text: The Company maintains robust processes for assessing, identifying, and managing material risks from cybersecurity threats. We are subject to federal and state laws and regulations governing privacy, security, and breaches of patient information and the conduct of certain electronic health care transactions, including, the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") and other health information privacy and security requirements. We rely on information technology networks and systems to process and store electronic information. We collect and store sensitive data, including PHI on our information technology networks. As we collect and manage large quantities of data, it is possible that hardware failures or errors in our systems could result in data loss or corruption or cause the information that we collect to be incomplete or contain inaccuracies that our partners regard as significant. Increased global cybersecurity vulnerabilities, threats, computer viruses, ransomware and phishing attacks, and more sophisticated and targeted cyber-related attacks, as well as cybersecurity failures resulting from human error and technological errors, pose a risk to the security of the Company's systems and networks and the confidentiality, availability, and integrity of data on these products, systems, and networks. We have implemented security measures designed to prevent disruptions and shutdowns of our information technology networks due to attacks by hackers or breaches due to malfeasance by contractors, employees and others who have access to our networks and systems.

companyName: MSP Recovery, Inc.

ticker: MSPR


text: The Company has effective processes in place to assess, identify, and manage material risks from cybersecurity threats. The Company's business is dependent on the communications and information systems of the Adviser, as an affiliate of FS Investments. The Company also relies on the communications and systems of other third-party service providers. FS Investments has implemented a cybersecurity program that applies to all of its subsidiaries and affiliates, including the Company and its operations.

companyName: FS KKR Capital Corp

ticker: FSK

secItem: Item 1C


text: b. The Company utilizes policies, software, training programs, hardware solutions and managed services to protect and monitor our environment, including multifactor authentication on all critical systems, firewalls, intrusion detection and prevention systems, vulnerability and penetration testing, identity and access management systems, cloud security controls and monitoring, data backup and recovery systems and 24x7 security operations center.

companyName: JELD-WEN Holding, Inc.

ticker: JELD


text: Under the direction of Atleos' Chief Security & Cash Operations Officer, the Global Information Security organization is responsible for implementing and maintaining an information security program with the goal to protect information technology resources and protect the confidentiality and integrity of data gathered on our people, partners, customers, and business assets. Also, we employ various information technology and protection methods designed to promote data security including firewalls, intrusion prevention systems, denial of service detection, anomaly-based detection, anti-virus/anti-malware, endpoint encryption and detection and response software, Security Information and Event Management system, identity management technology, security analytics, multi-factor authentication and encryption. In addition to the Chief Risk Officer, our Chief Compliance Officer has a direct channel to the Board. Further, our Chief Compliance Officer oversees investigations pertaining to fraud, conflicts of interest, violations of laws, and other similar matters, and reports on those activities to one or more Committees of the Board. All of these channels to the Board are designed to: prevent risks and initiatives from being siloed into one channel and provide a clear and accurate picture of the Company's evolving risk landscape.

companyName: NCR Atleos Corp

ticker: NATL


text: The Company's cybersecurity leadership includes the Chief Information Officer "CIO"/Chief Information Security Officer "CISO", who is responsible for governing and protecting Adtran's information assets, leading the cybersecurity strategy, and reporting directly to the Chief Executive Officer. The CIO/CISO ensures compliance with ISO 27001, oversees annual external audits, and leads the monthly Information Technology Cybersecurity meetings and the Data Privacy Committee. Since joining Adtran in November 2018, the CIO/CISO has leveraged extensive leadership experience to enhance the company's security posture. Additionally, the Chief Technology Officer ("CTO"), who joined the company in January 2023 following the Business Combination, plays a key role in product security oversight, drawing on prior experience as Adtran Networks' CTO leading their product management and advanced technology teams. Our CTO helps oversee our product security programs.

companyName: ADTRAN Holdings, Inc.

ticker: ADTN


text: Given the size of the company, we do not have a specific committee dedicated to cybersecurity oversight. Instead, all board members participate in the review and monitoring of these risks. The CTO and the CEO inform the board of directors on information security and cybersecurity matters as needed.

companyName: NYIAX, INC.


text: Firewalls. Our network and Computer Equipment is protected by one or more authorized firewalls, with any changes to firewall hardware, operating system, or rules requiring approval from authorized personnel including the review and approval of an IT change control document. Administration of firewalls is restricted to a minimum number of authorized personnel as necessary. We also employ intrusion detection at critical points of our network. All external access to our network, or to any computing resource on our network connected to a non-Clene network (including, but not limited to the internet) must pass through a hardware firewall, appliance, or equivalent device, where all traffic between our network and external networks can be continuously controlled, monitored, and examined for any access violations.

companyName: Clene Inc.

ticker: CLNN


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These material risks are managed across Riot, our subsidiaries, and third-party contractors, and monitoring such risks and threats is integrated into our overall risk management program. Our risk management program is comprised of, among other things, policies that are designed to identify, assess, manage, and mitigate cybersecurity risk, and is based on applicable laws and regulations, informed by industry standards and best practices.

companyName: Riot Platforms, Inc.

ticker: RIOT


text: Our Chief Information Officer, Chief Legal Officer, Chief Executive Officer, Chief Financial Officer and Chief Administrative Officer help identify, assess and manage the Company's cybersecurity threats and risks. They will identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example manual and automated tools, subscribing to reports and services that identify cybersecurity threats, conducting scans of the threat environment, evaluating threats reported to us, internal and external audits, conducting threat assessments for internal and external threats, third-party threat assessments and conducting vulnerability assessments to identify vulnerabilities.

companyName: SunPower Inc.

ticker: SPWR


text: Reliance on third parties' products and services that support critical operations can affect the risk posture, because these can be the target of new and evolving cybersecurity attacks. This risk, along with expanded regulatory requirements, has necessitated an increased use of technology to better identify information security risks across third parties and where necessary, pro-actively perform outreach with them. Deutsche Bank Group has a third-party risk management process designed to identify, monitor, and mitigate risks arising from working with third parties, which includes oversight of third parties' operations related to the services provided. In addition, where appropriate, Deutsche Bank Group will seek to include in its contractual arrangements with certain third-party vendors provisions addressing best practices with respect to data and cybersecurity, as well as the right to assess, monitor, audit and test such vendors' cybersecurity programs and practices.

companyName: RREEF Property Trust, Inc.


text: We design and assess our program based on the HITRUST Common Security Framework. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the HITRUST Common Security Framework as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: P3 Health Partners Inc.

ticker: PIII


text: The Company continues to expand investments in information technology security, including continuous end-user training, layered defenses, identifying and protecting critical assets, strengthening monitoring and alerting.

