text: Our Board is actively engaged in the oversight of our cybersecurity program. Specifically, the Risk Committee is responsible for overseeing our information security program, including management's actions to identify, assess, mitigate, and remediate material cyber issues and risks. Our CTIO provides quarterly reports to the Risk Committee regarding information security programs, key enterprise cyber initiatives, and significant cybersecurity and privacy incidents.

companyName: Kearny Financial Corp.

ticker: KRNY


text: We have in place a robust incident response process that helps ensure our preparedness for a cybersecurity incident including our ability to detect, analyze, contain, remediate, and recover from a security incident as well as conduct post-incident analysis to avoid future incidents. Incident response process activities are overseen by cross-functional leadership in Risk Management, Operations, Information Security, Compliance, and Information Systems. Security events and incidents are evaluated, ranked by severity, and prioritized for response and remediation. Incidents are evaluated to determine materiality and operational, business, and overall privacy impacts. We conduct regular exercises and drills to simulate responses to various cybersecurity incidents. The incident response team, including management, coordinates with technical and business stakeholders to further analyze risks and enhance detection, mitigation, and remediation strategies incorporated in the incident response program.

companyName: FARMERS & MERCHANTS BANCORP

ticker: FMCB

secItem: Item 1C


text: management and strategy have implemented and maintain various information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic, or competitive in nature, and clinical trial data, or Information Systems and Data.

companyName: Gamida Cell Ltd.


text: The Company engages in the periodic assessment and testing of the Company's policies, standards, processes, systems, and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability and penetration testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. The Company with our information technology partner regularly engages assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the CTO and GC who shares data with the SLT and Audit Committee, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.

companyName: Longeveron Inc.

ticker: LGVN


text: We utilize internal and external resources to evaluate the effectiveness and maturity of our cybersecurity program. We conduct regular penetration and vulnerability testing. We conduct annual tabletop exercises to test and iterate our Response Plan, while also providing training for the Response Plan working group. In addition, we conduct compliance training and regular phishing assessments for our employees.

companyName: Anywhere Real Estate Group LLC


text: The goal of our cybersecurity program is to establish processes for identification, assessment, and management of cybersecurity risks. We conduct periodic risk assessments, including with support from external vendors, if needed, to assess our cyber program, identify potential areas of enhancement, and develop strategies for the mitigation of cyber risks. We also conduct security testing and have established a vulnerability detection process, supported by security testing, that is designed to address the treatment of identified security risks based on severity. Our risk assessments include, but are not limited to: Interfaces Storage security Applications Hardware security Remote access security IT architecture Information flow Risks from Cybersecurity Threats Some potential cybersecurity threats include, but are not limited to:

companyName: AtlasClear Holdings, Inc.

ticker: ATCH


text: Managing Material Risks and Integrated Overall Risk Management We have strategically integrated cybersecurity risk management into our broader risk management framework. This integration ensures that cybersecurity considerations are an integral part of our overall risk management system and processes. In addition, our risk management team works closely with our IT department to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.

companyName: ZimVie Inc.


text: Our Audit Committee receives updates from the Cybersecurity Steering Committee at least annually, which cover topics related to information security, privacy, and cyber risks and risk management processes, including the status of significant cybersecurity incidences and projects designed to strengthen our information security posture. Our Audit Committee is also responsible for ensuring that the Board of Directors also receives periodic reports with respect to the status and management of our cybersecurity risks.

companyName: ClearPoint Neuro, Inc.

ticker: CLPT


text: Our DDS has more than 20 years of expertise in the information technology sector, with 10 years specifically dedicated to cybersecurity. This experience has fostered a thorough comprehension of cyber threat landscapes, defense strategies, and security technologies.

companyName: WATSCO INC

ticker: WSO


text: Our incident response plan coordinates the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate damage to our business and reputation. We maintain an Information Security Incident Response form that directs a detector of any incident to report such incident to our Information Security Officer, whom we contract through a third party service provider. Following notice of any such incident, our Information Security Officer would then work with our Chief Financial Officer and our Board to establish an appropriate response plan and to determine the materiality of the incident and any disclosure obligations.

companyName: TAO Synergies Inc.

ticker: TAOX


text: We strive to implement leading data protection standards to ensure a strong commitment to cybersecurity. Our Data Security Policy and Cybersecurity Incident Response Plan ("CIRP"), which is part of our enterprise wide risk management processes, guides our cybersecurity program. The CIRP, developed in consultation with an independent cybersecurity expert, includes processes for identifying, managing, and remediating cybersecurity incidents. We utilized the National Institute of Standards and Technology ("NIST") and the Center for Internet Security ("CIS") guidelines to develop and implement the CIRP, which is approved by our Chief Technology Officer ("CTO"). However, this should not be interpreted to mean that we meet any particular technical standards, specifications, or requirements, only that we used the NIST and CIS as a guide to help create develop and implement the CIRP. The CIRP is reviewed and updated annually. The Company's cybersecurity risk management processes include ongoing monitoring and testing of its information systems and data to identify and respond to potential cybersecurity threats. Internally, the Company utilizes an enterprise Attack Surface Management tool to routinely scan for vulnerabilities to internal assets. Externally, we use third-party vendors to routinely conduct scans for vulnerabilities to external assets. In addition, our internal auditors along with management also conduct periodic monitoring of our internal controls over our data security and customer privacy systems and processes.

companyName: GRAY MEDIA, INC

ticker: GTN


text: The Advisor's cybersecurity risk oversight includes: (i) reviewing and approving technology security policies and internal cybersecurity controls, (ii) monitoring cybersecurity and information security exposures, (iii) confirming the Advisor has adequate procedures in place to not only control and limit these exposures but also to timely respond to any cyber incident, and (iv) mandatory cyber security trainings for all Advisor personnel.

companyName: Sterling Real Estate Trust


text: threat intelligence, and other information obtained from governmental, public, or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.

companyName: BTCS Inc.

ticker: BTCS


text: Our chief architect and the cybersecurity management committee are responsible for our cybersecurity rules and methods, like those described in the "Risk Management and Strategy" section. They stay updated and track how we prevent, identify, lessen and address cybersecurity issues. This is done through regular checks of our systems, tests to find security weaknesses and having a plan ready to respond to any incidents. In addition to regular meetings, the chief architect and co-chief executive officer regularly discuss active, emerging and potential cybersecurity risks. They keep each other informed about significant changes affecting cybersecurity, and they periodically update our board of directors or the audit committee about these changes as well as our cybersecurity risks, so that our board of directors can administer its oversight function as part of its broader oversight and risk management.

companyName: Revolve Group, Inc.

ticker: RVLV


text: Health In Tech prioritizes a proactive and comprehensive approach to risk management and cybersecurity, ensuring the protection of our Operational Technology (OT) environment and critical infrastructure from evolving cyber threats. Our security framework is built on robust, adaptive measures, which are regularly refined to incorporate industry best practices and cutting-edge technologies.

companyName: Health In Tech, Inc.

ticker: HIT


text: The Company has partnered with Alasconnect LLC to evaluate the cyber risk and IT control capabilities within the enterprise. The goal is to increase cyber-resilience and cyber-threat response preparedness. Cyber policies, procedures and practices are extended to all third-party vendors and appropriately communicated to both management and the Board by way of strategic cyber incident tabletop exercises and quarterly board IT governance report ing. Any material risks identified from cyber security threats will be communicated to the management team which will evaluate and manage the risk. Although to-date the Company has not experienced any material losses relating to cyber-attacks or other information security breaches, there can be no assurance that the Company will not incur such losses in the future. The Company's risk and exposure to these matters cannot be fully mitigated because of, among other things, the evolving nature of these threats. As a result, cyber security and the continued development and enhancement of controls, processes and practices designed to protect systems, computers, software, data and networks from attack, damage or unauthorized access remain an area of attention.

companyName: Contango ORE, Inc.

ticker: CTGO


text: While we do not believe that our business strategy, results of operations, or financial condition have been materially adversely affected by any cybersecurity incidents, cybersecurity threats are pervasive, and, similar to other global financial services firms, we, as well as our clients, associates, regulators, service providers, and other third parties, have experienced a significant increase in information security and cybersecurity risk in recent years and will likely continue to be the target of cyber attacks. We continue to assess the risks and changes in the cyber environment, invest in enhancements to our cybersecurity capabilities, and engage in industry and government forums to promote advancements in our cybersecurity capabilities, as well as the broader financial services cybersecurity ecosystem. For more information on risks to us from cybersecurity threats, see "Any cyber attack or other security breach of our technology systems, or those of our clients or other third-party vendors we rely on, could subject us to significant liability and harm our reputation" in "Item 1A – Risk Factors" of this Form 10-K.

