text: The Company’s Information Security team is responsible for identifying, assessing, and mitigating cybersecurity risks. The Information Security team reports to the head of Information Technology, who reports to the Chief Technical Officer who reports to the Chief Executive Officer. The Information Security team also briefs the Security Committee (which consists of the Chief Technical Officer, CEO, CFO and Chief Legal Officer) regularly about the cyber threat landscape, their plans to mitigate cybersecurity risks and their responses to cybersecurity incidents.

companyName: QUINSTREET, INC

ticker: QNST


text: We have established a cybersecurity program, which includes maintaining policies and processes for assessing, identifying, and managing risks from cybersecurity threats, and have integrated these policies and processes into our overall risk management strategy. Our cybersecurity program is informed by standards established by the National Institute of Standards and Technology (NIST) and the Center for Internet Security (CIS).

companyName: Absci Corp

ticker: ABSI

secItem: Item 1C


text: Management Oversight The controls and processes employed to assess, identify and manage material risks from cybersecurity threats are implemented and overseen by our Information Technology and Facilities Director (the "ITFD"). Our ITFD is a third-party consultant, from whom we have a dedicated resource who specializes in the industry and has over 25 years of experience addressing cybersecurity risks. Our ITFD is responsible for the day-to-day management of the cybersecurity program, including the prevention, detection, investigation, response to, and recovery from cybersecurity threats and incident s, and is regularly engaged to help ensure the cybersecurity program functions effectively in the face of evolving cybersecurity threats. Our CFO oversees the ITFD and briefs our Board on cybersecurity matters, including the nature and design of our cybersecurity program, and threats, events, and program enhancements.

companyName: PLUS THERAPEUTICS, INC.

ticker: PSTV


text: The Company engages in the periodic assessment and testing of its policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of the Company's cybersecurity measures and planning. The Company regularly engages third parties to perform assessments on its cybersecurity measures, including information security materiality assessments and independent reviews of the Company's information security control environment and operating effectiveness. The results of such assessments and reviews are reported to the Audit Committee and the Board, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments and reviews.

companyName: Chiron Real Estate Inc.

ticker: XRN


text: We have integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. Our cybersecurity program is designed for assessing, identifying and managing material risks from cybersecurity threats to the confidentiality, integrity, and availability of our assets and information. Risk management is embedded into our IT processes and we continuously monitor risk by evaluating emerging threats and vulnerabilities.

companyName: Silk Road Medical Inc


text: As part of our risk management process, our cybersecurity risk management team oversees our vulnerability management practices and conducts routine application security assessments, yearly penetration testing, periodic security audits and ongoing risk assessments designed to identify cybersecurity risks to our environment. We continue to leverage third-party services for security operations through a dedicated managed security service provider to monitor and respond to cyber threats. This provider plays a critical role in, mitigating threats to our environment, as well as alerting and responding to events and incidents in close coordination with our internal team. For example, this provider performs searches across live and historical data to provide analysis based on threat intelligence and use cases to develop trends and data models to reduce false positives and enhance search criteria for future use. In addition to our routine practices, we also conduct testing, audits and assessments in connection with acquisitions, the implementation of new software, processes or activities requiring changes in our information technology environment, new cybersecurity events or developments and receipt of new risk intelligence. Further, we have adopted an enterprise-wide cybersecurity training and awareness program requiring all employees to complete annual cybersecurity training. The program is supported with monthly education and simulations with remedial training assignments to increase user awareness.

companyName: Montrose Environmental Group, Inc.

ticker: MEG


text: The Company uses third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats including, for example, managed cybersecurity service providers, cybersecurity software providers, penetration testing firms, and professional services firms, including legal counsel.

companyName: TerrAscend Corp.

ticker: TSNDF


text: To supplement our cyber risk management capabilities, we utilize certain third-party vendors. These vendors support our ability to proactively secure our network and systems, in addition to ongoing monitoring of our cyber environment. With respect to our management of cyber risks arising from third-party vendors, we utilize an internal risk assessment and monitoring program that includes the identification and ongoing review of third-party controls.

companyName: TRINET GROUP, INC.

ticker: TNET


text: Our management team is informed about and monitors the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above. In the last three fiscal years, we have not experienced any material cybersecurity incidents.

companyName: Elicio Therapeutics, Inc.

ticker: ELTX


text: STOC is responsible for overseeing the Company's technology program, including management's actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks. The Company's Chief Information Security Officer and its Chief Information Officer provide quarterly reports to the STOC regarding the information security program and the technology program, key enterprise cybersecurity initiatives, and other matters relating to cybersecurity processes. The Chief Information Security Officer also reports summaries of key issues, including significant cybersecurity and/or privacy incidents.

companyName: PROSPERITY BANCSHARES INC

ticker: PB


text: Business Continuity and Incident Response. The Company has established and maintains comprehensive business continuity, disaster recovery, and incident response plans that address the Company's response to cybersecurity incidents. We conduct periodic tabletop exercises and other testing of these plans to enhance incident response preparedness for potential disruption to technology we rely on in our business.

companyName: TTEC Holdings, Inc.

ticker: TTEC


text: The Company employs a robust system of information technology and cybersecurity controls across its enterprise to assess, identify, and manage material risks from cybersecurity threats. This framework is implemented and overseen by management's information security and compliance department, which is led by the Company's Vice President, IT Security & Compliance. The Vice President, IT Security & Compliance, who reports directly to Senior Vice President, Information Technology, has a Bachelor of Science in Commerce, with concentrations in management information systems and marketing, and has over 30 years' experience in all aspects of IT, including managing development, operations, cyber security, and other key areas. The Senior Vice President, Information Technology, has an Executive Technology Leadership Certificate in IT from Cornell University and has over 25 years of IT experience leading large-scale initiatives to enhance infrastructure and architecture based on emerging technologies and strategies. The Vice President, IT Security & Compliance and Senior Vice President, Information Technology, provide regular briefings for our senior management team on cybersecurity matters, including threats, events, and program enhancements. The Company also has a network of regional information technology directors stationed in each region where our resorts are located, who are integrated into the overall enterprise information technology security and compliance program. The Company references a recognized third-party cybersecurity framework to evaluate and manage cyber risk within the Company. We regularly benchmark against this framework and use the findings to develop our cybersecurity roadmap for ongoing evolution and improvement.

companyName: Playa Hotels & Resorts N.V.


text: We design and assess our cybersecurity risk management program against the National Institute of Standards and Technology Cybersecurity Framework (the "NIST Framework"). This does not imply that Okta, Inc.'s cybersecurity risk management program satisfies any particular specifications or requirements, only that we use the NIST Framework to guide our efforts to improve our security posture. Certain of our Okta Platform product offerings have attained multiple security certifications, the details of which are described in "Our Technology" under Part I, Item I of this Annual Report on Form 10-K.

companyName: Okta, Inc.

ticker: OKTA


text: Cybersecurity is an integral part of the Board's risk analysis and discussions with management. Our board of directors administers the Company's cybersecurity risk oversight function directly as a whole, as well as through the audit committee. At least annually, the full Board is updated on the Company's cybersecurity risks and risk mitigation strategy by the audit committee. The audit committee has access to advisors, and various other reports, and presentation materials related to cybersecurity threats, risk and mitigation. The Board also receives ad hoc updates, as needed, about material changes to the Company's cybersecurity program and/or the cybersecurity landscape, including briefings on major legislative and regulatory developments.

companyName: OXBRIDGE RE HOLDINGS Ltd

ticker: OXBR


text: Our IT Director has cybersecurity knowledge and skills gained from over 15 years of information technology experience at the Company and elsewhere. Under his supervision, the IT Department, with the advice of outside consultants, is responsible for developing, implementing, monitoring and maintaining cybersecurity and data protection practices across our business and reports directly to the Company's Vice President of Operations. The IT Director receives regular reports on cybersecurity threats from the internal cybersecurity team and reviews risk management measures designed and implemented by the Company to identify and mitigate data protection and cybersecurity threats. Our IT Director works with the General Counsel and other members of the Legal Department to oversee compliance with legal, regulatory and contractual security requirements. The IT Director also periodically attends the Board's Audit Committee meetings to report on developments impacting the IT Department and discuss annual cybersecurity goals and initiatives.

companyName: FORUM ENERGY TECHNOLOGIES, INC.