companyName: Gouverneur Bancorp, Inc./MD/

ticker: GOVB


text: We have adopted a comprehensive Information Security Policy applicable to all of our employees and business partners. We also maintain a Global Security Incident Response Plan ("GSIRP") to ensure we remain prepared in the event of a cyberattack or other form of network penetration. Our GSIRP is a cross functional plan that documents the details and decision-making process required during a response to a security incident, as well as the reporting protocol with clear escalation timelines and responsibilities. We test our GSIRP with tabletop exercises administered by a third party security consultant. We also maintain cyber liability insurance to help mitigate potential liabilities resulting from cyber issues.

companyName: Envista Holdings Corp

ticker: NVST


text: The Board and Audit Committee receive regular reports from management on our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.

companyName: Commerce.com, Inc.

ticker: CMRC


text: To date, we have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition; however, like other companies in our industry, we and our third-party IT service providers and vendors have from time to time experienced threats that could affect our information or systems. For more information, see, "Risk Factors," in this Annual Report.

companyName: enGene Holdings Inc.

ticker: ENGN


text: The Company has a Chief Information Security Officer ("CISO") whose team is responsible for leading company-wide cybersecurity strategy, policy, standards, and processes and works across all of the units of the Company to help protect the Company and its employees against cybersecurity risks. The CISO has significant cybersecurity expertise, including prior cybersecurity leadership in banking and insurance organizations. The CISO holds a Master of Business Administration, as well as Certified Information Systems Security Professional, Certified Information Systems Auditor, and Certified Information Security Manager cybersecurity-related certifications. The CISO also serves as a Director for the RH-ISAC.

companyName: CHOICE HOTELS INTERNATIONAL INC /DE

ticker: CHH


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment. The Company annually purchases a cybersecurity risk insurance policy that would help defray the costs associated with a covered cybersecurity incident if it occurred.

companyName: Warby Parker Inc.

ticker: WRBY


text: We continue to prioritize our investments in IT security, including additional end-user training, using layered defenses, identifying and protecting critical assets, strengthening monitoring and alerting capabilities and engaging experts. We regularly test defenses by performing simulations and drills at both a technical level (including through penetration tests) and by reviewing our operational policies and procedures with third-party experts. At the management level, our IT security team regularly monitors alerts and meets to discuss threat levels, trends and remediation. Further, we conduct periodic external penetration tests, bug bounty hackathons and maturity assessments to assess our processes and procedures and the threat landscape. These tests and assessments are useful tools for maintaining a robust cybersecurity program to protect our investors, customers, employees, vendors and intellectual property. In addition to assessing our own cybersecurity preparedness, the Audit Committee and the IT security team also consider and evaluate cybersecurity risks associated with use of third-party service providers.

companyName: Lulu's Fashion Lounge Holdings, Inc.

ticker: LVLU


text: Based on information known to us, we do not believe any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. We can give no assurance that we have detected or protected against all cybersecurity threats or incidents. Please refer to "Cybersecurity incidents or other damage to the information systems and technology of us or our tenants could harm our business" and "If we or our tenants fail to adhere to applicable privacy and data security laws, this could have a material adverse effect on us or on our tenants' ability to meet their obligations to us" included "Item 1A, Risk Factors" of this Annual Report on Form 10-K for additional information about material risks related to cybersecurity threats.

companyName: CareTrust REIT, Inc.

ticker: CTRE


text: Our business depends on the availability, reliability, and security of our information systems, networks, data, and intellectual property. As of the date of this report, we have not experienced a cybersecurity incident that has materially affected or is reasonably likely to materially affect our business strategy, results of operations, or financial condition. Any disruption, compromise, or breach of our systems or data due to a cybersecurity threat or incident could adversely affect our operations, research, product development, and competitive position. They may also result in a breach of our contractual obligations or legal duties to protect the privacy and confidentiality of our stakeholders. Such a breach could expose us to business interruption, future lost revenue, ransom payments, remediation costs, liabilities to affected parties, cybersecurity protection costs, lost assets, litigation, regulatory scrutiny and actions, reputational harm, and harm to our vendor relationships.

companyName: CAPRICOR THERAPEUTICS, INC.

ticker: CAPR


text: maintaining oversight of our information security program by senior management, our board-level Risk Committee, and our Board of Directors; and using a comprehensive Cybersecurity Incident Response Plan intended to provide a documented framework to enable us to mitigate the impact of, and recover from, any cyberattacks, and facilitate communication to internal and external stakeholders, as appropriate.

companyName: Atlantic Union Bankshares Corp

ticker: AUB


text: b Management provides frequent informal communications to the Board between regularly scheduled meetings to keep the Board apprised of any emerging risks or incidents.

companyName: IREN Ltd

ticker: IREN


text: Assessments and Risks Associated With Cybersecurity Threats While we have assessed our cybersecurity risk management program periodically in the past, in the second half of 2023, we started to utilize a leading industry cybersecurity framework in our assessments. Specifically, we use this framework to assess our cybersecurity controls against industry best practices in the areas of: identify and protect assets, detect and respond to suspicious activity, as well as recover from cybersecurity incidents. Based on the results of our initial assessment, we have developed a multi-year plan that allows us to focus on the highest priorities. Under the plan, we are required to make additional investments to enhance our processes and practices over a period of time.

companyName: Compass, Inc.

ticker: COMP


text: Our board of directors considers cybersecurity risk as part of its risk oversight function. The board of directors oversees management's implementation of our cybersecurity risk management program.

companyName: Cuentas Inc.

ticker: CUEN


text: We recognize the importance of developing, implementing, and maintaining cybersecurity measures designed to safeguard our information systems and protect the confidentiality, integrity, privacy, and availability of our data. We have implemented and integrated into our broader risk management framework a cybersecurity risk management program designed to promote a company-wide culture of cybersecurity risk awareness and management. Our cybersecurity risk management program includes a number of components, including periodic system audits and ongoing monitoring of critical risks from cybersecurity threats supported by third-party providers and technologies as well as automated tools. This process is designed to evaluate, assess, identify, and manage cyber risks in alignment with our business objectives and operational needs. In support of those efforts, we leverage a managed service provider ("MSP") and also engage with other third-party providers, consultants, and auditors to support our cyber risk management program, including periodic engagement of third parties to conduct security assessments and testing related to our computer systems. We have a process to implement mitigation plans to monitor and address identified cyber risks. Additionally, we have implemented an employee education program that is designed to raise awareness of cybersecurity threats, including risks posed by phishing attempts. We have implemented a process for this training to be included during the employee onboarding process and periodically thereafter.

companyName: Centessa Pharmaceuticals plc

ticker: CNTA


text: Our management evaluates all cybersecurity matters, with the purpose of meeting at least semi-annually and providing recommendations with respect to our information technology use and protection, including, but not limited to, data governance, privacy, compliance and cybersecurity. We have implemented controls, policies, procedures and technological safeguards to maintain and protect the integrity, continuous operation, redundancy and security of our IT systems and data that we believe to be reasonably consistent with industry standards and practices, or as required by applicable regulatory standards. We are also required to comply with applicable laws, rules, regulations and contractual obligations relating to the privacy and security of our IT systems and data and to the protection of such IT systems and data from unauthorized use, access, misappropriation or modification.