companyName: STIFEL FINANCIAL CORP

ticker: SF


text: We continue to augment the capabilities of our people, processes, and technologies in order to address our cybersecurity risks. Our cybersecurity risks, and the controls designed to mitigate those risks, are integrated into our overall risk management governance and are reviewed yearly by our Board of Directors.

companyName: MEDICINOVA INC

ticker: MNOV


text: Risks from Cybersecurity Threats We have not encountered cybersecurity challenges that have materially impaired our business strategy, results of operations or financial condition. From time to time, we experience cybersecurity events that require investigation. For additional information regarding whether any risks from cybersecurity threats, including as a result of any cybersecurity incidents are reasonably likely to materially affect our company, including our business strategy, results of operations or financial condition, please refer to Item 1A, "Risk Factors," in this Annual Report on Form 10-K, including the risk factor entitled "We are subject to cybersecurity risks to our operational systems, security systems, infrastructure, and data processed by us or third-party vendors."

companyName: Palladyne AI Corp.

ticker: PDYN


text: The Company has cybersecurity risk management processes in place intended to protect the confidentiality, integrity, and availability of our critical infrastructure, systems and information. Our cybersecurity risk management is integrated into the Company's enterprise risk management strategy. Our information technology security team works in partnership with internal auditors and external consultants in the identification, evaluation, and management of cybersecurity risks. We also have processes in place designed to evaluate potential risks associated with third-party service providers. Our cybersecurity program is aligned with the National Institute of Standards and Technology Cybersecurity Framework and includes an incident response plan. Additionally, we have business continuity and disaster recovery plans in place to prepare for any potential disruptions. With respect to our employees, we provide training for personnel regarding cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices.

companyName: FERRELLGAS PARTNERS FINANCE CORP


text: This governance structure ensures that cybersecurity risks are effectively managed by the IT Department, with oversight from the Chief Financial Officer and the Board. It maintains clear lines of communication and accountability, enabling timely decision-making and response to cybersecurity matters.

companyName: Alzamend Neuro, Inc.

ticker: ALZN


text: The Board Risk Committee has primary responsibility for overseeing the Company's comprehensive Enterprise Risk Management program. The Enterprise Risk Management program assists senior management in identifying, assessing, monitoring, and managing risk, including cybersecurity risk, in a rapidly changing environment. Cybersecurity matters and assessments are regularly included in Board Risk Committee meetings.

companyName: FIRST BANCSHARES INC /MS/


text: The Company maintains a comprehensive cybersecurity risk management program designed to identify, assess, manage, and mitigate cybersecurity risks. This program provides a framework for addressing threats and incidents, including those associated with third-party service providers. To secure its technology environment, the Company leverages the latest software and security capabilities, employing a defense-in-depth and layered strategy. This includes deploying next-gen endpoint detection and response, network anomaly detection, and multi-factor authentication across most of its environment. Additionally, the Company engages with third-party consultants and utilizes threat intelligence services to assist in its oversight and risk identification efforts. Furthermore, all employees and consultants with access to the Company's information systems are required to complete annual data protection and cybersecurity training, as well as ongoing phishing simulation exercises, as part of a broader training. Based on the information known as of the date of this Annual Report on Form 10-K, the Company does not believe that any cybersecurity incident experienced has materially affected or is reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. For additional information about cybersecurity risks, see Item 1A. "Risk Factors."

companyName: SCHOLASTIC CORP

ticker: SCHL


text: b. Systems Safeguards: The Company deploys system safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through ongoing vulnerability assessments and cybersecurity threat intelligence.

companyName: Axogen, Inc.

ticker: AXGN


text: Our Vice President, Information Technology provides an annual briefing to the Audit Committee regarding our company's cybersecurity risks and activities, including the status of cybersecurity system development, company-wide cybersecurity training programs, material changes to the cybersecurity system, policies or practices, any recent cybersecurity incidents and related responses, cybersecurity systems testing and engagement of third-party service providers in support of our cybersecurity system. Special meetings may also be called with the Audit Committee to brief the members on any material cybersecurity incidents and related responses thereto. Subsequent to such briefings, our Audit Committee will provide an update to the Board on such reports. In addition, the Board will receive periodic updates in meeting materials or directly from our Chief Financial and Business Officer on cybersecurity risks and activities.

companyName: Tenaya Therapeutics, Inc.

ticker: TNYA


text: Cybersecurity Program Overview The Adviser has instituted a cybersecurity program designed to identify, assess, and manage cyber risks applicable to the Company and assists as necessary with the oversight of other third-party service providers and their cybersecurity programs as discussed further below. The Adviser's cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Company relies. The Adviser actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Company.

companyName: Barings BDC, Inc.

ticker: BBDC


text: We engage a third-party Managed Service Provider ("MSP") to implement technology infrastructure and oversee its tactical operations. Our MSP employs multiple people with experience in technical leadership, system architecture, network infrastructure and cybersecurity. We believe using an MSP provides economies of scale for a smaller-sized company such as ours, by allowing us access to a broad range of experience and tool sets that would otherwise be difficult to acquire in-house. Our MSP uses specialized third-party services and tool sets for identifying, protecting against, and detecting cyber incidents. Through these services and tools, our detection capabilities include, but are not limited to, near real-time monitoring, intrusion detection systems, and advanced analytics to identify abnormal patterns of behavior. These third-party detection tools provide near real-time alerts, log aggregation, and threat intelligence feeds.

companyName: ClearSign Technologies Corp

ticker: CLIR


text: In the past three years, we have not experienced any material computer data security breaches as a result of a compromise of our information systems and we are not aware of any significant cybersecurity breach or attack that had a material impact on our business or operating results to date.

companyName: FIRST COMMONWEALTH FINANCIAL CORP /PA/

ticker: FCF


text: As a component of our overall risk management system and processes, we have a risk-based cybersecurity program, dedicated to protecting our data as well as data belonging to consumers (including UWC Members), employees and suppliers. We devote significant resources and utilize a defensive in-depth strategy, with multiple layers of security controls to protect the security of our computer systems, software, networks, and other technology assets. Our security efforts are designed to preserve the confidentiality, integrity, and continued availability of all information we own, or is in our care, and protect against, among other things, cybersecurity attacks by unauthorized parties attempting to obtain access to confidential information, destroy data, disrupt or degrade service, sabotage systems, or cause other damage. These processes include technical, administrative and physical controls and processes, as well as contractual mechanisms to mitigate risk. We also have policies and procedures to oversee and identify the cybersecurity risks associated with our use of third-party service providers, including the regular review of SOC reports, relevant cyber attestations, and other independent cyber ratings.

companyName: Mister Car Wash, Inc.

ticker: MCW


text: In addition, we undergo several compliance audits annually, which include a SOX compliance audit, a SOC1 audit and a SOC2 audit. Our approach to managing compliance-related risks includes maintaining a data loss prevention program, centralized compliance management, an identity management platform, ongoing Managed Security monitoring, threat and vulnerability monitoring, and information security risk insurance.

companyName: Maverick Merger Sub 2, LLC

ticker: COOP


text: The Company expects each associate to be responsible for the security and confidentiality of client information. We communicate this responsibility to associates upon hiring and regularly throughout their employment. We require each associate to complete training to protect the confidentiality of client information at the time of hire and during each year of employment. Associates must successfully pass a test to demonstrate understanding of these requirements and provide acknowledgement of their responsibilities.

companyName: HANCOCK WHITNEY CORP

ticker: HWC


text: We engage third-party service providers to conduct evaluations of our cybersecurity controls through penetration testing, independent audits and consulting on best practices to address existing and new challenges. These evaluations include testing the design and operational effectiveness of our cybersecurity controls. To further enhance the capabilities of our internal systems, we utilize third-party vendors to provide extended coverage of our information technology and operational technology environments. We also share and receive threat intelligence with companies in the energy sector, government agencies, information sharing and analysis centers and cybersecurity associations in order to monitor and address developments in the cybersecurity environment.

companyName: TALOS ENERGY INC.

ticker: TALO


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors—We rely on our information technology systems, employees and certain suppliers and counterparties, and certain failures or disruptions in those systems or chains could materially adversely affect our operations."

companyName: EVERTEC, Inc.

ticker: EVTC


text: Due to the evolving nature of cybersecurity threats, we actively engage with external experts to enhance our security expertise. These subject matter experts provide independent evaluations and testing of our cybersecurity risk management framework. Our collaboration with these entities includes regular audits, threat assessments, and consultations on security enhancements to reinforce our security posture.