ticker: FET


text: The General Partner has written plans, procedures and policies that govern the Partnership's general information security program. The General Partner has a Risk and Control Self-Assessment ("RCSA") framework to help identify, measure, monitor and report important operational risks faced by the General Partner. Man Group has a Cyber Incident Response Plan ("CIRP") which dictates how the Partnership reviews and responds to security alerts, events and incidents. Pursuant to the written incident response plan, in the event of a cybersecurity incident, the security team first identifies the incident, triages, and responds. The General Partner's compliance team is also notified of the cybersecurity incident and, in conjunction with the legal team, assists in incident remediation and determining the materiality. As applicable, RCSAs are filed with the General Partner's operational risk team in order to keep the General Partner informed on cyber risks. Ultimately, an aggregate response to a cyber incident is reported to Man Group's risk committees, creating awareness and consideration of the top risks and overall levels of risk exposure.

companyName: MAN AHL DIVERSIFIED I LP

ticker: MADL


text: We have an in-depth approach to monitoring and addressing cybersecurity risk. Members of management together with our Board, the Audit Committee of the Board (the "Audit Committee"), our internal Cybersecurity and Data Privacy Steering Committee (a cross-functional team which includes members of our Executive Leadership Team), and the members of an enterprise risk management team (a task force comprised of senior representatives of the company assessing risk in the organization), have developed cybersecurity and risk management processes to adapt to the changing cybersecurity landscape and respond to emerging threats in a timely and effective manner.

companyName: HASBRO, INC.

ticker: HAS


text: While we have experienced minor cybersecurity threats in the past, such as spear phishing or smishing (SMS phishing), to date no such threats have materially affected the Company or our financial position, results of operations and/or cash flows.

companyName: Karman Holdings Inc.

ticker: KRMN


text: Various technical, physical, and organizational measures, processes, standards, and policies designed to manage and mitigate material risks from cybersecurity threats to our systems and data have been implemented and are maintained. These include risk assessments, incident detection and response, vulnerability management, disaster recovery and business continuity plans, internal controls within our accounting and financial reporting functions, encryption of data, network security controls, access controls, physical security, systems monitoring, employee training, and penetration testing.

companyName: CANNAPHARMARX, INC.

ticker: CPMD


text: The Board has oversight responsibility for risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements, cooperation with law enforcement, and related effects on financial and other risks. Senior management regularly discusses cyber risks and trends and, should they arise, any material incidents with the Board.

companyName: Getaround, Inc


text: The Audit and Compliance Committee meetings take place on a quarterly basis and include a report from our Chief Security Officer ("CSO") regarding our security programs, including (i) the status on activities under way to support our security strategy, (ii) an overview of the current threat landscape, including emerging threats and trends that may affect us, (iii) key performance measures of security operations, and (iv) general security program needs. The security program includes cybersecurity, privacy, physical security and information security risk management. Our senior security leadership team has an average of 20 years of data security experience, and each member has served in multiple roles within our security programs.

companyName: HCA Healthcare, Inc.

ticker: HCA


text: The Company has written cybersecurity incident response plans that are reviewed, and updated if necessary, at least annually. The plans identify cross-functional incident response teams which are comprised of representatives from management, including the Chief Information Security Officer (CISO) and General Counsel. The plans provide for notification to the Executive Committee of the Board of Directors and the full Board of Directors, as appropriate, of any actual or suspected significant cybersecurity incidents and require regular updates to these parties during the investigation of such incidents.

companyName: DILLARD'S, INC.

ticker: DDS


text: TEC's Information Security group of the Information Technology department has the direct responsibility for developing, monitoring, and enforcing information security standards and procedures; reviewing and approving all network interconnections for compliance to security standards; and assisting, consulting, and training individuals throughout TEC in the use of appropriate information security practices. This group is responsible for ensuring that all IT and OT cyber systems, assets, and networks are aligned with Emera and affiliate cybersecurity framework. TEC engages independent third party consultants from time to time to assess the adequacy of its cybersecurity measures and assist in implementing any appropriate actions to address any vulnerabilities identified. In addition, TEC participates in an Electric Power Research Institute (EPRI) research project to develop cybersecurity performance metrics. EPRI offers a web-based platform, which supports automated cybersecurity data collection, security metrics calculation, visualization, and analysis. The Vice President of Information Technology and Chief Information Officer (CIO), who reports to the President and Chief Executive Officer, oversees this group and is responsible for managing the program, in collaboration with TEC's businesses and functions. TEC's CIO has advanced degrees in computer science and extensive experience in cybersecurity and information technology, including many years of experience at large organizations leading cybersecurity, IT processes and controls, strategy, architecture, delivery and support of IT applications, and overseeing large groups of employees and contractors responsible for carrying out these responsibilities.

companyName: TAMPA ELECTRIC CO


text: Scanning Third-Party Emails and Attachments: To mitigate the risk of email-based threats, all incoming emails and attachments from third parties are scanned for malicious content. This ensures that potentially harmful materials are identified and quarantined before they can reach the end user.

companyName: AIBOTICS, INC.

ticker: AIBT


text: We perform an annual assessment to measure the maturity of our information security program in a manner aligned with the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF"). This does not imply that we meet any specific technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to implement controls to combat and respond to cybersecurity risks.

companyName: Funko, Inc.

ticker: FNKO


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of management, including our Chief Financial Officer, who oversees outsourced IT (including cybersecurity).

companyName: Verrica Pharmaceuticals Inc.

ticker: VRCA


text: The Company's Information Security Working Group ("ISWG") is actively engaged in managing cybersecurity risks and overseeing the design, implementation, and evaluation of the Program. The purpose of the ISWG is to define cybersecurity risk tolerance, guide implementation of the Program, monitor Program development and effectiveness, and validate investments in cybersecurity measures and infrastructure. Members of the ISWG include: the Chief Financial Officer, the Chief Legal Officer, the head of the Company's Human Resource department, the Senior Vice President of Program Management and Corporate Infrastructure, the Senior Vice President of Regulatory and Quality Assurance, and the Company's head of Information Technology. The group meets semi-annually to review the effectiveness of the Program, discuss any new developments and potential improvements to the Program, and evaluate internal and external security-related events to determine how Avalo can take appropriate steps to mitigate such risks.

companyName: Avalo Therapeutics, Inc.

ticker: AVTX


text: We maintain cybersecurity insurance and regularly consult with third-party cybersecurity experts during our review of cybersecurity controls in place. We also perform periodic assessments of our key vendors, which allows the Company to identify vendor cybersecurity risks and to develop reasonable mitigation plans.

companyName: BRINKS CO

ticker: BCO


text: Material Effects of Cybersecurity Threats Cybersecurity risks have the potential to materially affect the Company's business, financial condition and results of operation. The Company strengthened its cybersecurity framework in response to cyber attacks in 2016 and 2017 and does not believe that risks from cyber security threats or attacks have materially affected the Company since 2017. However, the sophistication of emerging cyber threats and the utilization of new attack methods continues to evolve. The Company's cybersecurity risk management and strategy may not protect against all cyber incidents. For more information on how cybersecurity risk may materially affect the Company's business strategy, results of operations or financial condition, please refer to Item 1A, Risk Factors of this Form 10-K.

companyName: NATIONAL BANKSHARES INC

ticker: NKSH


text: The Company follows an established process to identify and evaluate risks from cyber security threats that may arise internally or through the introduction of third parties to the ISMS. This evaluation is part of the Company's risk management process. The process may include, but is not limited to, evaluating the third party's cybersecurity maturity and/or imposing certain contractual conditions.

companyName: TUCOWS INC /PA/

ticker: TCX


text: The Board of Directors (the Board), with oversight from the Audit Committee, is responsible for the governance of cybersecurity risks. The Audit Committee receives regular updates from management on cybersecurity risks and incidents, ensuring that the Board is kept informed. Management, led by the Chief Executive Officer (the "CEO"), is responsible for implementing the cybersecurity program, monitoring the company's risk posture, and reporting to the Audit Committee and the Board regarding cybersecurity-related risks. The CEO works closely with external consultants and vendors, including IntellectMap, to ensure that we stay current with industry standards and best practices.

companyName: Galera Therapeutics, Inc.

ticker: GRTX


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing the Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.

companyName: Confluent, Inc.

ticker: CFLT


text: Under the Company's cybersecurity governance framework, the Board has overall responsibility for overseeing management's establishment and operation of a cybersecurity program. Members of the Board have broad-based skills in risk management oversight and/or cybersecurity oversight certifications. The Board delegates certain cybersecurity oversight responsibilities to the Risk Oversight Committee, which oversees enterprise risk, vendor management, and information technology risks, including assessing and managing cybersecurity and data privacy risks, and to the Audit Committee, whose oversight responsibility includes, as part of its oversight of the Company's system of internal controls over financial reporting, assessing and managing financial risk exposures, including information technology, cybersecurity and data privacy risk related to the Company's financial systems. The Risk Oversight Committee has specific responsibility for overseeing information technology processes and controls, including for cybersecurity, data privacy, compliance with related policies, and the process to monitor risks to the Company arising from changing technology trends, and coordinates with the Audit Committee, as needed.