companyName: LM FUNDING AMERICA, INC.

ticker: LMFA


text: The Company recognizes the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard its information systems and protect the confidentiality, integrity, and availability of its data. The Company's information security program is managed by its Vice President, Operations and Technology, whose team is responsible for leading Company-wide cybersecurity strategy, policy, standards, architecture, and processes.

companyName: TANDY LEATHER FACTORY INC

ticker: TLF


text: Personnel and Third-Party Engageme nt Our Information Technology department is led by the Director of Technology who has more than twenty years of experience in technology management and cybersecurity, conducts regular risk assessments and continuously monitors our networks and systems.

companyName: Good Times Restaurants Inc.

ticker: GTIM


text: Cybersecurity risk management is part of the Company's overall enterprise risk management program. Our cybersecurity risk management program is designed to provide a framework for handling cybersecurity threats and incidents, including threats and incidents associated with the use of services provided by third-party service providers, and facilitate coordination across different departments of our company. This framework includes steps for assessing the severity of a cybersecurity threat, identifying the source of a cybersecurity threat including whether the cybersecurity threat is associated with a third-party service provider, implementing cybersecurity countermeasures and mitigation strategies and informing management and our Board of material cybersecurity threats and incidents. We engage with third party service providers to perform penetration tests and to inform us of possible vulnerabilities. In addition, cybersecurity training is provided to all employees on a regular basis and at least annually.

companyName: PHX MINERALS INC.


text: The CISO has appointed experienced security leaders over the North America and International regions to create additional alignment and collaboration.

companyName: APi Group Corp

ticker: APG


text: Our CISO is the member of our management team that is principally responsible for overseeing our cybersecurity program, in partnership with other business leaders across the Company. Our CISO has served in various roles in information technology and information security for over 25 years and holds a degree in Business Administration with a major in Accounting and Finance and a graduate degree in International Management. Our CISO also holds advanced certifications as a Certified Information Systems Security Professional and as a Qualified Technology Executive granted by Digital Directors Network and works in coordination with the other members of management, including, but not limited to, the Company's President and Chief Executive Officer, Chief Financial Officer, Chief Technology Officer, and General Counsel. Our Chief Technology Officer holds an undergraduate degree in computer science and economics from Northwestern and has served in various roles in information technology for over 33 years with Boyd Gaming and numerous other public companies. The Company's President and Chief Executive Officer, Chief Financial Officer, and General Counsel each hold undergraduate and graduate degrees in their respective fields, and each has years of experience with managing risks at the Company and in environments similar to the Company's, including risks arising from cybersecurity threats.

companyName: BOYD GAMING CORP

ticker: BYD


text: To fortify our information assets, we employ industry-standard measures such as multifactor authentication and endpoint protection defenses. Moreover, we collaborate with internal stakeholders across the organization to embed fundamental cybersecurity principles into our operations. This entails implementing multiple layers of cybersecurity defenses, restricting access based on business necessity, and ensuring the integrity of our business information. Throughout the year, our employees undergo regular cybersecurity awareness training, receive guidance on protecting confidential information, and participate in simulated phishing exercises. We maintain a cybersecurity incident response plan that includes a cross-functional response team and procedures for responding to cybersecurity incidents.

companyName: Rocket Lab Corp

ticker: RKLB


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan. There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information.

companyName: Immuneering Corp

ticker: IMRX


text: Our information technology team, led by our Vice President of Information Technology, is responsible for managing and directing day-to-day assessment and management of materials risks from cybersecurity threats, including oversight of our cybersecurity tools, controls and strategies to protect organization assets, networks and data. The Vice President of Information Technology reports to our Chief Financial and Business Officer. The Vice President of Information Technology has primary responsibility for our overall cybersecurity risk management program and supervises both our internal IT personnel and our retained external cybersecurity consultants. The Vice President of Information Technology has over 25 years of experience in information technology.

companyName: Phathom Pharmaceuticals, Inc.

ticker: PHAT


text: Engagement of Third Parties We engage third-party subject matter experts and consultants to conduct evaluations of our security controls, including, but not limited to, penetration testing, maturity assessments or consulting on our response to emerging threats. Results of these evaluations are used to help determine priorities and initiatives to improve the overall Program. As necessary, we also engage third-party experts and consultants to assist with the incident response process to augment our internal security operation center team.

companyName: LPL Financial Holdings Inc.

ticker: LPLA


text: Under its committee charter, the Audit Committee of the Board of Directors (the "Audit Committee") is responsible for discussing with senior management our policies with respect to risk assessment and risk management and for discussing with management our financial risk exposures and the steps management has taken to monitor and control such exposures. In particular, the Audit Committee oversees our cybersecurity strategy designed to identify, assess and mitigate cybersecurity risks, and reviews our cybersecurity and other information technology risks, controls and procedures, and receives periodic updates from management on cybersecurity regarding the adequacy and effectiveness of our cybersecurity measures. In fulfilling this oversight responsibility, the Audit Committee receives a periodic update of our cybersecurity strategy. Included in this review is a thorough discussion of the risks from cybersecurity threats including the potential impact of such threats to our operations. Specifically, with respect to cybersecurity risks, Incident Response Team members report to the Audit Committee on the (i) potential impact of the risk to the business, (ii) our current capabilities in managing such risks, (iii) the urgency for action in managing such risks and (iv) the outlook for a potential impact on us as a result of the risk. The Audit Committee also receives reports from members of the Incident Response Team on our mitigation efforts to address cybersecurity risks.

companyName: HALOZYME THERAPEUTICS, INC.

ticker: HALO


text: Our board of directors has oversight responsibility for our overall enterprise risk management, and delegates cybersecurity risk management oversight to our audit and risk committee. As part of its enterprise risk management efforts, our board of directors also meets with management, including our CISO, to assess and respond to critical business risks, including those that may arise from cybersecurity threats and incidents. Our audit and risk committee is responsible for ensuring that management has policies and processes in place designed to identify, monitor, assess, and respond to cybersecurity, data privacy, and other information technology risks to which the Company is exposed. Further, our audit and risk committee reports material cybersecurity risks to our full board of directors, based on the assessment of risk by our management, CISO, information security team, and legal team.

companyName: Remitly Global, Inc.

ticker: RELY


text: Avoid Sharing Confidential Files Outside the Organization: We enforce strict data handling policies to prevent the sharing of confidential files outside the organization. This includes the use of encrypted communication channels and secure data storage solutions.

companyName: AIBOTICS, INC.