companyName: BCB BANCORP INC

ticker: BCBP


text: This includes regular phishing simulations, with training provided for any failures, as well as periodic communications via the internal company portal concerning threats, best practices, and technology changes to improve security. We also work with the Company marketing department to periodically publish articles on our website to raise security awareness with our customers.

companyName: Tectonic Financial, Inc.

ticker: TECTP


text: Our Board of Directors has delegated oversight of risks related to cybersecurity to the Audit Committee. The Audit Committee is, therefore, charged with reviewing our cybersecurity processes for assessing key strategic, operational and compliance risks. Our Corporate Compliance Officer briefs the Audit Committee on cybersecurity risks at each of its meetings, which occur at least four times each year. These briefings include an assessment of cyber risks, an overview of the cyberthreat landscape, updates on cybersecurity incidents, and reports on our investments in cybersecurity risk mitigation strategies and technologies and related corporate governance. In addition, our domestic and European chief technology officers brief the Audit Committee on cybersecurity risks at least annually. The Audit Committee then provides updates on significant cybersecurity matters to the Board periodically.

companyName: Clear Channel Outdoor Holdings, Inc.

ticker: CCO


text: Our CISO is principally responsible for assessing and managing our cybersecurity risk management program, in partnership with leaders from our Technology, Information Security, Internal Audit, Legal and Compliance teams. Such individuals have an average of over 20 years of prior work experience in various roles involving technology, information security, auditing and compliance. These individuals, including the CISO, are informed about and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. As discussed above, our CISO then makes periodic reports to the Audit Committee regarding such matters.

companyName: Affirm Holdings, Inc.

ticker: AFRM


text: Despite our cybersecurity program, we cannot guarantee that we will not be subject to a material cybersecurity incident. For a description of the risks from cybersecurity threats that may materially affect the Company, and how they may do so, see Item 1A-"Risk Factors" included elsewhere in this Annual Report on Form 10-K. As of the date of this Annual Report, we have determined that there have been no cybersecurity incidents which materially impacted our business, financial condition, or results of operations.

companyName: Accolade, Inc.


text: Our cybersecurity program helps us secure our systems, keeps our business running around the clock and protects our clients, consultants, employees and shareholders from vulnerabilities and threats. With oversight from our Board, the Audit Committee and key leaders across Kforce, we have put proactive measures and systems in place to protect our information assets from unauthorized use or access. The Firm's cybersecurity framework is based on the National Institute of Standards and Technology ("NIST").

companyName: KFORCE INC

ticker: KFRC


text: New Mountain Capital has processes in place for assessing, identifying, and managing material risks from potential unauthorized occurrences on or through our electronic information systems that could adversely affect the confidentiality, integrity, or availability of our information systems or the information residing on those systems. These include a wide variety of controls, processes, systems, and tools that are designed to prevent, detect, or mitigate data loss, theft, misuse, unauthorized access, or other security incidents or vulnerabilities affecting our data. Pursuant to New Mountain Capital's Information Security Program, the New Mountain Capital Information Technology Steering Committee ("ITSC") is responsible for the development, evolution, and implementation of policies and technical measures to reasonably prevent security incidents. At times New Mountain Capital may also engage assessors, consultants, auditors, or other third parties to assist with assessing, identifying, and managing cybersecurity risks.

companyName: New Mountain Net Lease Trust


text: Our chief information security officer, who reports both to our chief risk officer and our chief information officer, manages the cybersecurity governance framework designed to protect the confidentiality, integrity, and availability of our information technology assets and data under our control. Our chief information security officer and assistant chief information security officer collectively have approximately 20 years of experience with the FHLB in successively more responsible roles and have led teams to design, secure, implement, and audit numerous technology solutions. Our information security group is responsible for developing, documenting, and approving our information security control standards, guidelines, and procedures, in line with the policies and standards set forth by the Board and management committee. They are experienced and knowledgeable in both technology and cybersecurity and maintain industry recognized security certifications.

companyName: Federal Home Loan Bank of Cincinnati


text: The CFO and CCO of the Company oversee the Company's oversight function generally and rely on GC Advisors' CIO and cybersecurity team to assist with assessing and managing material risks from cybersecurity threats. The Company's CFO has been responsible for this oversight function as CFO to the Company for over three years and has worked in the financial services industry for more than eighteen years, during which time the CFO has gained expertise in assessing and managing risk applicable to the Company. The Company's CCO has been responsible for this oversight function as CCO to the Company for thirteen years and has worked in the financial services industry for more than twenty years, during which time the CCO has gained expertise in assessing and managing risk applicable to the Company. The Advisors' CIO has been responsible for her function for over four years and has worked in the financial services industry for more than fifteen years, during which time the CIO has gained expertise in assessing and managing risk applicable to the Company.

companyName: GOLUB CAPITAL BDC, Inc.

ticker: GBDC


text: We maintain an incident response plan that includes policies and procedures for notifying affected third parties and complying with applicable laws.

companyName: Bannix Acquisition Corp.


text: USCF's procedures include guidance for determining the materiality of cybersecurity incidents, including with respect to cybersecurity incidents experienced by third-party service providers. Such determinations are made by USCF's senior management, including its Chief Executive Officer, which uses both qualitative and quantitative factors in assessing the material impact of an incident. The factors include the functional impact, the information impact, costs, the observed activity, the location of observed activity, actor characterization, and recoverability of information. As of the date of this report, USCF is not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect USL, including its business strategy, results of operations, or financial condition.

companyName: United States 12 Month Oil Fund, LP

ticker: USL


text: The Managing Owner utilizes a combination of statistics, data and testing by third party service providers and software in order to monitor and identify cybersecurity threats. To the extent those threats require immediate attention, they are dealt with and reported to the Committee thereafter in accordance with the procedures outlined in the Managing Owner's incident response plan. Other threats, as well as follow ups once threats are properly dealt with, are then discussed and analyzed by the Committee. Reports on these activities are discussed with the Board on at least an annual basis, with any material issues raised promptly to the Board as well.

companyName: GLOBAL MACRO TRUST


text: The Board and the Audit Committee each receive regular presentations and reports on developments in the cybersecurity space, including risk management practices, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, and information security issues encountered by our peers and third parties. The Board and the Audit Committee also receive prompt and timely information regarding any cybersecurity risk that meets pre-established reporting thresholds, as well as ongoing updates regarding any such risk. On an annual basis, the Board and the Audit Committee discuss our approach to overseeing cybersecurity threats with our CFO and other members of senior management. Our CEO, CFO and other members of our senior management collectively have several decades of experience managing risk at our company or similar companies and assessing cybersecurity threats.

companyName: Jasper Therapeutics, Inc.

ticker: JSPR


text: Our cybersecurity program is led by our chief information officer (CIO), who is responsible for developing and executing our overall information security strategy, policy, security engineering, operations and cyber threat detection and response. Our CIO has extensive information technology (IT) and program management experience and leads a team that has many years of experience with our organization. Our cybersecurity risks are also reviewed and tested annually through third party assessments and internal and external information technology audits. Our information technology team reviews cybersecurity risks at least annually, integrating findings into strategic risk assessments. Our CIO reports to our chief executive officer.

companyName: KRONOS WORLDWIDE INC

ticker: KRO


text: We maintain processes to inform and update management and, as needed, the Audit Committee, about security incidents that may pose a significant risk for the business, as applicable. Although risks from cybersecurity threats have to date not materially affected us, our business strategy, results of operations or financial condition, we have, from time to time, experienced threats and security incidents relating to our and our third party vendors' information systems. See Item 1A, "Risk Factors," to this report for more information.

companyName: REPLIGEN CORP

ticker: RGEN


text: As part of our cybersecurity risk management program, we implement technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls. Additionally, we have established and maintain processes related to incident response and have been developing processes related to business continuity and disaster recovery designed to address our response to a cybersecurity incident. We leverage third parties and cybersecurity consultants as appropriate, including a virtual Chief Information Security Officer, or vCISO, to develop strategies to assess, address and align cybersecurity efforts with our business objectives and operational requirements. Further, we have a risk-based process to assess the cybersecurity practices of certain third parties prior to onboarding, including vendors, service providers and other external users of our systems.

companyName: Tectonic Therapeutic, Inc.

ticker: TECX


text: To date, risks arising from cybersecurity threats have not materially affected the Company, its results of its operations, or its financial condition. However, the Company also recognizes the reality of the ever-evolving cyber risk landscape faced by industries and businesses across the world. Depending on their source and nature, cyber incidents could in the future materially affect CPKC and its operations, and financial condition.