companyName: ASSURED GUARANTY LTD

ticker: AGO


text: The CISO is responsible for developing and implementing our information security program and reporting on cybersecurity matters to the Audit Committee. Our CISO has a decade of experience leading cyber security oversight. Members of the security team have cybersecurity experience and certifications, such as the Certified Information Systems Security Professional certification. We regularly conduct training and/or simulations to ensure employees are aware of current cyber threats. Additionally, periodic tabletop exercises at a management level incorporate external advisors. All employees are required to complete cybersecurity training annually. We also require employees in certain roles to complete additional role-based, specialized cybersecurity training.

companyName: Fossil Group, Inc.

ticker: FOSL


text: Elements our cybersecurity information technology measures include efforts to identify, prevent, detect, mitigate, and remediate cybersecurity risks and incidents through: • Cybersecurity risk assessments for identification of material cybersecurity risks to our critical systems, information, products, and our technology environment; • Security personnel and vendors responsible for managing our cybersecurity risk assessment processes, our security controls, and our response to cybersecurity incidents; • Training and awareness programs for our personnel and senior management to drive adoption and awareness of cybersecurity processes and information technology measures; • A cybersecurity monitoring program responsible for tools that produce alerts and reports of suspicious activity for the prevention of and response to cybersecurity incidents; • Internal testing and assessments, where appropriate, of our cybersecurity information technology measures; • Management of external consultants and services engaged by us, where appropriate, to assess, test, or otherwise assist with aspects of our cybersecurity information technology measures; and • A third-party risk management process for evaluating cybersecurity threats associated with our use of service providers, suppliers, and vendors.

companyName: Cenntro Inc.

ticker: CENN


text: For a description of the risks from cybersecurity threats that may materially affect the company and how they may do so, please see "Risk Factors – Risks Related to Employees, Managing Our Growth and Other Legal Matters."

companyName: Equillium, Inc.

ticker: EQ


text: Overseeing our cybersecurity efforts and guiding our security initiatives is our Chief Information Officer, who brings over 25 years of experience in leadership roles managing cybersecurity and large-scale IT environments across both private and public sectors. Additionally, our team members involved in the security program are acquiring the necessary skills and knowledge to address emerging cybersecurity challenges.

companyName: META MATERIALS INC.


text: The Strategy and Risk Committee of the Board of Directors oversees the Company's cybersecurity risks and strategy. A member of the committee has a bachelor and doctoral degrees relevant to and experience in cybersecurity and information technology trends. Management provides the Strategy and Risk Committee periodic reports on cybersecurity risks, risk mitigation in place and planned, and any material cybersecurity incidents. These reports are provided to our Board of Directors. If a material cybersecurity incident were to occur, the Audit Committee would oversee the financial reporting and disclosure and law compliance aspects.

companyName: DAKTRONICS INC /SD/

ticker: DAKT


text: The Company's Board will be involved in overseeing our risk management processes and policies that may be implemented from time to time. The audit committee will coordinate these activities through regular interactions with the Company's management outlined above including but not limited to: presentations regarding recent developments, potential risks associated with third parties, emerging trends, any relevant findings or any incident that rises to the level of established thresholds.

companyName: Actinium Pharmaceuticals, Inc.

ticker: ATNM


text: Our internal team of cybersecurity and data privacy professionals oversee, among other things, our cybersecurity risk management and mitigation, incident prevention, detection, and remediation. The leadership of these teams is comprised of various professionals with cybersecurity expertise, including our Executive Vice President of Information Security and Disaster Recovery, who reports to our Chief Operating Officer. Our Executive Vice President of Information Security and Disaster Recovery has a bachelor's degree in computer information systems, multiple university certifications in advanced cybersecurity, and over 30 years' experience in cybersecurity and technology roles at various companies. Our executive leadership team, with input from the above teams, is responsible for our overall enterprise risk management system and associated processes, and regularly considers cybersecurity risks in the context of other material risks to the Company. Risk Management Program Components, Training, and Incident Response.

companyName: USANA HEALTH SCIENCES INC

ticker: USNA


text: The Board's oversight of cybersecurity risk is supported by our CIO. The CIO attends ERMC meetings and provides cybersecurity updates to these Board committees on a quarterly basis. Our CRO, in conjunction with our CIO, facilitates the involvement of the ERMC in oversight of potentially significant cybersecurity incidents.

companyName: Primis Financial Corp.

ticker: FRST


text: Seaboard's information security program and the Information Security Team is led and managed by a dedicated Director of Information Security (the " IS Directo r"). The IS Director, whose experience includes over eight years in information security leadership roles and relevant certifications, brings appropriate expertise to Seaboard's information security program. The IS Director's experience and knowledge are crucial to the ongoing development and execution of Seaboard's information security program.

companyName: SEABOARD CORP /DE/

ticker: SEB


text: As part of our overall risk management system we maintain comprehensive policies and processes for assessing, identifying and managing material risks from cybersecurity threats, including risks relating to production, safety, reputation, intellectual property, procurement and business continuity. Cybersecurity risk management is included as part of our overall annual Enterprise Risk Management program. As part of this program, our enterprise risk professionals consult with internal cybersecurity subject matter experts to identify cyber risks and evaluate their severity and the efficacy of our mitigation efforts, with the results being reported to the executive leadership team and the Board of Directors.

companyName: Tronox Holdings plc

ticker: TROX


text: The Company is constantly evolving its information security strategy and responses for new and emerging threats. As of the date of this Annual Report on Form 10-K, the Company has not encountered risks from cybersecurity threats that have materially affected, or are reasonably likely to materially affect, the Company's business strategy, results of operations or financial position.

companyName: INGLES MARKETS INC

ticker: IMKTA


text: We utilize a seasoned and mature artificial intelligence-based security system that learns and monitors the actions of individuals that have access to our networks and systems, including location of access (notably from international locations), email, and SAAS platforms that we don't host. The system not only protects based off of the specific rules implemented, it also takes action based on user activity (including remote access to our systems by our employees) that is outside their normal behavior pattern. Additionally, our employees go through cybersecurity awareness training as part of their onboarding procedures.

companyName: Vivos Therapeutics, Inc.

ticker: VVOS


text: Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology environment.

companyName: IDEAYA Biosciences, Inc.

ticker: IDYA


text: We conduct risk assessments to evaluate the effectiveness of our systems and processes in addressing threats and to identify opportunities for enhancements. Additionally, we conduct privacy and cybersecurity reviews, as well as annual employee training, and monitor emerging laws and regulations related to information security and data protection. We utilize third party tools and techniques to test and enhance our security controls, perform annual cybersecurity framework assessments, conduct ongoing penetration testing of our systems, and benchmark against industry practices. Our internal audit function provides independent assessment on the overall operations of our cybersecurity program and the supporting frameworks.

companyName: Riot Platforms, Inc.

ticker: RIOT


text: if necessary, the use of third -party security experts if and when an incident is detected We are not aware of having experienced any material cybersecurity incidents. We are not aware of any existent cybersecurity threats that would materially affect, or are reasonably likely to materially affect, our business strategy, results of operations or financial conditions. For more information, please see "Cybersecurity" under Item 1A "Risk Factors" above.

companyName: FUEL TECH, INC.

ticker: FTEK


text: Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. Further, a cyber incident impacting our systems or a third-party's systems could subject us to business, regulatory, litigation and reputational risk, which could have a negative effect on our business, results of operations and financial condition. For more information on our cybersecurity related risks, see Item 1A Risk Factors of this Annual Report.

companyName: Dominari Holdings Inc.

ticker: DOMH


text: The Information Security Office conducts company-wide cybersecurity training, including through an annually required course of online training modules and a continuous email phishing test campaign. In addition, the CISO leads periodic cybersecurity tabletop exercises with company leadership to continually improve the organization's preparedness for cyber incidents. These exercises consider real-world events that could impact the business and seek to fine-tune response activities in an effort to minimize future cybersecurity incident impacts.

companyName: James River Group Holdings, Inc.

ticker: JRVR


text: Identification —monitor information technology systems and detect deviations from normal operations and see if they represent actual security incidents. When an incident is discovered, collect additional evidence, establish its type and severity, and document the incident. Containment —perform short-term containment, for example by isolating the network segment that is under attack;

companyName: WYTEC INTERNATIONAL INC

ticker: WYTC


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also periodically receives briefings from management on our cyber risk management program.