ticker: AIBT


text: The underlying controls of our cybersecurity risk management program are based on recognized industry practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology Cybersecurity Framework. Our approach to cybersecurity risk management includes the following key elements: • Defense and On-going Monitoring – Our SOC is responsible for the on-going monitoring and analysis of cybersecurity threats to the Company. The SOC evaluates cybersecurity incidents according to the Company's cyber incident response plan, appropriate cybersecurity incident playbook, and crisis communications cybersecurity incident plan. The Company also utilizes endpoint detection and response services as well as data forensic investigation services for additional capability and timely assistance with potential cybersecurity incidents. • Technical Safeguards – The Company utilizes various tactics for cybersecurity threat protection. We periodically perform vulnerability assessments, remediate vulnerabilities, review logs and access, perform system maintenance, manage network perimeter protection, and implement and manage disaster recovery testing. Further, Zebra relies on its information security management system supported by a comprehensive set of policies that directly align with ISO 27001 and are supported by System and Organization Controls 2 (SOC2) reports and external ISO 27001:2013 certification for certain parts of our business. • Education and Awareness – To foster employee awareness of cybersecurity threats, we provide periodic educational sessions to our employees, including annual training on general cybersecurity concepts and targeted educational opportunities that include real-life simulation and "tabletop exercises." We also regularly conduct privacy and security summits that involve training and information sessions conducted by employees and by third parties. • Third-Party Risk Management ("TPRM") – Our TPRM function focuses on mitigating cybersecurity risk from specific third-party vendor categories. This function performs initial TPRM assessments as part of the vendor selection process and regularly reassesses vendors based on vendor type and risk factors.

companyName: ZEBRA TECHNOLOGIES CORP

ticker: ZBRA


text: Ford and Ford Credit's global cybersecurity incident response is overseen by Ford's Chief Information Security Officer. Ford's Chief Information Security Officer has served in that role for over 7 years and has over a decade of engineering and operations expertise with cybersecurity technologies and services. He was appointed in 2022 by the Ford Credit Board as Ford Credit's "Qualified Individual" under the Federal Trade Commission Safeguards Rule, and is responsible for overseeing and implementing Ford Credit's information security program and enforcing it. Ford Credit's Chief Technology Officer is Ford Credit's senior member responsible for direction and oversight of the Qualified Individual. Ford's Chief Information Security Officer also reports to Ford Motor Company's Chief Enterprise Technology Officer, who has spent over two decades managing cybersecurity risks as a leader at enterprise software and Fortune 50 companies. Ford's Chief Enterprise Technology Officer reports directly to Ford's Chief Executive Officer.

companyName: FORD MOTOR CREDIT CO LLC


text: 26North utilizes technical security controls, policy enforcement mechanisms, monitoring systems, tools and related services, including from third-party providers, and management oversight to assess, identify and manage risks from cybersecurity threats. In addition, 26North has implemented and continues to implement risk-based controls designed to prevent, detect and respond to information security threats. Such controls help us and 26North protect our information, our information systems, and the information of our investors, and other third parties who entrust us with their sensitive information.

companyName: 26North BDC, Inc.


text: Specifically, our technology team relies on third-party information security experts for risk assessment, monitoring, and system enhancements. In addition, our technology team provides training to all employees periodically, on an ongoing basis.

companyName: Ranpak Holdings Corp.

ticker: PACK


text: As required by Item 106 of Regulation S-K, the following sets forth information regarding our cybersecurity strategy, risk management and governance, which is overseen by Caterpillar and forms a part of Caterpillar's cybersecurity strategy, risk management and governance. A description of Caterpillar's cybersecurity strategy, risk management and governance can be found under Item 1C. "Cybersecurity" in Caterpillar's Annual Report on Form 10-K for the year ended December 31, 2024 filed separately with the SEC.

companyName: CATERPILLAR FINANCIAL SERVICES CORP


text: Management provides cybersecurity program briefings to the Audit Committee on at least an annual basis, and more frequently if circumstances warrant. These briefings include assessments of cyber risks, the threat landscape, updates on any incidents, and reports on NOG's investments in cybersecurity risk mitigation and governance.

companyName: NORTHERN OIL & GAS, INC.

ticker: NOG


text: We conduct periodic risk assessments to identify potential internal and external cybersecurity threats. These assessments evaluate the likelihood of the occurrence and potential impact of such threats, as well as the adequacy of our existing policies, procedures, systems, and controls.

companyName: GCT Semiconductor Holding, Inc.

ticker: GCTS


text: While cybersecurity incidents have not had a material adverse effect on our business, financial condition, results of operations, or cash flows, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us.

companyName: Broad Capital Acquisition Corp


text: The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. Our full board of directors also receives briefings from management where it deems appropriate regarding cybersecurity.

companyName: Revolution Medicines, Inc.

ticker: RVMD


text: Cleco has processes and procedures in place to ensure its cybersecurity program is operating effectively and members of Cleco's EMT routinely review its cybersecurity strategy, policy, program effectiveness, standards enforcement, and cybersecurity issue management. Cleco conducts risk assessments and compliance audits against standards including the NIST CSF, NERC CIP, and SOX. Cleco also engages with a variety of independent third parties, such as assessors, consultants, and auditors, for periodic audits and reviews of cybersecurity threats and related controls, including review of periodic penetration tests, regular patch reviews from vendors listing relevant risks, industry alerts and forums, and tabletop exercises. These assessment results are used to develop appropriate cybersecurity controls and risk mitigation strategies, which are implemented throughout the organization. Cleco also utilizes its Internal Audit department to review its cybersecurity program, in which findings are reported to the Audit Committee.

companyName: Cleco Corporate Holdings LLC


text: Our Information Technology department, under the leadership of our Vice President of Information Technology ("VP of IT") and with cross-functional internal and third-party support, helps identify, assess and manage the Company's cybersecurity threats and risks. The Information Technology department identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and the risk profile of the Company and its industry using various methods, including regular threat assessments (including through interaction with law enforcement), internal and external audits, threat environment scans and third-party threat assessments, vulnerability assessments, external intelligence feeds and third-party-conducted tabletop training exercises.

companyName: Vital Farms, Inc.

ticker: VITL


text: Risk Monitoring and Review: We implement tools to continuously monitor network traffic, system logs, and user activities to detect threats in real-time. Regular audits and metrics help identify gaps, track performance, and strengthen our cybersecurity posture.

companyName: Armlogi Holding Corp.