companyName: CANADIAN PACIFIC KANSAS CITY LTD/CN

ticker: CP


text: Our security efforts are managed by a team of executive cybersecurity, IT, engineering, operations, and legal professionals. We have established a cross-functional leadership team, consisting of executive-level leaders, that meets regularly to review cybersecurity matters and evaluate emerging threats. With oversight and guidance provided by the cross-functional leadership team, our information security teams refine our practices to address emerging security risks and changes in regulations. Our executive-level leadership team also participates in cybersecurity incident response efforts by engaging with the incident response team and helping direct the company's response to and assessment of certain cybersecurity incidents.

companyName: NVIDIA CORP

ticker: NVDA


text: Our collaboration with other third parties includes regular audits of our ISO 27001 compliance, penetration testing, threat assessments, and consultation on security enhancements. These partnerships provide expert knowledge and insights which are designed to ensure our cybersecurity strategies and processes are appropriate.

companyName: Kimball Electronics, Inc.

ticker: KE


text: While we have yet to experience a material cybersecurity event, we acknowledge the persistent and evolving nature of these threats, which have the potential to materially impact our business strategy, operations, and financial results adversely. We maintain robust policies and procedures focused on cybersecurity incident management, ensuring timely communication and escalation to all relevant stakeholders. This enables faster response and effective communication, including public disclosure if a material cybersecurity event were to occur.

companyName: Crucial Innovations, Corp.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain individuals in Company management, including our VP of IT and Facilities, who has over 25 years of IT experience, including 10 years of information security experience, in various IT leadership roles in life sciences companies.

companyName: Vaxcyte, Inc.

ticker: PCVX


text: We have experienced, and may in the future experience, whether directly or through our supply chain or other channels, cybersecurity incidents. While prior incidents have not materially affected our business strategy, results of operations or financial condition, and although our processes are designed to help prevent, detect, respond to, and mitigate the impact of such incidents, there is no guarantee that a future cyber incident would not materially affect our business strategy, results of operations or financial condition. See "Risks Related to Technology, Security and Business Disruptions" in "Risk Factors" on pages 14 - 15 of this Form 10-K.

companyName: BOEING CO

ticker: BA


text: Our Audit Committee and our management are actively involved in the oversight of our risk management program, of which cybersecurity represents an important component. As described in more detail below, we have established policies, standards, processes, and practices for assessing, identifying, and managing material risks from cybersecurity threats. We have devoted significant financial and personnel resources to implement and maintain security programs to meet regulatory requirements and customer expectations, and we intend to continue to make significant investments to maintain the security of our data and infrastructure.

companyName: Sensata Technologies Holding plc

ticker: ST


text: We conduct regular internal reviews of our cybersecurity program which are overseen by our executive management, and material issues are presented to the board of directors. Our cybersecurity department also participates as part of our regular quarterly Disclosure Committee to review risks requiring disclosures in financial reporting.

companyName: Luminar Technologies, Inc./DE

ticker: LAZRQ


text: We have established a cybersecurity risk management process that aims to identify, assess, mitigate, monitor, and report on the IT risks and cybersecurity threats that may affect our business objectives, performance, reputation, and compliance. We conduct an overall annual cybersecurity risk assessment to identify and prioritize the IT risks that may impact our business strategy, results of operations, and financial condition. We have processes and controls that help prevent, detect, and recover from security incidents and we also perform regular security assessments to test the resilience of our IT systems and networks against potential attacks and vulnerabilities. Our employees are provided awareness training on a regular basis to help them identify, avoid, mitigate, and report cybersecurity threats.

companyName: CONSTELLIUM SE

ticker: CSTM


text: We also have a vendor risk assessment process consisting of the distribution and review of supplier questionnaires designed to help us evaluate cybersecurity risks that we may encounter when working with third parties that have access to confidential and other sensitive company information. We take steps designed to ensure that such vendors have implemented data privacy and security controls that help mitigate the cybersecurity risks associated with these vendors. We routinely assess our high-risk suppliers' conformance to industry standards (e.g., ISO 27001, ISO 28001, and C-TPAT), and we evaluate them for additional information, product, and physical security requirements. Refer to "Item 1A. Risk factors" in this annual report on Form 10-K for additional information about cybersecurity-related risks.


text: The cybersecurity committee of our board of directors has oversight responsibility for cybersecurity risks. The CISO provides updates at least twice a year to the cybersecurity committee regarding matters related to information technology and cybersecurity risks including the state of our cybersecurity programs, emerging cybersecurity developments and threats, and our strategy to mitigate cybersecurity risk. Additionally, the full board of directors receives updates on cybersecurity risks twice a year as part of the enterprise risk management meetings.

companyName: TE Connectivity plc

ticker: TEL


text: We maintain a comprehensive process following standard compliance frameworks (i.e., NIST) for identifying, assessing, and managing material risks from cybersecurity threats as part of our broader risk management system and processes. We closely follow the security industry and global threat trends, and our security professionals oversee cybersecurity risk management and mitigation, incident prevention, detection, and remediation. Our team consists of professionals with deep cybersecurity expertise across multiple industries, including our Director of Infrastructure Management (our ISO) and our Vice President, Cybersecurity Services. Our executive leadership team, along with input from the above professionals, are responsible for our overall enterprise risk management process and regularly consider cybersecurity risks in the context of other material risks to the Company. Should an incident arise or be identified, they reviewed by a cross-functional team to determine whether further escalation is appropriate, with any material incident being escalated to the appropriate members of the technical management teams.

companyName: INFINITE GROUP INC


text: The CIMT is responsible for coordinating the containment, response, investigation, reporting and recovery related to a cybersecurity incident, and is an internally led management team made up of leaders from our Communications, Human Resources, IT and Cybersecurity, Legal and Compliance, Risk Management and other departments, including our IT Director, Cyber Security. Team members possess a broad scope of expertise, including cybersecurity, information technology, legal, compliance, risk management, insurance and crisis communications. The CIMT operates under the co-leadership of the General Counsel and CDO, who are responsible for oversight and composition of the CIMT, determining whether an incident warrants activating external service providers, providing updates to the Chief Executive Officer and senior management team, keeping our Governance Committee as well as our Board of Directors informed as appropriate, and ultimately establishing and executing our enterprise-wide incident response strategy.

companyName: BWX Technologies, Inc.

ticker: BWXT


text: In the event of a potential cybersecurity incident, or a series of related cybersecurity incidents, we have a documented security incident response plan that provides a consistent approach to identifying and classifying the incident as well as a defined escalation process to management to assess the materiality.

companyName: MediXall Group, Inc.

ticker: MDXL


text: Our Board oversees significant risks facing the Company. For some categories of risk, the Board has empowered a committee to provide more focused oversight. In the case of cybersecurity and technology risk more broadly, the Board's Audit Committee has that responsibility.

companyName: HERTZ GLOBAL HOLDINGS, INC

ticker: HTZ


text: Management is responsible for day-to-day assessment and management of cybersecurity risks. The Company officer with oversight of Information Technology ("IT") has primary oversight of material risks from cybersecurity threats. Through November 2024, our Chief Information Officer was responsible for IT and had more than 25 years of experience across various engineering, business and management roles, including leading the development and implementation of information technology strategies and roadmaps for manufacturing automation. After the departure of our Chief Information Officer, our Vice President of Administration has responsibility and oversight for IT.

companyName: AAON, INC.

ticker: AAON


text: Our various cybersecurity risk management processes apply to various functions, including but not limited to, third-party suppliers and vulnerability management. We employ processes and technologies to bring visibility to, and protect against, cybersecurity risk, to include real time monitoring of network traffic. The Company also has a comprehensive body of policies and standards for assessing, identifying, and managing material risks from cybersecurity threats, including an incident response plan, business continuity plan, crisis management plan, as well as disaster recovery mechanisms, which are tested and updated. Additionally, the Company employs staff that are specifically dedicated to raising cybersecurity awareness and training within the organization.

companyName: Alcoa Corp

ticker: AA


text: Cybersecurity risks identified through any of the foregoing mechanisms and submitted to our governance, risk, and compliance platform are assessed by our internal risk management professionals, in collaboration with appropriate subject-matter experts ("SMEs"), pursuant to standards established by our Enterprise Risk Management ("ERM") organization. Our internal risk management professionals work with the SMEs and other stakeholders to establish remediation plans for identified information security risks and to determine when risk acceptance might be a reasonable and appropriate solution. Issues relating to cybersecurity identified by Internal Audit are reported to the Technology Committee of our board of directors ("Technology Committee").

companyName: GLOBAL PAYMENTS INC

ticker: GPN


text: As of the date of this report, we are not aware of any cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. We can provide no assurance that there will not be incidents in the future or that past or future attacks will not materially affect us, including our business strategy, results of operations, or financial condition.

companyName: BTCS Inc.