companyName: Lyra Therapeutics, Inc.

ticker: LYRA


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example maintaining an incident response plan and policies, maintaining disaster recovery and business continuity plans, conducting risk assessments, encrypting certain data, maintaining network security controls, segregating data, maintaining access controls, monitoring systems, conducting periodic employee training, penetration testing, asset management tracking and disposal, physical security measures, and physical security controls.

companyName: Artiva Biotherapeutics, Inc.

ticker: ARTV


text: The Company employs a number of tools and services, such as network monitoring and vulnerability assessments to inform our risk identification and assessment processes. We also maintain an incident response plan that outlines processes designed to triage, assess the severity of, escalate, contain, investigate, and remediate cybersecurity incidents while also complying with relevant legal obligations. Our employees receive cybersecurity awareness and sensitive information protection training on a regular basis, which we also periodically test for effectiveness through simulations, which may include simulated phishing emails and tabletop exercises. Additionally, the Company regularly makes assessments related to the potential impact of a security incident at a third-party vendor, service provider or customer or otherwise implicating the third-party technology and systems the Company uses. We also maintain cybersecurity risk insurance.

companyName: VINCE HOLDING CORP.

ticker: VNCE


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, the Company's information security function works with management, including our Chief Operating Officer ("COO") to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.

companyName: Minerva Neurosciences, Inc.

ticker: NERV


text: The Audit and Examination Committee of our board of directors is responsible for overseeing our information and cybersecurity risk management program, including management's actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks. Our Information Security Officer provides quarterly reports to the Audit and Examination Committee of our board of directors regarding the information security program, cybersecurity and/or privacy incidents, key cybersecurity initiatives, and other matters relating to cybersecurity processes. These reports may occur more frequently if a significant issue or incident is being addressed.

companyName: CITIZENS FINANCIAL SERVICES INC

ticker: CZFS


text: Key elements of our cybersecurity risk management program include but are not limited to the following: • risk assessments designed to help identify material cybersecurity risks to our critical systems and information; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers and vendors based on their criticality and risk profile.

companyName: Four Corners Property Trust, Inc.

ticker: FCPT


text: Cybersecurity threats have not significantly impacted our operations, and we do not anticipate such risks materially affecting our business, strategy, financial condition, or results of operations.

companyName: NETWORK CN INC

ticker: NWCN


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: an incident response plan; incident detection and response; disaster recovery and business continuity plans; implementation of security standards; network security controls; access controls; system monitoring; and employee training.

companyName: Milestone Pharmaceuticals Inc.

ticker: MIST


text: Our audit committee also receive prompt and timely information regarding any cybersecurity incident that meets establishing reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. To date, we have not experienced any cyber security incident.

companyName: Bio Green Med Solution, Inc.

ticker: BGMS


text: Education and Awareness We monitor emerging laws and best practices related to data protection, privacy and information security. We regularly remind employees of the importance of handling and protecting customer and employee data, and our policies require each of our employees to undergo annual privacy and information security training designed to enhance employee awareness of how to detect and respond to cybersecurity threats.

companyName: Bandwidth Inc.

ticker: BAND


text: The Company has implemented a Cybersecurity Incident Response Plan (CSIRP), which is integrated into its Master Business Continuity Plan, to identify, assess and respond to cybersecurity threats. The CSIRP provides a well-defined, consistent, and organized approach to information security related incidents and is supplemented by playbooks designed to respond to specific attacks. The CSIRP requires approval by the Executive Leadership Team under the Cybersecurity Committee and is governed by the Continuity of Operations Policy that is approved annually by the Board of Directors.

companyName: WSFS FINANCIAL CORP

ticker: WSFS


text: As of the date of this Annual Report on Form 10-K, we do not believe that known risks from cybersecurity threats, including as a result of any previous cybersecurity incident that we are aware of, have materially affected or are reasonably likely to materially affect us, including our business strategy results of operations or financial condition. However, we can give no assurance that we have detected or protected against all such cybersecurity incidents or threats or that we will not experience such an incident in the future. Further details about the cybersecurity risks we face are described under "Risks Related to Information Technology, Cybersecurity and Data Protection" in Item 1A. "Risk Factors" of this Annual Report on Form 10-K.

companyName: RESOURCES CONNECTION, INC.

ticker: RGP


text: We engage third-party service providers to conduct evaluations of our cybersecurity controls through penetration testing, independent audits and consulting on best practices to address existing and new challenges. These evaluations include testing the design and operational effectiveness of our cybersecurity controls. Going forward, we are committed to conducting these evaluations at least annually. To further enhance the capabilities of our internal systems, we utilize third-party vendors to provide extended coverage of our information technology and operational technology environments. We also share and receive threat intelligence with companies in the energy sector, government agencies, information sharing and analysis centers and cybersecurity associations in order to monitor and address developments in the cybersecurity environment.

companyName: TALOS ENERGY INC.

ticker: TALO


text: Our cybersecurity incident response plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our internal disclosure committee and our senior leadership team. Senior leadership team members work with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response plan provides for reporting of certain cybersecurity incidents to the Audit Committee.

companyName: Vital Farms, Inc.

ticker: VITL


text: Our incident response and recovery planning is a key component of our cybersecurity efforts. We have developed and documented an incident response plan that outlines specific procedures for identifying, containing, and remediating cyber incidents. Regular testing of this plan ensures its effectiveness, with adjustments made as necessary. Furthermore, we maintain backups of essential data and systems to enable swift recovery from any cyber incidents.

companyName: MONARCH CASINO & RESORT INC

ticker: MCRI


text: As of the date of this Annual Report, there have been no cybersecurity threats that have materially affected or are reasonably likely to materially affect our business, operations, or financial condition. For more information on how cybersecurity risk could materially affect our company's business strategy, results of operations, or financial condition, please refer to the "Risk Factors" section of this Annual Report.

companyName: STREAMLINE HEALTH SOLUTIONS INC.


text: The Director, IT plays a pivotal role in our cybersecurity framework, actively identifying and assessing risks from cybersecurity threats. This is achieved through a variety of methods, including but not limited to, extensive audits, detailed assessments, and the engagement of outside cybersecurity consultants. In addition to these existing strategies, we have implemented several processes to increase our ability to identify, monitor, and assess material cybersecurity threats.

companyName: Cidara Therapeutics, Inc.


text: Cybersecurity is an important part of our risk management processes and an area of focus for our board of directors and management. Our board of directors will discuss with management our cybersecurity threat risk management and processes surrounding material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. Management has engaged a reputable third-party to assist in monitoring the Company's cybersecurity risks which will be communicated to the Chief Financial Officer. The board will receive prompt and timely information from the Chief Financial Officer regarding any cybersecurity incident, as well as ongoing updates regarding any such incident until it has been addressed. Members of the board of directors are also encouraged to regularly engage in conversations with management on cybersecurity-related news events.

companyName: Cryomass Technologies, Inc.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program and shares common methodologies, reporting channels, and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas. Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems and information; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, including our incident response personnel; • tabletop exercises conducted at the management level to ensure the Company is prepared in the event of a cybersecurity incident and to help identify areas of improvement for the cyber security incident response and risk management programs; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents, cybersecurity resilience and recovery; and • a third-party risk management process for service providers, suppliers, and vendors who access our critical systems and data.

companyName: ENERPAC TOOL GROUP CORP

ticker: EPAC


text: Our Vice President – IT, Biren Kumar, has more than 16 years of experience serving as a Chief Information Officer ("CIO") or similar role, which included responsibility for managing cybersecurity risk. Mr. Kumar was named Vice President – IT in 2024. Prior to joining Antero, he served as the CIO for several companies, including Dynegy Inc. from 2005 to 2011, Rockwater Energy Solutions Inc. from 2011 to 2014, KLX Inc. from 2014 to 2018 and KLX Energy Services Holdings, Inc. from 2018 to 2021. Mr. Kumar holds a Bachelor of Business Administration in Management Information Systems and a Master of Business Administration from the University of Houston.

companyName: Antero Midstream Corp

ticker: AM


text: We are committed to continuously improving our cybersecurity program as we recognize the ever-evolving nature of cybersecurity threats and the need to adapt our measures accordingly. We plan to focus on expanding our cybersecurity leadership, resources and expertise, and enhancing our governance and processes.

companyName: STERLING INFRASTRUCTURE, INC.