ticker: BTOC


text: W e use independent third-party service providers to perform penetration testing of our infrastructure to help us better understand the effectiveness of our controls, improve our defenses, and conduct assessments of our program for compliance with regulatory requirements and industry guidelines. We also engage with outside risk experts and industry groups, including other peer institutions, as needed, to help us evaluate potential future threats and trends, particularly with respect to emerging information security and fraud risks. In addition, we use a Third-Party Risk Management program to help mitigate risks with our third- and fourth-party providers; however, our ability to monitor our service providers' cybersecurity practices is limited. We generally have agreements in place with our service providers that include requirements related to cybersecurity and data privacy. We cannot guarantee, however, that such agreements will prevent a cyber incident from impacting our systems or information. Additionally, we may not be able to obtain adequate or any reimbursement from our service providers in the event we should suffer any such incidents. Due to applicable laws and regulations or contractual obligations, we may be held responsible for cyber incidents attributed to our service providers in relation to any data that we share with them.

companyName: Atlantic Union Bankshares Corp

ticker: AUB


text: All incidents are prioritized and assessed for materiality. Cybersecurity incidents are reported to relevant stakeholders in accordance with the incident response plan. All notable cybersecurity incidents as well as the number of cybersecurity incidents are reported quarterly to the Board of Directors.

companyName: SUPERIOR INDUSTRIES INTERNATIONAL INC

ticker: SSUP


text: Our cybersecurity risk management processes include a cybersecurity incident response plan, and we have invested in technical and organizational safeguards intended to manage and mitigate material risks from cybersecurity threats to our IT Systems, including network security controls, employee training, internal vetting of critical third-party vendors and service providers who have access to our systems or with whom we may share data, as well as periodic system reviews and security incident response exercises. Our cybersecurity risk management program is a component of the overall enterprise risk management activities that we undertake, and shares common methodologies, reporting channels and governance processes that apply to other risk areas.

companyName: Custom Truck One Source, Inc.

ticker: CTOS


text: The Audit Committee of Kroger's Board of Directors is charged with oversight of data privacy and cybersecurity risks. Kroger's CDO and CISO provide quarterly updates on cybersecurity risks and related mitigating actions to the Audit Committee, meet with the full Board at least annually and inform the Audit Committee immediately if a cybersecurity incident is deemed material. They report to the Audit Committee and the Board on compliance and regulatory issues, provide updates concerning continuously-evolving threats and mitigating actions, and present a NIST Cybersecurity Framework Scorecard. Additionally, the CDO and CISO discuss and present strategies to address geopolitical threats that may affect operations as well as technological changes, such as AI and quantum computing. In overseeing cybersecurity risks, the Audit Committee focuses on aggregated, thematic issues with a risk-based approach. Oversight of cybersecurity risk incorporates strategy metrics, third-party assessments, and internal audit and controls. An independent third party also regularly reports to the Audit Committee and the full Board on cybersecurity, and outside counsel advises the Board on best practices for cybersecurity oversight by the Board, and the evolution of that oversight over time. Management also reports on strategic key risk indicators, ongoing initiatives, and significant incidents and their effect.

companyName: KROGER CO

ticker: KR


text: As cybersecurity risks continue to evolve with multiple threat vectors, Entergy and the Registrant Subsidiaries maintain a comprehensive security strategy to keep current with the changing threats. To inform this effort, Entergy and the Registrant Subsidiaries utilize the National Institute of Standards and Technology Cybersecurity Framework, which consists of standards, guidelines, and best practices to manage cybersecurity risk across the enterprise. A risk-based approach is used to direct security initiatives to the most significant risks and provide the most value in terms of risk reduction and protection. Entergy and the Registrant Subsidiaries use a vendor risk management program to assess and monitor security risks that arise from certain third-party vendors. In addition, Entergy and the Registrant Subsidiaries utilize technology and threat-intelligence services to assess and continuously monitor the cybersecurity risk of key vendors, as identified through the vendor risk management program.

companyName: ENTERGY LOUISIANA, LLC

ticker: ELC


text: Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. We have established policies and controls for assessing, identifying and managing material cybersecurity risks and responding to material cybersecurity incidents.

companyName: DYADIC INTERNATIONAL INC

ticker: DYAI


text: As part of our overall risk management approach, we prioritize the identification and management of cybersecurity risks at several levels, including Board oversight, executive commitment, management support, and employee training.

companyName: CENTERPOINT ENERGY RESOURCES CORP


text: As a triple net REIT with no significant consumer facing infrastructure or exposure, the Company faces a limited number of cybersecurity risks in connection with the operation of the business. Risks from cybersecurity threats have not materially affected the Company to date and are not reasonably likely to materially affect the Company, including the Company's business strategy, results of operations or financial condition. Other than widespread threats generally affecting businesses, the Company has not experienced threats to or breaches of its data or systems, including malware and computer virus attacks. For more information about the cybersecurity risks faced by the Company, see the risk factor entitled "We face risks associated with security breaches through cyber-attacks, cyber intrusions or otherwise, as well as other significant disruptions of our information technology (IT) networks and related systems" in Item 1A- Risk Factors.

companyName: Gaming & Leisure Properties, Inc.

ticker: GLPI


text: In addition, we have product cybersecurity risk assessment and management processes in place within our E-Systems business, where our products are more susceptible to cybersecurity threats, that align our internal policies, standards and development practices with customer requirements and industry standards, including the International Organization for Standardization ("ISO") 21434 control framework specific to road vehicle cybersecurity engineering. We received our ISO 21434 Road Vehicle Cybersecurity Engineering certification in 2023.

companyName: LEAR CORP

ticker: LEA


text: In the last two fiscal years, we have not identified cybersecurity threats that have materially affected, or are reasonably likely to materially affect, our business, results of operations, or financial condition. Although we proactively attempt to prevent all threats, we are unable to eliminate all risk from cybersecurity threats or provide assurance that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see Item 1A. Risk Factors "Our business and operations would suffer in the event of computer system failures, cyber-attacks, or deficiencies in our or third parties' cybersecurity."

companyName: MUSTANG BIO, INC.

ticker: MBIO


text: We have experienced cybersecurity incidents, primarily related to phishing emails, and may in the future experience, whether directly or indirectly, cybersecurity incidents. While prior incidents have not materially affected our business strategy, results of operations, or financial condition, there is no guarantee that a future cyber incident would not materially affect our business strategy, results of operations, or financial condition. See risks related to cybersecurity and business disruptions in "Risk Factors" in this Form 10-K.

companyName: UNITED STATES ANTIMONY CORP

ticker: UAMY


text: We maintain a comprehensive process for identifying, assessing, and managing material risks from cybersecurity threats as part of our broader risk management system and processes. This cybersecurity risk management process includes a wide variety of mechanisms, controls, technologies, methods, systems, and other processes that are designed to prevent, detect, or mitigate data loss, theft, misuse, unauthorized access and other security incidents and vulnerabilities.

companyName: Digital Turbine, Inc.