ticker: BTCS


text: During the three fiscal years presented within this Form 10-K, our results of operations and financial condition have not been materially affected by cybersecurity risks and incidents. For a detailed discussion of significant risk factors regarding cybersecurity threats, refer to Item 1A — "Risk Factors — Risks Related to Information Security and Technology."

companyName: TAPESTRY, INC.

ticker: TPR


text: We have not experienced any material cybersecurity incidents in fiscal 2024, and as of the date of this Report, we have not identified any material risks from active cybersecurity threats, including as a result of any prior cybersecurity incidents. However, despite our security measures, there can be no assurance that our cybersecurity risk management processes described will be fully implemented, complied with or effective in protecting our systems and information. While we maintain insurance to mitigate potential losses from a cybersecurity incident, such insurance may be insufficient to cover all losses or all types of claims that may arise. See Item 1A. Risk Factors in this Report for a discussion of whether and how risks from identified cybersecurity threats have materially affected or, if realized, are reasonably likely to materially affect our business strategy, results of operations or financial condition.

companyName: Citi Trends Inc

ticker: CTRN


text: Most recently, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, which have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors—Risks Related to Our Business and Operations."

companyName: SIFCO INDUSTRIES INC

ticker: SIF


text: Our CISO oversees our cybersecurity risk management in partnership with our Chief Financial Officer, General Counsel, Chief Compliance and Privacy Officer and other members of management. These members of management monitor and are informed of the prevention, mitigation, detection and remediation of cybersecurity incident through their management of, and participation in, the cybersecurity risk management and strategy processes described above.

companyName: NEVRO CORP


text: We provide periodic training for all personnel regarding cybersecurity threats, with such training appropriate to the roles, responsibilities and access of the relevant Company personnel.

companyName: Guardian Pharmacy Services, Inc.

ticker: GRDN


text: A third-party Managed Detection and Response ("MDR") service, which monitors the security of our information systems around-the-clock, including intrusion detection and alerting.

companyName: FIRST NORTHERN COMMUNITY BANCORP

ticker: FNRN


text: Cybersecurity Risk Management & Strategy We have implemented and maintain a cybersecurity program that is designed to identify, assess and manage risks from cybersecurity threats and was established by reference to the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. The primary goal of our cybersecurity program is to prevent cybersecurity incidents to the extent feasible, while simultaneously increasing our system resilience in an effort to minimize the business impact should an incident occur. We aim to take an active approach to monitoring and evaluating our cybersecurity threat environment and risk profile as part of our cybersecurity program, which is administered by our information systems ("IS") department, led by our Senior Vice President, Chief Technology Officer ("CTO") and Senior Vice President, Chief Information Officer ("CIO," together with our CTO, "IS Leaders"). Our IS Leaders are primarily responsible for the direction and implementation of technology, applications and security at BXP. Our CTO has extensive technology and program management experience with approximately 40 years of technology experience, 26 years of which have been with BXP and a total of 30 years with publicly-traded REITs. In January 2024, our IS leadership expanded to include our CIO, who has 30 years of technology experience developed across multiple industries, including commercial real estate, in guiding organizations through strategic initiatives that span technology, cybersecurity, and digital transformations.

companyName: BXP, Inc.

ticker: BXP


text: We rely on third-party service providers to help manage our information systems, including network security service providers with experienced information technology professionals. We also work with third parties to identify, assess, and manage actual and perceived cybersecurity threats and risks, and we evaluate cybersecurity risk as part of our overall risk management strategy. With the assistance of these third-party service providers, we implement and maintain various technical, physical, and administrative controls and processes to manage and mitigate material risks from cybersecurity threats to our information systems. This includes procedures for incident detection and response, network security controls, access controls, physical security, systems monitoring, and backup and recovery procedures.

companyName: MAYS J W INC

ticker: MAYS


text: As of the date of this report, we have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents that we believe have, or are likely to, materially affect us, our business strategy, results of operations or financial condition.

companyName: Next Technology Holding Inc.

ticker: NXTT


text: In 2023, we established an executive management group responsible for determining the materiality of cybersecurity incidents and necessary disclosures. This group consists of our CISO, Chief Financial Officer, Chief Legal Officer and Chief Accounting Officer.

companyName: JONES LANG LASALLE INC

ticker: JLL


text: • Disruptions in the Company's supply chain could result in an adverse impact on results of operations. • Network compromise or equipment sabotage could impact the operations of the fulfillment center sites which could impact the revenue. • Cybersecurity incidents, including breaches of confidential information, sensitive data, personal information, or intellectual property could damage the company's reputation, disrupt operations, increase costs, and impact revenues.

companyName: Grove Collaborative Holdings, Inc.

ticker: GROV


text: The program is designed based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF); provided that this does not imply that we meet any particular technical standards, specifications or requirements, only that we use the NIST CSF as a guide to help us identify, assess and manage cybersecurity risks relevant to our business.

companyName: BREAD FINANCIAL HOLDINGS, INC.

ticker: BFH


text: We utilize Information Technology Associates ("ITA"), an outsourced IT provider which has been designated with oversight responsibility for our cybersecurity risks. ITA possesses a deep understanding of our information technology systems, including methods to manage and monitor cybersecurity risks. It also provides active monitoring and risk assessments of cybersecurity threats and communicates such threats to our Company. Low risk threats are communicated to our systems analysts, and high risk threats are first communicated to Bill Bennett (our CEO and director), Brady Smallwood (our COO and director), and Gary Schubert, our CFO, and are then discussed with our board of directors.

companyName: INNOVATIVE FOOD HOLDINGS INC

ticker: IVFH


text: As a U.S. Government contractor, we may be prone to a greater number of cybersecurity threats than companies in other industries. We believe we are well positioned to meet the requirements of the Cybersecurity Maturity Model Certification ("CMMC") program and are preparing for certification once the requirements are effective. As of the date of this Report, risks from cybersecurity threats, including as a result of previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations or financial condition. However, there can be no guarantee that cybersecurity threats and incidents will not materially affect us in the future. See Item 1A of this Report for more information on our cybersecurity risks.

companyName: BWX Technologies, Inc.

ticker: BWXT


text: IT and cybersecurity are a standing Board agenda item, with quarterly presentations to the Board from the IT leadership quarterly. Our Audit Committee assists the Board in its oversight responsibilities regarding our systems, policies, and procedures relating to technology and cybersecurity. The Audit Committee's charter mandates that the Audit Committee reviews our technology and cybersecurity systems, policies, and procedures (including those relating to our assessment of third-party provider cybersecurity controls) with management. The Audit Committee is further tasked with discussing with management the policies with respect to risk assessment and risk management, including those related to technology and cybersecurity. The CRO presents an IT and Cybersecurity update to the Audit Committee on a quarterly basis and additionally as needed, to inform it of any new or emerging cybersecurity threats or risks.

companyName: GREENLIGHT CAPITAL RE, LTD.

ticker: GLRE


text: The Board's oversight of cybersecurity risk management is supported by the Audit Committee of the Board (the "Audit Committee"), which interacts with our Manager's Director of Information Technology and Chief Compliance Officer and other members of management of our Manager that implement and oversee our Manager's cybersecurity program.

companyName: NexPoint Real Estate Finance, Inc.

ticker: NREF


text: Maintain a dedicated cybersecurity team under the direction of our Chief Information Security Officer (the "CISO"), each of whom has expertise related to data and network security, data governance and risk management;

companyName: 5&2 Studios, Inc.


text: Current Processes: We believe we have adequate processes and systems to maintain the confidentiality of our communications and records. Given our current sales level and small number of employees, we do not perceive cybersecurity threats as a material risk at this time. However, SecureTech lacks formal processes for assessing, identifying, and managing cybersecurity risks directly or through third-party service providers. Additionally, we have not engaged any assessors, consultants, auditors, or other third parties regarding cybersecurity matters.

companyName: Securetech Innovations, Inc.

ticker: SCTH


text: Site assessment, procedural review and testing in connection with cyber insurance renewals; and terms of governance, the Company employs an IT director, with over 20 years of relevant experience, who supervises our other IT employees and is also responsible for our outside technology services. Our IT director reports directly to our President and reviews cybersecurity assessments with our President on at least a monthly basis. Our President is responsible for escalating any cybersecurity matters as appropriate, in consultation with our General Counsel. Our Board of Directors is ultimately responsible for oversight of cybersecurity risk management and receives regular reports from, and engages in regular dialogue with, Company management.

companyName: Omega Flex, Inc.