ticker: STRL


text: The second line of defense independently evaluates, monitors, and challenges our risk mitigation efforts to proactively identify cybersecurity risks, including early-stage engagement and risk management with emerging threats. Second line teammates provide effective challenge to the cybersecurity risk management efforts of the first line through ongoing engagement in problem incidents, regular reviews of cybersecurity risk reporting, and inquiries into the sufficiency of risk management activities. Our second line of defense leads our Management Risk and Compliance Committee, which governs our technology and operational risk tolerances, including cybersecurity and third- and fourth party provider risks. This committee includes the Information Security Officer, the SVP of IT and the Chief Risk Officer. The Committee is responsible for escalating key risks to our Executive Leadership Team.

companyName: Village Bank & Trust Financial Corp.


text: In recognition of these risks, we have implemented a comprehensive risk management framework that includes: • Continuous monitoring of our networks and systems for signs of unauthorized activity. • Regular updates to our cybersecurity measures to address new vulnerabilities and threats. • Collaboration with industry partners and government agencies to share information on threats and best practices for cybersecurity. • Maintaining cyber insurance to mitigate the financial impact of potential cybersecurity incidents.

companyName: AppTech Payments Corp.

ticker: APCX


text: We have implemented a cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.

companyName: MANHATTAN BRIDGE CAPITAL, INC

ticker: LOAN


text: Our Chief Information Officer and our Chief Information Security Officer meet annually with the full Board, and periodically, but generally at least quarterly, with the Chief Executive Officer, Chief Operations Officer, and Audit Committee to review the company's information technology systems and discuss key cybersecurity risks. Our Chief Information Security Officer has direct access to the Chair of our Audit Committee and keeps the Audit Committee apprised of any developments that may emerge in between regularly scheduled meetings that require its attention. Additionally, our Incident Response Plan includes escalation protocols to raise occurrences that require attention from the Audit Committee or the board of directors as a whole.

companyName: CHARLES RIVER LABORATORIES INTERNATIONAL, INC.

ticker: CRL


text: Strong performance and reliability of the Company's technology systems are critical to operating safely and effectively, and protecting personal and customer data is essential to maintaining stakeholder trust. The Company has implemented processes designed to assess, identify, and manage material cybersecurity risks, as described further below. CSX maintains a cybersecurity framework that is integrated across the organization through people, processes and technology to help protect the personal information of its customers, its contractors and its suppliers as well as protect the integrity of its own operations. Cybersecurity is also integrated into the Company's Enterprise Risk Management ("ERM") program. The Company equips CSX systems with various cybersecurity tools, conducts vulnerability scans and provides critical cybersecurity information to application users, as appropriate. The Company also takes proactive measures to advise CSX employees of how they can assist the Company in its cybersecurity practices. CSX informs employees on cybersecurity best practices, including how to identify cyber-related suspicious activity, how to report such activity and, as appropriate, proactive measures employees can take to safeguard company information and devices. The Company also provides cybersecurity awareness training to employees and conducts cybersecurity testing exercises to help maintain cybersecurity vigilance. With the assistance of third-party consultants, the Company conducts an annual cybersecurity exercise, which is often a "tabletop" scenario involving a cross-functional group responding to a hypothetical cybersecurity threat.

companyName: CSX CORP

ticker: CSX


text: The Audit Committee of our Board oversees risk from cybersecurity threats. The Audit Committee of the Board and the full Board each receive quarterly updates on cybersecurity risks identified through the enterprise risk management processes described above.

companyName: InterDigital, Inc.

ticker: IDCC


text: The Board of Directors is responsible for oversight of the Company's cybersecurity program and the Company's responses to cybersecurity risk. The Board of Directors has delegated to its SETO Committee responsibility for the oversight and review of technology policy, strategy and governance, and cybersecurity issues that could impact the Company's operational performance or risk profile. The SETO Committee meets at least quarterly and receives reports related to cybersecurity threats, trends and risks, and related mitigation activities. In addition, the SETO Committee and the Board of Directors receive reports of periodic external assessments and internal testing of the effectiveness of the Company's cybersecurity program. The SETO Committee coordinates with the Audit, Finance and Risk Committee, as appropriate, on matters related to cybersecurity risk. The Audit, Finance and Risk Committee is responsible for, among other things, overseeing the adequacy and effectiveness of the Company's system of internal controls and the Company's risk assessment and management strategy, including with respect to cybersecurity risks.

companyName: American Water Works Company, Inc.

ticker: AWK


text: In addition to the risk management activities undertaken under the ERM Program, where management assesses and manages material risks from cybersecurity threats, our security and technological infrastructure team led by Technology Infrastructure and Security Manager, is responsible for day-to-day identification, assessment and management of the information security risks we face. Personnel in our security and infrastructure team collectively have decades of experience in information security, information technology and cybersecurity operations. These personnel are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents detected through automated detection and monitoring tools. The team manages and continually enhances the Company's enterprise security structure with the goal of preventing cybersecurity incidents to the extent feasible, while simultaneously increasing our system resilience to minimize the business impact should an incident occur. In the event of a cybersecurity incident, the Company is equipped with an incident response plan that includes procedures such as: (i) reporting of the incident through a ticket management tool designated by the Company, (ii) identification and analysis, (iii) monitoring, containment, and eradication, (iv) remediation and creation of controls, and (v) lessons learned and preparation for future incidents. The Technology Infrastructure and Security Manager provides regular updates to the Board concerning the Company's technology and cybersecurity programs, associated risks and the Company's efforts to help mitigate those risks.

companyName: Clever Leaves Holdings Inc.

ticker: CLVR


text: The Company has an information security program and procedures in place to protect, identify, detect, respond to and manage reasonably foreseeable cybersecurity risks and threats. The Company uses various security tools that help prevent, identify, investigate, resolve and recover from identified vulnerabilities and security incidents to protect our information systems and data from cybersecurity threats. This framework is implemented and overseen by management's information security department which is led by the Information Technology ("IT") Support Associate Director and overseen by the Company's IT Steering Committee. The IT Support Associate Director has over twenty years of experience in technology management and cybersecurity. The IT Steering Committee is comprised of the Company's two Associate IT Directors, the CEO, and CFO and convenes quarterly to review IT control policies and procedures are properly followed and any new employees were properly onboarded in compliance with security procedures.

companyName: RAVE RESTAURANT GROUP, INC.

ticker: RAVE


text: Cybersecurity risk management is integrated into the Company's enterprise-wide risk management. Our Board has overall oversight responsibility for our risk management and management is responsible for identifying, considering, and assessing material risks to the Company.

companyName: NIOCORP DEVELOPMENTS LTD

ticker: NB


text: We maintain a written Information Security Policy, which establishes the foundational components of our cybersecurity program and our high-level security responsibilities over all technologies, facilities and data. When engaging service providers and third-party vendors, we perform due diligence to assess whether these providers have appropriate privacy and security controls, and we generally require these providers to implement appropriate protective measures, and to use confidential information solely for the purposes of performing their services.

companyName: GARTNER INC

ticker: IT


text: As a leader in Information Management and cybersecurity we recognize the importance of assessing, identifying, and managing risks associated with cybersecurity threats. These risks include, among other things, operational risks; intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy or security laws and other litigation and legal risk; and reputational risks. At OpenText, cybersecurity risk management is an integral part of our overall enterprise risk management program. Our cybersecurity risk management program aligns with industry best practices such as the National Institute of Standards and Technology (NIST) Cybersecurity Framework 2.0, and the International Organization for Standardization (ISO)/International Electro-technical Commission (IEC) ISO/IEC 27001 standard. This provides a framework for identifying, monitoring, evaluating, and responding to cybersecurity threats and incidents, including those associated with the use of our software, applications, services, and cloud and hybrid infrastructures developed or provided by third-party vendors and service providers. Our framework includes steps for identifying the source of a cybersecurity threat or incident, assessing the severity and risk of a cybersecurity threat or incident, implementing cybersecurity mitigation or remediation strategies, and informing our management and our Board of material cybersecurity threats and incidents.

companyName: OPEN TEXT CORP

ticker: OTEX


text: In addition, the Audit Committee of the Board monitors internal audit's coverage of cybersecurity governance, risks, and related controls, including any identified deficiencies, that could adversely affect the ability to record, process, summarize, and report financial data. The Risk Committee coordinates with the Audit Committee for review of information security matters, as needed.