ticker: APPS


text: We are committed to appropriate cybersecurity governance and oversight. Our cybersecurity organization is led by our CISO, who reports directly to our CIO and under the organization of our chief financial officer (CFO). Our CISO is educated in computer information systems and has over 20 years of experience in leadership, management, and engineering roles in the technology and cybersecurity realms. Our CISO also has experience implementing cybersecurity programs in alignment with the NIST Cybersecurity Framework. Our CIO is educated in computer science and has over 25 years of experience in leadership, management, and consulting roles in applications, digitalization, and infrastructure with oversight responsibilities for cybersecurity.

companyName: Catalent, Inc.


text: Our team of cybersecurity professionals are responsible for maintaining a global information systems environment that focuses on least privilege, least functionality, and network segmentation throughout the landscape using a layered approach (i.e. a defense-in-depth strategy). This includes a security operations center and cybersecurity analysts who provide 24/7 network monitoring.

companyName: ALBEMARLE CORP

ticker: ALB


text: To maintain the highest levels of cybersecurity, we engage independent third-party experts to assess and audit our cybersecurity and obtain cybersecurity certifications, including ISO 27001, ISO 27701 and/or SOC2 on our key services. Our insurance coverage addresses certain financial exposures related to cybersecurity incidents. Although, we have not experienced any material cybersecurity incidents, we face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition, results of operations, cash flows or reputation. Despite our efforts, the risk of unauthorized access, modification, theft, misuse and other cybersecurity attacks cannot be eliminated entirely. We have experienced, and may continue to experience, cybersecurity incidents in our normal course of business. See "Risk Factors — Risks Related to Our Business, Industry and Operations — If the security of our platform is compromised, it could compromise our and our creators' and users' personal, sensitive, confidential and proprietary information, disrupt our internal operations and harm public perception of our platform, which could adversely affect our business and reputation."

companyName: WEBTOON Entertainment Inc.

ticker: WBTN


text: nCino conducts annual cybersecurity risk and threat assessments which include detailed control analyses for measuring both inherent and residual risk factors. These assessments are performed by nCino Information Security as part of ISO 27001 ISMS requirements, framework and certification. Our annual risk assessment, aligned to ISO 27001 and National Institute of Standards and Technology ("NIST"), is the basis for security risk identification, with additional assessments to address risks that threaten the achievement of established control objectives. Threats to security, confidentiality, and availability are identified and assessed as part of our annual and routine risk assessments. Additional information on the cybersecurity risks we face is discussed in Part I, Item 1A of this Annual Report on Form 10-K, "Risk Factors."

companyName: nCino, Inc.

ticker: NCNO


text: We oversee and identify material risks from cybersecurity threats associated with our use of third-party service providers, perform third party security assessments of select third party service providers, and employ techniques to protect our organization in the event our third parties experience a cybersecurity incident.

companyName: TreeHouse Foods, Inc.

ticker: THS


text: The Company's Board of Directors (the "Board") recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Board is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM"). The Company's cybersecurity policies, standards, processes, and practices are fully integrated into the Company's ERM program. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: WABASH NATIONAL Corp

ticker: WNC


text: We engage with third parties to separately conduct cyber assessments on a recurring basis and assist with containment and remediation efforts. In addition, third-party technology and analytics are utilized to identify potential vulnerabilities. We recognize that third parties that provide services to the Company can be subject to cybersecurity incidents that could impact the Company. To manage third-party risk, we maintain a third-party risk management program, which is designed to assess the security controls of our third parties. The assessment methodology is based on risk and relies on the data, access, connectivity, and criticality of the services that the third-party offers. As noted, we also conduct tabletop exercises to identify improvement opportunities in our supply chain resilience.

companyName: BRISTOL MYERS SQUIBB CO

ticker: BMY


text: The Board of Directors of the company (the "Board"), primarily through its Audit Committee, oversees the company's cybersecurity program. The company's Chief Information Officer ("CIO") and Chief Security Officer ("CSO") regularly report to the Audit Committee on the current state of the company's cybersecurity program (including the current threat landscape, cybersecurity risks, and any significant incidents). The Audit Committee may provide updates to the Board on the substance of these reports and any recommendations for improvements that the Audit Committee deems appropriate.

companyName: ARROW ELECTRONICS, INC.

ticker: ARW


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example, outside consultants, third party penetration testing providers, and threat intelligence and forensic providers.

companyName: ACELYRIN, Inc.


text: Ongoing Activities To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and protect against, detect, and respond to cybersecurity incidents, we undertake the following activities: All corporate machines are protected by anti-virus software and enterprise network protection; We require two -factor authentication on all corporate machines; We require two -factor authentication for all corporate email accounts; We require all corporate employees to complete quarterly cybersecurity training provided by a third -party; Our CIO and other members of our technology team proactively monitor all potential risks and immediately respond to threats; Our data is backed up in multiple offline air-gapped devices; We test all backups quarterly; We monitor regulations to ensure our policies and procedures are up-to-date and compliant.

companyName: HireQuest, Inc.

ticker: HQI


text: We routinely engage with assessors, consultants, auditors, and other third-parties, including by annually having an independent Qualified Security Assessor review our Information Security Program to help identify areas for continued focus, improvement and/or compliance, including undergoing annual compliance audits with respect to PCI DSS and SOC 2 compliance.

companyName: GREEN DOT CORP

ticker: GDOT


text: Security event monitoring and detection The Company formally tracks and reports on major identified risks and vulnerabilities and the results of their analysis and evaluation. These details can then be used to track and monitor their successful management as part of the activity to deliver the required, anticipated results. Security risks are categorized by Practice or Vulnerability (exploitable). The information is reported in the monthly security metrics report along with quarterly reporting to the ISSB.

companyName: COMMERCE BANCSHARES INC /MO/

ticker: CBSH


text: We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations or financial condition. We also describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "We are increasingly dependent on information technology systems, infrastructure and data, and our internal computer systems, or those of our collaborators, third-party clinical research organizations or other contractors or consultants, may fail or suffer security breaches, which could result in a material disruption of our product development programs." included as part of our risk factor disclosures at Item 1A of this Annual Report.

companyName: Entera Bio Ltd.

ticker: ENTXW


text: Reporting to Board of Directors The CISO, in his capacity, regularly informs the VP of IT, the CFO, the CEO, and the General Counsel or Head of Legal of material cybersecurity risks and incidents. This is how executive management is kept abreast of our cybersecurity posture and potentially material cybersecurity risks facing Cytokinetics. Furthermore, significant cybersecurity matters, and strategic risk management decisions are escalated by any of the CEO, the CFO and the General Counsel or Head of Legal to the Audit Committee, so that the Audit Committee can oversee and provide guidance on critical cybersecurity issues.

companyName: CYTOKINETICS INC

ticker: CYTK


text: Senior management, with the support of CyberTeam, monitors current events and trends related to cybersecurity and assesses any potential impact on current systems and operations.

companyName: Lucid Diagnostics Inc.