ticker: OFLX


text: The Board recognizes that our business depends on the confidentiality, integrity, availability, performance, security, and reliability of our data and technology systems and devotes time and attention to the oversight of cybersecurity and information security risk. In particular, the Board's Risk Committee receives recurring updates and reports on information security-related topics from senior management, including from the Company's Chief Compliance Officer, Chief Risk Officer, and Chief Information Security Officer. More specifically, the Risk Committee receives recurring presentations from senior management on cybersecurity, including architecture and resiliency, incident management, business continuity and disaster recovery, significant information technology changes, data privacy, insider threats, physical security, information related to third-party cyber assessments and risks associated with the use of third party service providers. The Risk Committee also reviews and approves any changes to the related information security and privacy program charter. Further, summaries of the proceedings from prior Risk Committee meetings are provided to the Board on a routine basis. Additionally, in 2024, the Board, along with senior management and third-party advisors, participated in a cybersecurity ransomware tabletop exercise.

companyName: Cboe Global Markets, Inc.

ticker: CBOE


text: Role of Management Our cybersecurity risk management program and activities are led by our CISO, who reports to Ken Grady, our Senior Vice President and CIO, and oversees a team of information security professionals. At this time, Mr. Grady is our acting CISO while we are conducting a search to hire a new CISO. Mr. Grady, who joined IDEXX as our CIO in 2014, has more than twenty years of experience leading information technology teams, including cybersecurity teams, at healthcare companies. Our CIO is responsible for our cybersecurity-related governance programs, overseeing testing of our compliance with standards and remediation of known risks, and leads our employee training program.

companyName: IDEXX LABORATORIES INC /DE

ticker: IDXX


text: The Trust does not have a board of directors; therefore, the Trustee is responsible for oversight of the Trust’s risks from cybersecurity threats. The Trustee has dedicated personnel that are responsible for assessing and managing the Trust’s cyber risk management program, informing senior management of the Trustee regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervising such efforts. The Trustee’s information technology team has decades of experience selecting, deploying, and operating cybersecurity technologies, initiatives, and processes, and relies on threat intelligence as well as other information obtained from governmental, public or private sources, including external consultants engaged by the Trustee to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. External partners are a key part of the Trustee’s cybersecurity protocols and policies. The Trustee works with leading firms in the cybersecurity industry, leveraging their technology and expertise to monitor and maintain the performance and effectiveness of products and services that are used by the Trustee.

companyName: SABINE ROYALTY TRUST

ticker: SBR


text: Training and testing for all employees on cybersecurity risks, mitigation, and best practices. New employees are required to complete cybersecurity training and testing, and annual training and testing is required for all employees. Written policies and procedures that govern the use of information technology and the handling of sensitive information. Written incident response plans. Regular cybersecurity reporting to the Audit Committee.

companyName: NVE CORP /NEW/

ticker: NVEC


text: Information Security Risk Management and Strategy We manage our cybersecurity risk in accordance with our Information Security Program, which is applicable to all users of our information technology assets, information assets, and facilities, including our directors, officers, employees, temporary workers, business partners, contractors, vendors, service providers, and individuals affiliated with third parties. The Information Security Program includes a dedicated Cybersecurity Incident Response Plan (the "CIRP"), which sets forth the rules and requirements for detecting, investigating, containing, eradicating, and resolving information security incidents, and addresses the response portion of security monitoring. The Information Security Program also includes: (i) a collection of Security Incident Forms, which delineate the processes for reporting, classifying, investigating, documenting, and communicating information security incidents and (ii) Security Guidelines and Baseline Protections, that establish the rules and requirements for enabling, logging, alerting, and monitoring real time security alerts and security logs (automated or manual) in connection with security incidents.

companyName: Community West Bancshares

ticker: CWBC


text: The Head of Global ISGA maintains a Certified Information Systems Security Professionals, or CISSP, certification and has approximately two decades of IT security management experience. The IT security team is supported by external vendors that provide managed services for network support, security operations and other IT areas as needed. Our IT security team also meets regularly with our Global Privacy Committee, which oversees our Enterprise Data Protection Program, to coordinate on cybersecurity initiatives and strategy related to protection of personal data.

companyName: Amylyx Pharmaceuticals, Inc.

ticker: AMLX


text: The Company has multiple enterprise risk programs and assessments that include information security as an integrated component and allow the Company to identify, assess, and manage risk. Processes and controls documented through these programs are tested as part of the enterprise-wide risk and control self-assessment program. Additionally, metrics have been identified across the organization to cover key information security risk, which have defined risk thresholds in line with our risk appetite. A management information systems program is in place with supporting governance routines to review any breaches of these metrics. Further risk management practices related to cybersecurity include scenario risk analysis, operational risk event escalation and monitoring, as well as processes to assure policy compliance.

companyName: Santander Holdings USA, Inc.


text: The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by external resources accessing the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.

companyName: QUICKLOGIC Corp

ticker: QUIK


text: We utilize third parties and consultants to assist in the identification and assessment of risks, including to support tabletop exercises and to conduct security testing. We utilize well-known cloud-based technologies and service providers such as GoDaddy, Microsoft Office, and DropBox enterprise to provide protection against cybersecurity threats. We have a special email encryption from GoDaddy that protect against cyberthreats.

companyName: Mag Mile Capital, Inc.

ticker: MMCP


text: The Director of Information Technology & Cybersecurity has served in various roles in information technology and information security for over 25 years, including the design and management of operational and cybersecurity activities of two large public companies. The Director of Information Technology & Cybersecurity holds undergraduate and graduate degrees in computer science and is certified in National Institute of Standards and Technology ("NIST"), Cybersecurity Maturity Model Certification ("CMMC"), Cybersecurity and Infrastructure Security ("CIS"), and General Data Protection Regulation ("GDPR"). The Company's CEO and CFO each hold undergraduate and graduate degrees in their respective fields, and each has over 20 years of experience managing risks at the Company and at similar companies, including risks arising from cybersecurity threats.

companyName: EASTERN CO

ticker: EML


text: On an annual basis, the cybersecurity organization also enlists the aid of an independent third party to assess our alignment with the National Institute of Standards & Technology's Cyber Security Framework. The assessment examines our information/cybersecurity program and its associated controls and delivers a report that documents assessment results and provides recommendations for further enhancements. The cybersecurity organization is responsible for presenting an overview of the Cybersecurity Risk Assessment Report to the Board of Directors on at least an annual basis, and the HP executive leadership team is heavily involved in implementing and resolving recommendations. From time to time, we also engage assessors, consultants, auditors, or other third parties to assist with assessing, identifying, and managing cybersecurity risks.

companyName: HP INC

ticker: HPQ


text: The audit committee of the board of directors is responsible for the oversight of the company's enterprise risk management program. The audit committee's oversight includes reviewing and discussing with management (at least annually) management's report on assessment of risk exposure and risk management, the processes in place to identify and manage significant risks, steps taken by management to control or mitigate such exposures, and management's report on cybersecurity risk management, which includes strategies to mitigate data protection and cybersecurity risks. Additionally, the IT Director reports at least annually to the audit committee on cybersecurity threat risks, and our Chief Executive Officer reports regularly to the chair of our board of directors, and the full board of directors, as appropriate, about emerging threats to our operations, both at scheduled board meetings and through communications between board meetings. Pursuant to the company's incident response plan, if a significant cybersecurity incident occurs that may have a material effect on the company's business or its financial statements, management will discuss the incident and management's mitigation and remediation plan for such incident with the audit committee. As of the date of this report, we have not identified any cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, financial results, or long-term financial condition. For more information on cybersecurity risks, see the risk factor entitled "Cybersecurity incidents could disrupt business operations, result in the loss of critical and confidential information, and adversely impact our reputation and results of operations" in Part I – Item 1. Business, Item 1A. Risk Factors contained in this report.

companyName: POTLATCHDELTIC CORP

ticker: PCH


text: We have invested time and resources with a goal to define, implement and further develop the maturity of our cybersecurity risk management and strategy program. During this time, we have developed a common cybersecurity incident response plan across our businesses and jurisdictions that while unique to the risk profile of each business, allows us to utilize common response and decision-making protocols in an effort to react quickly to a potential cybersecurity threat and manage risk to our overall Company.

companyName: ATN International, Inc.

ticker: ATNI


text: Members of management work collaboratively to develop and implement policies, practices and procedures to protect our IT networks and related systems from cybersecurity threats and to respond appropriately and timely to any cybersecurity incidents. The members of management responsible for our cybersecurity risk management program include our Vice President–Information Technology, our General Counsel, our Chief Accounting Officer, our Senior Vice President–Data and Technology, and our Vice President–Financial Reporting and Accounting. Through ongoing communications from employees in each of our Data, Analytics and Technology and Information Technology departments, such members of management monitor our assessment of material cybersecurity risks, our prevention and detection of cybersecurity threats, and, if a cybersecurity incident were to occur, our mitigation and remediation of such incident.