companyName: FIRST CITIZENS BANCSHARES INC /DE/

ticker: FCNCA


text: The Company has a dedicated cybersecurity team that collaborates with compliance, privacy, legal, and other teams across the global organization to assess the risk landscape. ADM's cybersecurity program is designed to be aligned with applicable industry standards and is assessed regularly by independent third-party auditors. The multifaceted nature of the Company's cybersecurity measures includes aspects of prevention, detection, and response capabilities, employee training programs, threat intelligence monitoring, and the implementation of an array of technologies. The Company has established processes to oversee and identify cybersecurity risks associated with the use of third-party service providers, which include the completion of due diligence before engaging with any third party, controls for response to mitigate any significant risks, and assessments and reviews during the course of the relationship. Additionally, the Company has ongoing partnerships with government and commercial cybersecurity experts to understand emerging cybersecurity threats.

companyName: Archer-Daniels-Midland Co

ticker: ADM


text: Our corporate information security organization, led by our Chief Information Security Officer (CISO), who reports to our CIO, is responsible for our overall information security strategy, policy, security engineering, operations and cyber threat detection and response. Our CISO has more than 20 years of experience in the field of information security and holds multiple cybersecurity certifications including the designation of Certified Information Systems Security Professional.

companyName: TEXTRON INC

ticker: TXT


text: The Board of Directors has delegated oversight of risks related to the Company's information system controls and security to the Audit Committee of the Board of Directors. Our cybersecurity program is managed by the Chief Financial Officer (CFO), who has over 20 years of business experience as well as a general familiarity with cybersecurity matters and an understanding of the potential financial impacts, disclosure obligations, and enterprise risks to the Company as they relate to cybersecurity. The CFO updates the Audit Committee on cybersecurity matters. The Audit Committee updates the full Board of Directors with respect to cybersecurity matters.

companyName: Stardust Power Inc.

ticker: SDST


text: The Audit Committee of our Board of Directors is responsible for overseeing management's processes for identifying and mitigating risks that affect our operations, including cybersecurity risks. Procedures for assessing, identifying and managing cybersecurity-related risks are incorporated into our overall risk management framework. Senior leadership regularly briefs the Audit Committee and the full Board of Directors on our cybersecurity and information security posture and the Audit Committee is apprised of cybersecurity incidents deemed to pose a critical risk to our information technology ("IT") assets or business. We have an incident response playbook that outlines the steps to be followed from incident detection to mitigation, recovery and notification, including notifying key functional areas, such as legal and financial reporting, as well as senior leadership and the Audit Committee, as appropriate. We rely upon in-house and cybersecurity vendors to monitor our IT systems and assets and have a governance structure and processes to assess, identify, manage, and report cybersecurity risks.

companyName: vTv Therapeutics Inc.

ticker: VTVT


text: Management positions directly responsible for assessing, measuring, and managing cybersecurity risks include the Chief Information Security Officer ("CISO") and the Chief Technology and Operations Officer ("CTOO"). The current CISO has more than 20 years of technology leadership experience, including a significant period directly leading cybersecurity efforts, and holds multiple industry certifications. The CTOO has more than 25 years of audit, risk, operations, and technology leadership experience, including prior assignments as the Bank's Chief Audit Executive and Director of Bank Operations. The CISO and CTOO regularly report information about cybersecurity risks to the Board or a committee of the Board.

companyName: ZIONS BANCORPORATION, NATIONAL ASSOCIATION /UT/

ticker: ZION


text: For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," including "Risk Factors—Risks Related to Our Business, Industry, and Operations: If we experience a security breach or incident affecting our customers' assets or data, our data or IoT devices, our Data Platform, or other systems, our Connected Operations Cloud may be perceived as not being secure or safe, our reputation may be harmed, and our business could be materially and adversely affected." and elsewhere in this Annual Report on Form 10-K.

companyName: Samsara Inc.

ticker: IOT


text: We describe whether and how risks from identified cybersecurity threats, including as a result of previous incidents, may materially affect, or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Failure to maintain the integrity of internal or customer data or to protect our systems from cyber-attacks could disrupt our business, damage our reputation, and subject us to significant costs, fines or lawsuits" included as part of our risk factor disclosures included in Part I, Item 1A of this Annual Report filed on Form 10-K.

companyName: Travel & Leisure Co.

ticker: TNL


text: We have been subject to attempted cybersecurity attacks from time to time, and will likely continue to be subject to such attempted attacks; however, these prior attacks have not had a material impact on our system or business operations. For information about cybersecurity risks to our business, see Item 1A. Risk Factors and the risk factor titled "Our operations are subject to risks beyond our control, including but not limited to, cybersecurity intrusions, terrorist or other physical attacks, acts of war, or unauthorized access to personally identifiable information."

companyName: WISCONSIN ELECTRIC POWER CO

ticker: WELPP


text: Our security operations team is responsible for detecting, mitigating, and responding to cybersecurity threats through a network of technologies, capabilities, and best practices on a 24/7 basis. This team consists of both internal employees located in several countries as well as a partner organization who supports our security operations team 24/7.

companyName: Crane NXT, Co.

ticker: CXT


text: The ROC is responsible for reviewing reports from management related to enterprise-wide risk management efforts, including cybersecurity risks. As part of this oversight, the ROC conducts an annual review and approval of information security policies and programs, and receives regular updates on key risk indicators, threat trends, risk remediation activities, and operational events. The ROC regularly reports on this oversight, including cybersecurity, to the Board. Management employs multiple real-time and interval-based monitoring and reporting mechanisms to detect and respond to cybersecurity incidents, and may also engage third parties to assist in these efforts. Documented escalation procedures are regularly tested through tabletop exercises and other activities, including notification to executive management during qualifying cybersecurity incidents.


text: We periodically assess and test our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. The Company regularly engages third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported, as appropriate, to the Risk Committee, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.

companyName: MARKETAXESS HOLDINGS INC

ticker: MKTX


text: Regions regularly tests and assesses its environment so it can update and maintain its systems and controls to mitigate the risks from cyber threats and vulnerabilities. These include risk assessments and penetration testing as well as testing against security controls. Layered security controls are designed and maintained to complement each other and enhance risk mitigation efforts. Regions will continue to develop and enhance controls, processes and technology to respond to evolving disruptive technology and to protect its systems from attacks or unauthorized access. In addition, Regions' TPRM function establishes the risk-based framework that governs all associates, subsidiaries, and affiliates who are engaged in the sourcing, planning, risk assessment, due diligence, contracting, ongoing monitoring, and governance of vendor engagements, including those that present cybersecurity risks for Regions. The TPRM framework includes the initial inherent-risk assessment conducted at onboarding and the applicable due diligence risk assessments, based on the engagement's risk profile. Upon completion of the applicable due diligence, the contract is constructed and negotiated, with efforts made to ensure appropriate terms are in place to further mitigate the risks presented. Thereafter, each engagement is reassessed on the established cadence associated with the inherent-risk tier, and performance scorecards are competed to ensure optimal delivery and to denote material changes in the engagement.

companyName: REGIONS FINANCIAL CORP

ticker: RF


text: We implement and maintain various technical, physical, and organizational measures, processes, and policies, designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example, an incident detection and response plan; vulnerability management processes; risk assessments; implementation of security standards; encryption of certain data; network security controls; segregation of certain data; access controls including multi-factor authentication for certain Information Systems and Data; physical security; asset management, tracking and disposal; systems monitoring; vendor risk management program; employee training; penetration testing; and cybersecurity insurance. Our assessment and management of material risks from cybersecurity threats is integrated into the Company's overall risk management processes. For example, our information technology department presents updates on our IT environment and cybersecurity threats to the audit committee of the board of directors, which evaluates our overall enterprise risk and the effectiveness of our risk management approaches.

companyName: Bolt Biotherapeutics, Inc.

ticker: BOLT


text: Board of Directors Oversight responsibilities for our cybersecurity and digital trust compliance programs and risks lie with the Audit Committee of the Board. The Board is actively engaged in the oversight of our cybersecurity program and oversees all operational, financial, strategic, and reputational risks with oversight of specific risks undertaken with the committee structure including risks related to cybersecurity, privacy, and technology.

companyName: Baker Hughes Co

ticker: BKR


text: Our cybersecurity program is regularly assessed to ensure it meets the ever-changing cyber risk environment. This is accomplished via monthly risk assessment meetings performed by our technical cybersecurity committee, periodic risk assessments and audits performed by internal audit, and cyber tests and assessments performed by contracted consultants.

companyName: SAFETY INSURANCE GROUP INC

ticker: SAFT


text: Material Cybersecurity Incidents We are not aware of any cybersecurity incidents that have materially impaired our operations or financial reporting responsibilities or performance historically.