ticker: LUCD


text: We have certain processes for assessing, identifying and managing cybersecurity risks, which are designed to help protect our information assets and operations from internal and external cyber threats, as well as secure our networks and systems. Such processes, which are effected principally through an outside information technology management/cybersecurity consultant and a computer security firm that we have engaged, include procedural and technical safeguards, response plans, incident simulations and routine review of our policies and procedures to identify risks and refine our practices. Our computer security firm serves as our managed security services provider, and its services include managed detection and response, incident management, managed security awareness and a quarterly risk assessment. Our information technology management/cybersecurity consultant has responsibility for managing detection and incident response in consultation with out our managed security services provider. We considered the internal risk oversight programs of our information technology management/cybersecurity consultant and our managed security services provider before engaging them. As part of our overall risk mitigation strategy, we also maintain cyber insurance coverage; however, such insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyber-attacks and other related breaches.

companyName: KALA BIO, Inc.

ticker: KALA


text: We mitigate cyber risk through trainings and exercises at all levels of the Company. Annual cyber and physical training and testing of employees are included in our enterprise security program. Our enterprise business continuity program facilitates business impact analysis of core functions for development of emergency operating plans and coordinates annual testing and training exercises. In addition, there are independent third party audits of our critical infrastructure security program and our business risk security controls.

companyName: AVISTA CORP

ticker: AVA


text: • Disruptions in the Company's supply chain could result in an adverse impact on results of operations. • Network compromise or equipment sabotage could impact the operations of the manufacturing or distribution sites which could impact the revenue. • Cybersecurity incidents, including breaches of confidential information, sensitive data, personal information, or intellectual property could damage the Company's reputation, disrupt operations, increase costs, and impact revenues. • Nation state attacks due to current geopolitical and economic climate could impact oil and gas industry.

companyName: Drilling Tools International Corp

ticker: DTI


text: Additional information about cybersecurity risks we face is discussed in Item 1A of Part I, "Risk Factors," under the heading "Risks Related to Information and Cyber Security," which should be read in conjunction with the information above. The Audit Committee, which is comprised of independent directors, oversees our policies and procedures for protecting our cybersecurity infrastructure and for compliance with applicable data protection and security regulations, and related risks. The Audit Committee receives reports regarding such risks from management, including our Chief Technology Officer, and reports to the Board at least quarterly. The Audit Committee also oversees the Board's response to any significant cybersecurity incidents. Our Chief Technology Officer, who has extensive cybersecurity knowledge and skills gained from over ten years working in the technology industry, heads the team responsible for implementing and maintaining cybersecurity and data protection practices at Aterian, working closely with our General Counsel who has a certification in Data Security and Privacy Policy from Cornell University. Both our Chief Technology Officer and General Counsel report directly to our CEO.

companyName: Aterian, Inc.

ticker: ATER


text: Governance Related To Cybersecurity Risks Our cybersecurity process is overseen by our Information Technology department, which is managed by our Head of IT. The Head of IT role is currently held by an individual who has approximately two decades of professional IT management experience. In addition, our Security Leadership Team (SLT), which is comprised of the Head of IT as well as leaders from our operations, finance, and legal departments, is responsible for documenting, reviewing, and assessing our cybersecurity processes, monitoring for cybersecurity incidents, and periodically reporting on cybersecurity risks and risk management to a committee of our executive team (Executive Committee). The Executive Committee, which is led by our Chief Executive Officer, undertakes reviews of our cybersecurity program and assesses any security incident updates from the SLT on a quarterly basis.

companyName: FATE THERAPEUTICS INC

ticker: FATE


text: We have established processes designed to identify, assess and manage material risks associated with cybersecurity threats. Our information technology, networks, and infrastructure have been and may in the future be subject to damage, disruptions, or shutdowns due to cyber-attacks, malware, employee or third-party error or malfeasance, power outages, communication or utility failures, systems failures, natural disasters or other catastrophic events. These risks include, among other things, operational risks, intellectual property theft, fraud, extortion, harm to employees or customers, violation of privacy or security laws and other litigation and legal risks, and reputational risks.

companyName: Frontier Communications Parent, Inc.


text: Management's Role and Responsibilities Our CISO is responsible for day-to-day management and oversight of our information security program and leads our cybersecurity organization, which comprises approximately 1,000 professionals globally as of September 30, 2025. Our CISO and President of Technology receive regular reports from our cybersecurity personnel in connection with monitoring the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our CISO reports directly to our President of Technology and provides quarterly reports on our cybersecurity performance to the CRC.

companyName: VISA INC.

ticker: V


text: The Audit Committee ("Audit Committee") of the Company's Board of Directors (the "Board") is involved in the oversight of the Company's enterprise risk management program, including risks of cybersecurity threats. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on ensuring the implementation of effective and efficient controls, technologies, and other processes to assess, identify, prevent and mitigate cybersecurity threats and effectively respond to cybersecurity incidents when they occur.

companyName: Steel Connect LLC


text: ITT employs a team of certified cybersecurity professionals responsible for assessing and managing cybersecurity risks, led by the Chief Information Security Officer (CISO), who altogether make up ITT's Cyber Security Operations Center (CSOC). The qualifications of our cybersecurity team include the following industry-recognized certifications: ISC2 Certified Information Systems Security Professional (CISSP), Certified Cloud Security Professional (CCSP), Certified Ethical Hacker (C|EH), Security+, and IAPP Certified Information Privacy Professional (CIPP/US). Additionally, our cybersecurity team possesses several certifications from the SANS Institute's Global Information Assurance Certification (GIAC) program, the top cybersecurity accreditation body in the world. These include GIAC Incident Handler Certification (GCIH), GIAC Certified Systems and Network Auditor (GSNA), GIAC Foundational Cybersecurity Technologies (GFACT) and others. The CSOC monitors the global ITT landscape for cyber threats, provides prevention strategies, initiates incident response for detected intrusions, and prescribes proactive and reactive mitigation strategies. The CSOC serves as the cornerstone for protecting, assessing, and managing cybersecurity risks for the enterprise, which includes, but is not limited to, back-office processes, critical manufacturing processes, intellectual property, and sensitive data. The CISO reports to the Chief Information Officer (CIO), who in turn reports to the Chief Financial Officer (CFO). The CIO has over 21 years of experience in information technology, including 14 years at ITT, while the CISO brings over 28 years of experience in information technology, with the last 22 years focused on information security and cybersecurity across various industries. The combined expertise and qualifications of our cybersecurity team enable us to effectively monitor, assess, and respond to cybersecurity threats.

companyName: ITT INC.

ticker: ITT


text: Our Vice President – Information Technology leads management's assessment and management of cybersecurity risk. He reports directly to our President & Chief Executive Officer and is a member of our senior management team, providing cybersecurity updates to that group monthly, with more frequent updates as needed. Our Vice President – Information Technology has more than 35 years of experience within industrial distribution, spending the majority of which managing and maintaining information systems. In addition, our Vice President – Information Technology leads a team of individuals that focus on monitoring our information systems and data for intentional and unintentional actions that could cause harm to our information systems or the data on such systems.