companyName: STAG Industrial, Inc.

ticker: STAG


text: OFG uses external consultants and other third-party service providers to monitor our information systems for any cyberattacks, impersonators or unauthorized releases of sensitive customer data, as well as performing investigations and penetration testing, identifying system vulnerabilities and required software patches, monitoring and managing firewalls, and advising on systems and cloud architecture. OFG also conducts due diligence of third-party software and related services and reviews cybersecurity reports from technology services providers to ensure that our cybersecurity infrastructure can respond to evolving cybersecurity risks relevant to our business. Pursuant to our cybersecurity risk management framework, our Information Security team develops an annual information security awareness plan to educate employees as to the Company's standards, processes and practices with respect to information security, potential cybersecurity threats and proper use of information security resources entrusted to them, with the goal of minimizing possible employee security risks. Our Information Security team engages third-party consultants to assist us in the evaluation of our cybersecurity risk management practices to identify risks, perform social engineering exercises, and provide annual cybersecurity training.

companyName: OFG BANCORP

ticker: OFG


text: We have not been a victim of a cyber-attack or other cybersecurity incident that has had a material impact on us, our business strategy, results of operations or financial condition; however, we have from time to time experienced non-significant cybersecurity events, including attempted denial of service attacks, malware infections, phishing and other information technology events that are typical for an electronic financial services company of our size. An actual, threatened or perceived cyber-attack or breach of our security could materially affect us, including our business strategy, results of operations and financial condition in many ways, including through the loss of clients or client confidence, expenditure of significant costs to repair system, network or infrastructure damages as well as to protect against future cyber-attacks, security breaches or harm and potential litigation or other claims or actions, including from regulatory agencies. For additional information regarding risks related to cybersecurity threats, see Part I, Item 1A. – "Risk Factors — Risks Relating to Cybersecurity and Intellectual Property — Actual or perceived security vulnerabilities in our systems, networks and infrastructure, breaches of security controls, unauthorized access to confidential or personal information or cyber-attacks could harm our business, reputation and results of operations" and "— Systems failures, interruptions, delays in service, catastrophic events and resulting interruptions in the availability of our platforms or solutions could materially harm our business and reputation."

companyName: Tradeweb Markets Inc.

ticker: TW


text: We also manage cybersecurity risk through incident response strategies. We employ a fault-tolerant, highly available architecture and network segmentation as part of our containment strategy. We do not solely rely on architecture to ensure continuity and containment, and we employ additional technologies including, but not limited to, automated account disabling, automated device quarantining, network segment-isolation scripts, and cyber kill chain runbooks. We have implemented an Enterprise Data Backup Policy, which includes, among other activities, offsite backups, intra-day recovery points, and routine restoration of critical data. We use infrastructure-as-code to enable recovery of virtualized environments and employ data replication across multiple operating regions. We routinely exercise our recovery capabilities. Our Cybersecurity Incident Response Plan establishes a framework to manage the life cycle of a cyber event. Additionally, our Enterprise Crisis Management Plan provides a structure to assemble an enterprise crisis team in the event of a potential cyber related crisis. The crisis response team, including our Chief Information Officer (CIO), is responsible for managing the channels of communication pursuant to our Crisis Management Plan. This notification includes the notification or reporting of any significant cyber incidents to executive management. We periodically conduct cyber incident drills that include, as applicable, members of our Board of Directors, executives, certain business stakeholders, and legal and security partners, as necessary.

companyName: Midstream Co LLC


text: As one of the critical elements of the Company's overall ERM approach, the Company's cybersecurity risk management program and strategy is focused on the following key areas: • Governance—As discussed in more detail under the heading "Governance," the Board's oversight of cybersecurity risk management is supported by the Risk Committee of the Board (the "Risk Committee") and by the Technology Committee of the Board (the "Technology Committee"), which regularly interacts with the Company's ERM function, CRO, Chief Information Officer ("CIO"), CISO and other members of management and relevant management committees. In recognition of the evolving landscape of cyber threats and the critical importance of safeguarding our digital assets and customer information, the Bank has taken proactive steps to enhance our cybersecurity framework and risk management practices. Central to these efforts is the expertise and oversight provided by the Board, particularly through the involvement of its Technology Committee. This committee is composed of directors with significant experience in technology and cybersecurity, working to align our cyber risk management strategies with best practices and industry standards. • Technical Safeguards—The Company deploys layered technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through penetration testing, vulnerability assessments and cybersecurity threat intelligence. • Incident Response and Recovery Planning—The Company has implemented a robust, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents. To that end, the Company has established and maintains a comprehensive cybersecurity incident response plan that establishes a structured approach for the Company's response to a cybersecurity incident, such plan is tested and evaluated on a regular basis. The Company has implemented controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. • Outside Experts —The Company routinely works with outside experts, consultants, auditors and other third parties in connection with managing its cybersecurity risks and for advice regarding best practices and technical expertise. • Third-Party Risk Management —The Company maintains a robust, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Education and Awareness—The Company provides regular, mandatory training for personnel regarding cybersecurity threats to equip the Company's personnel with effective tools to address cybersecurity threats.

companyName: Stellar Bancorp, Inc.

ticker: STEL


text: Threat Detection and Prevention – Given our limited resources, we prioritize the deployment of cost-effective tools and technologies for threat detection and prevention. This includes the use of firewalls, intrusion detection systems, antivirus software, and security information and event management (SIEM) solutions to monitor and mitigate potential security incidents.

companyName: ESCALADE INC

ticker: ESCA


text: The Company's cybersecurity risk management program is designed to ensure the Company's data, information systems, networks and devices are appropriately protected from a variety of threats and that our third parties with access to the Company's data take similar precautions. Regular risk assessments are conducted to validate control requirements and ensure that the Company's information is protected at a level commensurate with its sensitivity and value. Preventative and detective security controls are employed on all media where information is stored, the systems that process it, and infrastructure components that facilitate its transmission to ensure the confidentiality, integrity, and availability of Company information. These controls include, but are not limited to, access control, data encryption, data loss prevention, incident response, security monitoring, third-party risk management, and vulnerability management.

companyName: National Bank Holdings Corp

ticker: NBHC


text: We have a robust cybersecurity training and awareness program. We require employees and contract employees to regularly participate in information security training and use internal phishing campaigns to measure the effectiveness of the training program.

companyName: Vital Energy, Inc.

ticker: VTLE


text: Education and Awareness Our policies require each of our employees to contribute to our data security efforts. We regularly remind employees of the importance of handling and protecting customer and employee data, including through annual privacy and security training to enhance employee awareness of how to detect and respond to cybersecurity threats. We also provide quarterly training updates for our employees, which include social engineering exercises.

companyName: WASHINGTON TRUST BANCORP INC

ticker: WASH


text: Among other things, the Information Security Program is focused on the following key areas: • Security Operation and Governance: As discussed in more detail under the heading "Governance," senior management carries out this mandate through the Operational Risk and Enterprise Risk Management Committees. To maintain alignment and appropriate insight regarding information security activities, an Information Security Steering Committee provides general program insight. • Collaborative Approach: The Corporation has implemented a cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. • Security Competencies: The Information Security organization oversees a program of security competencies and tools designed to protect the confidentiality, integrity, and availability of our data. These assets represent a blend of various management (e.g., policies), operational (e.g., standards and processes), and technical controls (e.g., tools and configurations). • Cyber Defense Center and the Incident Response Plan: The Corporation has a Security Operations Center, known as the "Cyber Defense Center," which provides continual security monitoring 24 hours per day, seven days per week, where resources deliver threat analysis, vulnerability management, intrusion detection, intrusion hunting and red team exercises. The Corporation's Incident Response Plan helps reduce the risks related to security incidents by providing guidelines on responding to incidents by focusing on a roadmap for coordinating personnel, policies, and procedures. • Third-Party Risk Management: Management of the Corporation's third parties, including vendors and service providers, is conducted through a risk-based approach and the level of due diligence is driven from risk factors established by Corporate Risk Management. • Security Awareness and Education: The Corporation provides annual, mandatory training for personnel regarding security awareness as a means to equip the Corporation's personnel with the understanding of how to properly use and protect the computing resources entrusted to them, and to communicate the Corporation's information security policies, standards, processes and practices.