companyName: Orion Group Holdings Inc

ticker: ORN


text: Prior to the consummation of our Business Combination on February 9, 2024, we had no business operations and Quantum was a special purpose acquisition company with no business operations. Since Quantum's IPO, its sole business activity has been identifying and evaluating acquisition transaction candidates. We have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our management oversees the assessment and management of cybersecurity threats. In the event of any reportable cybersecurity incident, our management shall promptly notify our board of directors, including determining the necessary actions such as disclosure, mitigation, or other appropriate responses. Quantum has not encountered any cybersecurity incidents since its IPO.

companyName: AtlasClear Holdings, Inc.

ticker: ATCH


text: Our Chief Business and Legal Officer and our security governance steering committee, which includes our Controller, Vice President of HR, Vice President of Program Management and Manager of IT/IS, are primarily responsible for assessing and managing our risks from cybersecurity threats. Our Chief Business and Legal Officer has more than a decade of operational experience overseeing and advising on risk management in the highly regulated biopharmaceutical industry, and leads a wide range of business functions, including IT/IS. Our Manager of IT/IS has over 20 years of experience with IT, with an emphasis on cybersecurity over the past two years. They and other members of our security governance steering committee engage in training and education relating to cybersecurity risk.

companyName: Lexeo Therapeutics, Inc.

ticker: LXEO


text: Our board of directors has delegated oversight of our Cyber Risk Program to the Risk Committee of the board of directors. The presentations to the Risk Committee cover, among other things, our cyber incident experience, ongoing cyber threats, material risks, deployment of cybersecurity controls and risk mitigants, engagement of third parties (e.g., consultants and auditors) and third-party tools, our cyber insurance coverages and our employee-training programs.

companyName: E2open Parent Holdings, Inc.


text: Monitor Cybersecurity Incidents Our internal cybersecurity control group meets on a monthly or more frequent basis to discuss and assess risks related to cybersecurity threats and review any reported cybersecurity incidents. The reviews include a review of the incident log, assessments of risks identified by multiple independent third parties and a review of our cyber risk as well as cybersecurity threat modeling. Identified risks related to cybersecurity threats are further analyzed as part of our enterprise risk management process. Our employees are provided with regular security policy and security awareness training including identifying potential cybersecurity incidents and reporting them to our security incident response team.

companyName: ACACIA RESEARCH CORP

ticker: ACTG


text: The Company's cybersecurity team also provides enterprise-wide cybersecurity training for employees to maintain and continuously improve the Company's mitigation against human-driven risk.

companyName: LABCORP HOLDINGS INC.

ticker: LH


text: Engage Third-parties on Risk Management. Periodic external reviews, including penetration tests and security framework assessments, are conducted by auditors, external assessors, and/or consultants to assess and ensure compliance with the Company's information security programs and practices. Internal and external auditors assess the Company's information technology general controls on an annual basis.

companyName: Knife River Corp

ticker: KNF


text: Cybersecurity is essential for Okta. Our cybersecurity strategy is to develop a consistent framework of security controls that can apply to all business functions. To execute on this strategy, we integrate cybersecurity risk management into our broader enterprise risk management program. We also take a cross-functional approach to cybersecurity risk management by engaging teams across the business, including security, technical operations, engineering, IT, customer support, legal and communications, to implement shared processes for identifying, assessing and managing key cybersecurity risks.

companyName: Okta, Inc.

ticker: OKTA


text: Risks from Cybersecurity Threats We have not experienced any cybersecurity events, including cybersecurity incidents, that have had or which are likely to have any material impact on our business strategy, results of operations or financial position.

companyName: GRID DYNAMICS HOLDINGS, INC.

ticker: GDYN


text: The underlying processes and controls of our cyber risk management protocol incorporate recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF"). We have undertaken, on an annual basis, to conduct an assessment of our cyber risk management processes and controls to identify, quantify, and categorize material cyber risks. In addition, we have developed a risk mitigation plan to address such risks, and where necessary, remediate potential vulnerabilities identified through the annual assessment process.

companyName: Cadrenal Therapeutics, Inc.

ticker: CVKD


text: Comprehensive Cybersecurity Program: We have implemented a comprehensive cybersecurity risk management program (Cybersecurity Program) that is aligned with the National Institute for Standards and Technology Cybersecurity Framework. Our Cybersecurity Program provides a risk-based approach to cybersecurity, and security controls are tailored so that cost-effective controls can be applied commensurate with the risk and sensitivity of specific information systems, control systems, and enterprise data. Our Cybersecurity Program incorporates best practices and industry standards from multiple sources and is designed to comply with applicable regulations. The Cybersecurity Program includes, but is not limited to, the following elements: risk assessment, policies and procedures, training and awareness, auditing, compliance monitoring and testing, and incident response.

companyName: WILLIAMS COMPANIES, INC.

ticker: WMB


text: The Audit Committee of our Board of Directors is responsible for overseeing the Company's enterprise risk management program, including overseeing the adequacy of protection of the Company's technology, including physical security, patent and trademark program, proprietary information, and information security. The Audit Committee receives quarterly reports from our Information Security Director and third parties on cybersecurity matters. In addition, the Audit Committee receives quarterly reports addressing cybersecurity as part of our enterprise risk management program and to the extent cybersecurity matters are addressed in regular business updates. These reports include, among other things, existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents, if any, and the status of key information security initiatives. Our Audit Committee members also engage in ad hoc conversations with management on cybersecurity-related news and events, and discuss any updates, as needed, to our cybersecurity risk management and strategy programs.

companyName: MEDALLION FINANCIAL CORP

ticker: MFIN


text: To date, management has not identified risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. While we work to maintain our cybersecurity processes, there can be no assurance that such actions will be sufficient to prevent cybersecurity incidents or mitigate all potential risks or threats to such systems, networks, and data or those of our third-party providers.

companyName: UNIVERSAL ELECTRONICS INC

ticker: UEIC


text: Cybersecurity Risk Management & Strategy Arrow's cybersecurity risk management and data security program is an in-depth, layered, defensive approach that leverages people, processes and technology to manage and maintain cybersecurity controls. Arrow employs a variety of preventative and detective tools to monitor, block, and provide alerts regarding suspicious activity, as well as to report on any suspected advanced persistent cybersecurity threats. Our security framework involves processes for detection, identification, protection and response to a cybersecurity incident. Additionally, we are well prepared for recovery in the case of a cybersecurity incident with proper vendor support as well as backups both online and offline.

companyName: ARROW FINANCIAL CORP

ticker: AROW


text: Our cybersecurity risk management program includes: • Risk Assessment: Regular assessments identify and prioritize technical risks to critical assets through threat identification and vulnerability assessments. • Risk Identification and Analysis: Prioritization of risks is based on standardized scoring frameworks, focusing resources on addressing the most significant threats. • Risk Mitigation and Management: A range of controls and measures are implemented to mitigate identified risks, incorporating technical and procedural safeguards. • Monitoring and Detection: Continuous monitoring systems are deployed to detect potential security incidents in real-time, ensuring a 24x7x365 capability to respond and mitigate. • Cybersecurity Training and Awareness: New hire, annual, and ongoing security awareness training is given to all employees. • Incident Response: A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents. • Continuous Improvement: Commitment to continuous improvement is reflected in regular reviews, updates of risk assessments, and simulated cyberattacks to identify and remediate risks from existing and emerging threats.

companyName: Paragon 28, Inc.


text: The company's cybersecurity policies, procedures, and strategies primarily are implemented by the company's information security department, which reports directly to the CISO. The company's information security department performs functions that include but are not limited to general security operations, event monitoring, incident response, vulnerability management, policy and procedure development, security compliance, product development support, product security readiness testing, third-party vendor security assessments, and penetration testing. Other personnel and departments in the company also assist with cybersecurity risk management, including but not limited to the company's technology organization and the company's privacy, legal, third-party risk management, and corporate audit services teams. The company also has developed processes to integrate cybersecurity risk management within the company's product and software development processes.

companyName: GoDaddy Inc.

ticker: GDDY


text: We maintain a global cybersecurity policy that incorporates recognized industry standards and best practices from the National Institute of Standards and Technology as well as various security certifications.

companyName: FISERV INC

ticker: FISV


text: The Board's oversight of cybersecurity risk management is supported by the Audit Committee of the Board (the "Audit Committee"), which interacts with our management and the Chief Technology Officer of the Manager that implement and oversee our cybersecurity program.

companyName: VINEBROOK HOMES TRUST, INC.