companyName: ASSOCIATED BANC-CORP

ticker: ASB


text: The Company maintains a dedicated internal cybersecurity team that interacts with executive management and its business units to identify, assess, manage, and respond to cybersecurity risks and incidents relating to the Company's information systems and operations. In addition, this internal cybersecurity team is responsible for managing detection, mitigation and remediation of cybersecurity incidents. The internal cybersecurity team is managed by the CISO, who reports to the CAO, who is a member of the executive leadership team. At December 31, 2024, the Company's internal cybersecurity team consisted of members located in various countries and time zones across the world. The team has members with experience in governance, risk management and compliance, threat monitoring, threat emulation, penetration testing and cyber incident management. Team members have both individual responsibilities and a team focus, covering areas such as network, endpoint device, and e-mail security engineering as well as operations and threat management, monitoring, and response.

companyName: MOODYS CORP /DE/

ticker: MCO


text: First Guaranty engages third-party services to conduct penetration testing as well as regular evaluations of security protocols and processes. Furthermore, First Guaranty has implemented a vendor risk management program that includes a thorough vendor review and information security assessment of the vendor's security controls, policies, and procedures prior to onboarding. Ongoing and regular monitoring of third parties is managed through the vendor management, enterprise risk management, Information Security, and internal audit departments.

companyName: First Guaranty Bancshares, Inc.

ticker: FGBI


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part I. Item 1A.

companyName: SunPower Inc.

ticker: SPWR


text: Part I Item 1A, 1B, and 1C the Fleet Marine Force, Joint Staff J-2/Defense Intelligence Agency, and Headquarters Marine Corps Command, Control, Communications, and Computers (C4I). The CSO participated in numerous exercises and crisis operations during his time in the military. The CSO is a member of the Information Systems Audit and Control Association and a certified Information Privacy Manager from the International Association of Privacy Professionals. The CSO also completed the Harvard Kennedy School Executive Education Program in Cybersecurity and the FBI Domestic Security Executive Academy.

companyName: ENTERGY LOUISIANA, LLC

ticker: ELC


text: The Board of Directors, directly and through its Audit Committee, oversees our cybersecurity risk management by reviewing material cybersecurity trends, potential risks and strategic priorities, and by monitoring progress made towards those priorities. The Audit Committee is responsible under its charter for reviewing with our management the processes management has implemented to monitor and mitigate cybersecurity risk exposures. On a regular basis, the Audit Committee considers management's reports on significant changes to our cybersecurity strategy, as well as risk mitigation and remediation efforts being undertaken with respect to cybersecurity incidents and under the program generally. The Audit Committee regularly reports to the Board of Directors on its activities with respect to cybersecurity matters.

companyName: Ingredion Inc

ticker: INGR


text: Our CIO and other senior leaders regularly review the results of the assessments, tabletop exercise, cybersecurity roadmap progress, and monthly operational metrics to stay informed about risks from cybersecurity threats and monitor the prevention, detection, mitigation and remediation of cybersecurity incidents. They report this information to the Audit Committee and ERM Committee as appropriate, together with measures to be implemented to further strengthen our IT environment as the Company grows and evolves. We have a response plan governing our assessment, response and notifications internally and externally upon the occurrence of a cybersecurity incident that is led by our CIO, in coordination with other senior leaders. Depending on the nature and severity of an incident, our CIO and CEO may escalate notification of the incident to the Audit Committee and to the Board.

companyName: ChampionX Corp


text: We also incorporate cybersecurity risk management into our Enterprise Risk Management ("ERM") program. Through our ERM program, we identify, assess and manage a broad range of risks across our businesses, regions and functions, and we align our risk management efforts with our corporate strategy. Our enterprise IT, manufacturing and distribution OT, third-party and product cybersecurity risks are each assessed as part of our ERM program. As part of our cybersecurity risk management program, we engage a range of third-party experts each year, including advisors, consultants and auditors, to evaluate and enhance our program through security attestations and certifications, maturity assessments and security testing. We also engage third parties for staff augmentation to strengthen our cybersecurity program through additional dedicated resources. In addition, we actively engage with intelligence agencies, law enforcement, and advocacy and industry groups.

companyName: BECTON DICKINSON & CO

ticker: BDX


text: The Audit Committee has been delegated the primary responsibility for the Board's oversight of cybersecurity risks. Executive summaries of our internal risk assessments, program initiatives, regulatory compliance and incident summaries are shared with our Audit Committee on a semi-annual basis, with additional updates as needed. Our third-party assessment and audit results, which are performed on an annual basis, and associated remediation plans are also shared with our Audit Committee. Additionally, our Internal Audit function independently conducts periodic reviews of our cybersecurity controls and reports the results of those reviews to the Audit Committee. The Audit Committee reports to the Board on cybersecurity risk oversight at least annually.

companyName: Victoria's Secret & Co.

ticker: VSCO


text: Through our incident response policy, we have designated an incident response team composed of representatives of management and other employees as well as representatives from our outsourced cybersecurity firm that has responsibility for overseeing cybersecurity incidents. Led by management, our third-party IT and cybersecurity team is responsible for the day-to-day investigation of and response to potential information security-related incidents. Pursuant to our incident response policy, incidents meeting specified severity levels are required to be escalated to the incident response team for review and response. The goal of the policy is to prevent, detect and react to information security incidents, determine their scope and risk, respond appropriately to the incident, communicate the results and risk to relevant stakeholders, and reduce the likelihood of the incident from reoccurring. Pursuant to our incident response policy, if we are notified of a cybersecurity incident impacting a third-party service provider that affects our information systems or data, we will respond on the same basis as any other incident. We are implementing a business use case review process and vendor risk assessment for all third-party service providers that will access or implicate our materially significant technology or data. If we deem the cybersecurity risk of a particular service provider too great, such service provider will not be approved or access will be terminated.

companyName: CareTrust REIT, Inc.

ticker: CTRE


text: Apollo and Athene Cyber teams coordinate with and leverage one another across a number of areas. The CISOs meet regularly to discuss cyber-related risks, programs and projects. Other members of Apollo and Athene's Cyber teams meet as needed on a variety of topics and open lines of communications are present to allow for the information sharing across the retirement services and asset management businesses.

companyName: Apollo Global Management, Inc.

ticker: APO


text: Our cybersecurity program is managed by a dedicated Chief Information Security Officer ("CISO") with over 25 years of experience, who has held leadership roles during his career managing cybersecurity, information compliance and governance, privacy programs, and risk remediation. The CISO holds several certifications in cybersecurity-related areas, including Certified Information Systems Security Professional (CISSP), Certified in Risk and Information Systems Control (CRISC) and Certified Information Systems Auditor (CISA). The CISO, General Counsel, and the Chief Financial Officer ("CFO") play a critical role in informing the Audit Committee on cybersecurity risks. They provide comprehensive briefings to the Audit Committee, generally on a quarterly basis but at least annually, which encompass a broad range of topics, including: • Current cybersecurity landscape and emerging threats; • Status of ongoing cybersecurity initiatives and strategies; • Incident reports and learnings from any cybersecurity events; and • Compliance with regulatory requirements and industry standards.

companyName: MediaAlpha, Inc.

ticker: MAX


text: Policies and Procedures As of December 31, 2023, we have implemented a set of comprehensive cybersecurity and data protection policies and procedures. Our comprehensive information security program is based on recognized industry standards covering areas such as risk management, incident response, change management, vendor assessment, data backup, and disaster recovery. Our policies and procedures provide for the prompt escalation and communication of significant cybersecurity incidents so that Company senior management, and where appropriate, the Board of Directors, can make decisions regarding the handling, public disclosure and reporting of such incidents in a timely and effective manner.

companyName: Telesis Bio Inc.


text: Cybersecurity Risk Oversight The BancPlus board of directors, through the Risk Committee, provides direction and oversight of the enterprise-wide risk management framework of BancPlus. The Risk Committee of the BancPlus board of directors oversees the Company's cybersecurity program. They receive regular reports from the Cybersecurity Committee about the prevention, detection, mitigation, and remediation of cybersecurity risks, including cybersecurity incidents, information security vulnerabilities, progress of risk reduction initiatives, external auditor feedback, control maturity assessments, and relevant internal and industry cybersecurity incidents. BancPlus' risk management framework is overseen by the Chief Risk Officer at the management level. BancPlus' CISO has primary responsibility for assessing and managing material cybersecurity risks and leads management's Cybersecurity Committee. The CISO's experience spans over 20 years of cybersecurity operations and management, leading teams in highly regulated industries such as healthcare, education, and financial industry consulting for private and public companies. The CISO holds a Master of Business Administration and has attained a variety of professional certifications such as CISSP, CISM, GLAW, and GSEC, among others. The CISO reports to the Chief Risk Officer. See the section entitled "Part I, Item 1. Business—Enterprise Risk Management" for additional information on the role of the BancPlus board of directors and its committees in overseeing risk management.

companyName: BANCPLUS CORP