text: While we have not yet experienced any material impacts from a cyber-attack, any one or more future cyber-attacks could materially adversely impact the Company, including a loss of trust among our customers, departures of key employees, general diminishment of our global reputation and financial losses from remediation actions, loss of business or potential litigation or regulatory liability. Further, evolving market dynamics are increasingly driving heightened cybersecurity protections and mandating cybersecurity standards for our products, and we may incur additional costs to address these increased risks and to comply with such demands.

companyName: Boxlight Corp

ticker: BOXL


text: The AGM Board of Directors' oversight of Apollo's cybersecurity risk management is supported by the audit committee of the AGM Board of Directors (the "AGM audit committee"), the AAM Global Risk Committee ("AGRC"), the Operational Risk Forum (the "ORF"), the Cybersecurity Working Group and management. The AGM Board of Directors, the AGM audit committee, the AGRC, the ORF and the Cyber Security Working Group receive regular updates on Apollo's information technology, cybersecurity risk profile and strategy, and risk mitigation plans from Apollo's risk management professionals, AGM's Chief Security Officer ("CSO"), its CISO, and other members of Apollo's management and relevant management committees and working groups. The Cyber Security Working Group is chaired by the CISO and has representation from Apollo's Technology, Legal, Compliance, and ERM teams. The group meets at least once a quarter to discuss cybersecurity and risk mitigation activities, among other topics. The CISO regularly reports to the ORF regarding cyber risk, and the ORF in turn reports to the AGRC on a quarterly basis, noting any cyber updates when necessary or appropriate. In turn, AGM's board of directors and/or the AGM audit committee receive quarterly risk updates from risk management professionals, as well as at least annual updates on cyber risk specifically. The full AGM Board of Directors or the AGM audit committee receives presentations and reports on cybersecurity risks from AGM's CSO or CISO, as well as from Athene's CISO, at least annually.

companyName: Apollo Asset Backed Credit Co LLC


text: As of the date of this Report, we have not encountered any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.

companyName: ADAPTIN BIO, INC.


text: Material Effects of Cybersecurity Incidents Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including its business strategy, results of operations, or financial condition. Further information regarding cybersecurity risks can be found in Item 1A. Risk Factors - Risks Relating to Information Technology, Cybersecurity and Intellectual Property.

companyName: Live Nation Entertainment, Inc.

ticker: LYV


text: Managing Material Risks and Integrated Overall Risk Management We have implemented a risk-based approach to identify and assess the cybersecurity threats that could affect our business and information systems. Our cybersecurity risk assessment process evaluates our maturity across key areas of cybersecurity, and incorporates industry standard framework considerations, including the National Institute of Standards and Technology. The cybersecurity management program includes evaluation of our technical, administrative, and end-point security, including encryption, firewalls, security scans and anti-virus systems and logical security controls. We continue to promote a company-wide culture of cybersecurity risk management awareness and cybersecurity considerations are integrated in our decision-making processes. We have an experienced IT team led by our Vice President of IT, who has more than 20 years of industry experience. Our Vice President of IT reports directly to the executive team and works closely with our management team, and where necessary, engages external experts to evaluate and address cybersecurity risks in alignment with our business objectives and operational needs. Our Vice President of IT provides regular updates on cybersecurity to the audit committee of our board of directors.

companyName: BuzzFeed, Inc.

ticker: BZFD


text: Our Chief Business Officer and other members of senior management provide quarterly briefings to the audit committee regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. Our audit committee provides regular updates to the board of directors on such reports. In addition, our Chief Business Officer provides annual briefings to the board of directors on cybersecurity risks and activities.

companyName: Ventyx Biosciences, Inc.

ticker: VTYX


text: Company management, including our Chief Financial Officer, meets as needed with relevant employees of the Manager, who collectively have over ten years of experience in managing cybersecurity related issues on behalf of the Manager, to discuss cybersecurity risks and incident trends and escalate them, as appropriate, to the Audit Committee.

companyName: Granite Ridge Resources, Inc.

ticker: GRNT


text: Education and awareness to cyber threats is a core component of our information security program. All employees undergo dedicated cybersecurity training as part of their onboarding process and on an ongoing basis. In recent years, we have enhanced our employee education and awareness program to focus on engagement, including through frequent phishing campaign assessments, communications from our CISO and reinforcement from other senior leaders on relevant cyber threats. We have also engaged third-party experts to perform penetration tests and assess our response mechanisms and hosted tabletop exercises with senior leaders to test our incident response preparedness. These organizations, as well as other third parties that do business with us, are reviewed as part of our Vendor Risk Management program. To foster prompt response to incidents, recovery of lost data, and minimal impact to strategic operations in emergency events, we maintain, test, and regularly review our Incident Response, Disaster Recovery and Business Continuity Plans.

companyName: Evercore Inc.

ticker: EVR


text: External Support and Third-Party Risk Management Management continues to take steps to enhance our data security infrastructure and defenses. Our processes also address cybersecurity threat risks associated with using third-party service providers, including those in our supply chain or who have access to our customer and employee data, our information systems, or the facilities that house such systems or data. We engage outside third-party experts, cybersecurity advisors, and auditors to conduct regular risk assessments, penetration testing, and vulnerability analyses. Our enterprise risk management and cybersecurity-specific risk identification programs include consideration of third-party risks and informs our selection and oversight of third-party service providers. We conduct appropriate due diligence on third-party service providers, vendors, and partners before establishing relationships with them, and we monitor such relationships on an ongoing basis. We also periodically review the Company's cyber insurance policies to ensure appropriate coverage.

companyName: SunCoke Energy, Inc.

ticker: SXC


text: Our Senior Director, IT and Chief Financial Officer present, at least annually, to the Audit Committee to discuss management's ongoing cybersecurity risk management program. The annual presentation to the Audit Committee includes information about the sources and nature of risks the Company faces, how management assesses such risks, progress on vulnerability remediation, and current developments in the cybersecurity landscape. In turn, the Chair of the Audit Committee provides an annual readout to the full Board of Directors that includes a summary of the Senior Director, IT and Chief Financial Officer's presentation, to enable discussion of cybersecurity risk management at the full Board level. When appropriate, members of our internal incident response team will also update the executive management team on developments relating to cybersecurity and, if needed, cybersecurity incidents.

companyName: Fusion Pharmaceuticals Inc.


text: Overseeing Third-Party Risk. Because we know the risks associated with engaging third-party service providers, we have implemented processes designed to oversee and manage these risks. It is our policy to conduct security assessments of all third-party service providers before engagement, and we aim to maintain ongoing monitoring for compliance with our cybersecurity standards. This monitoring includes regular assessments by our chief operations officer and ITSP Group.

companyName: SOUTH DAKOTA SOYBEAN PROCESSORS LLC

ticker: SDSYA


text: We have established and maintain comprehensive incident response and recovery plans to address our response to cybersecurity incidents, and such plans are tested and reviewed on an as needed basis. Our cybersecurity program includes a dedicated security incident response team (the "SIRT") responsible for identifying, investigating, and mitigating cybersecurity threats. The SIRT follows a well-defined incident response process encompassing intake, investigation, mitigation, and recovery. This process leverages tools for threat detection and utilizes standardized protocols for containment, root cause analysis, and system restoration. By integrating security measures with a robust response process, we aim to minimize the impact of potential cyber incidents.

companyName: Velo3D, Inc.

ticker: VELO


text: We have strategically invested resources and tools to combat the ever-changing cyber threat landscape. These investments include growing our internal technology team headcount and bolstering our partnerships with entities with external expertise, resulting in increased protection, monitoring, and response capabilities. We have also made investments to carry cybersecurity insurance that provides additional protection and resources to reduce a cybersecurity event's impact and potential losses.

companyName: Sanara MedTech Inc.

ticker: SMTI


text: We have established and maintain a comprehensive incident response plan, designed to address our response to a cybersecurity incident. Our cross-functional members comprise the incident response team to respond and disclose material incidents. The incident response plan defines pre-incident activities and preparation, classification of incidents, response team internal and external contacts, process flow of the response team, escalation of incidents to outside entities and law enforcement and frequency of review of the incident response plan. We conduct regular tabletop exercises (i.e., discussion-based simulations) to test these plans and ensure personnel are familiar with their roles in a response scenario.

companyName: Xencor Inc

ticker: XNCR


text: Under the ISP, the Board of Directors or an appropriate committee thereof is required to oversee all efforts with respect to the development, implementation and maintenance of an effective information security program. In addition, the ISP charges management with responsibility for identifying all reasonably foreseeable internal and external threats that could result in unauthorized disclosure, misuse, alteration or destruction of Bank information, and directs management to develop and implement procedures and other controls designed to reduce or eliminate identified risks.

companyName: UNITED BANCORP INC /OH/

ticker: UBCP