companyName: APPLIED INDUSTRIAL TECHNOLOGIES INC

ticker: AIT


text: Bain Capital has adopted and implemented an Information and Cybersecurity Program ("Cybersecurity Program") that prioritizes detection and analysis of and response to cybersecurity threats, management of security risks and resilience against cyber incidents, including those that may impact the Company. The Cybersecurity Program aligns with National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) and is reviewed and adjusted as needed and is approved by the Bain Capital's Chief Information Security Officer ("CISO").

companyName: Bain Capital Specialty Finance, Inc.

ticker: BCSF


text: The Committee receives periodic reports from management on potential cybersecurity risks and threats and receives presentations on cybersecurity topics from Hycroft's Information Systems Manager. The Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity. The full Board of Directors also receives briefings from management on the cybersecurity risk management program as needed.

companyName: HYCROFT MINING HOLDING CORP

ticker: HYMC


text: Engage Third Parties on Risk Management We also undergo periodic external security audits, vulnerability assessments, and penetration testing of CenterPoint Energy's systems and user data security practice, conducted by third-party consultants. We also conduct tabletop exercises to test our incident response processes. Further, as discussed below, we engage third parties to provide guidance and support to our cybersecurity management team.

companyName: CENTERPOINT ENERGY RESOURCES CORP


text: The Custodians also maintain geographically dispersed backups of private keys, which are cryptographically generated into shards and stored in separate locations; multiple locations must be accessed to reconstruct a single key. The storage facilities are highly secured, and include 24x7 on-premises security presence, video surveillance, and alarms for unexpected entry. Access to facilities is controlled by multi-person controls, multi- team access rules, and multi-factor authentication.

companyName: UPEXI, INC.

ticker: UPXI


text: The program is based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). The NIST CSF framework provides the basis to evaluate our program for completeness and helps to ensure that the various components of the program are at a level that reduces cybersecurity risk to levels within the Company's risk appetite, considering the current threat and regulatory environment. Key components of the cybersecurity program include: • A risk assessment process that identifies and prioritizes cybersecurity risks; defines and evaluates the effectiveness of controls to mitigate the risks; and reports results to executive management and the board of directors. • A third-party managed detection and response service, which monitors the security of our information systems around-the-clock, including intrusion detection and alerting. • An incident response plan that outlines establishes a structured approach for the Company's response to a cybersecurity incident. The incident response plan is coordinated through the CISO and key members of management are embedded into the plan by its design. The plan facilitates coordination across multiple parts of our organization and is evaluated at least annually. • A training program that educates employees about cybersecurity risks and how to identify and escalate cybersecurity events. • A third-party risk management program designed to ensure that our key vendors meet our expectations on cybersecurity. This includes conducting periodic risk assessments of vendors, requiring vendors to implement appropriate cybersecurity controls and monitoring vendors' compliance with our cybersecurity requirements.

companyName: Third Coast Bancshares, Inc.

ticker: TCBX


text: Our Board of Directors (the "Board") has not delegated responsibility for cybersecurity matters to a committee. Rather, the Board believes that due to the importance and continually evolving nature of risks from cybersecurity threats, all members of the Board should participate in the oversight of these topics. As a result, management briefs the Board on cybersecurity matters during regularly scheduled Board meetings. Roper's Vice President of Audit Services also periodically briefs the Audit Committee on cybersecurity matters and related risks, as needed. The Vice President of Audit Services also reports to the Audit Committee on matters, including cybersecurity matters, that are addressed and monitored pursuant to the Company's enterprise risk management program.

companyName: ROPER TECHNOLOGIES INC

ticker: ROP


text: Audit Committee is responsible for providing oversight over management's processes to identify and evaluate cybersecurity risks to which the Company is exposed and to implement processes and programs to manage cybersecurity risks and mitigate any incidents. The Audit Committee also reports material cybersecurity risks to the Board. We believe this risk management process provides visibility and oversight to allow the Board and executive leadership team to make timely, data-driven decisions ensuring that the Company, its employees, investors, and partners are adequately protected.

companyName: Royale Energy, Inc.

ticker: ROYL


text: Our cybersecurity management team includes our Corporate Vice President, Information Technology, who leads the operational teams responsible for enterprise security, data governance and enterprise incident response and global operations, and our Senior Vice President of Cloud and Engineering operations, who leads the operational teams responsible for product and cloud privacy and security, data governance and product security incident response. Our operational cybersecurity teams are comprised of members with decades of collective experience in IT security systems, tooling, operations and governance; hold various IT security industry certifications and have received specialized cybersecurity training.

companyName: CALIX, INC

ticker: CALX


text: We operate in the biotechnology sector, which is subject to various cybersecurity risks that could adversely impact our business, financial condition, and results of operations, including intellectual property theft; fraud; extortion; harm to employees, patients, or healthcare providers; violation of privacy laws and other litigation and legal risk; and reputational risk. We have implemented a risk-based approach to identify and assess the cybersecurity threats that could affect our business and information systems, and we manage cybersecurity risks through a robust enterprise risk management process. These policies and practices are aligned with industry best practices and standards, such as the National Institute of Standards and Technology ( NIST) cybersecurity framework. Our cybersecurity program encompasses the IMT and its policies, platforms, procedures, and processes for assessing, identifying, and managing risks from cybersecurity threats, including third-party risk from vendors and suppliers. Our program includes various policies, procedures, and plans related to cybersecurity, including the CSIRP, Corporate Crisis Management Plan, Crisis Communications Response Plan, Organizational Resiliency Governance Policy and Framework, and Business Continuity Plans. These plans outline a coordinated approach for protecting information security, managing vulnerabilities, and assessing, identifying, and managing risks from cybersecurity threats, including identifying and responding to cybersecurity incidents, and processes for categorizing incidents, reporting findings, and keeping senior management, our Audit Committee, and other key stakeholders informed and involved as appropriate.

companyName: UNITED THERAPEUTICS Corp

ticker: UTHR


text: Our cybersecurity incident response plan also contains mechanisms to notify executive management of cybersecurity incidents. As part of the plan, an executive-level leadership team may be activated and can act to direct our response efforts, to include mitigation and remediation activities, when appropriate.

companyName: Super Micro Computer, Inc.

ticker: SMCI


text: Monitoring is another key component of the cybersecurity risk management system. We employ 24/7 monitoring and regular testing to mitigate threats and possible weaknesses. Additionally, we maintain insurance coverage for cybersecurity attacks.

companyName: Thermon Group Holdings, Inc.

ticker: THR


text: Finally, the Company's Disclosure Committee is responsible for assisting the CEO, CFO and Audit Committee to prepare SEC-required disclosures, confirming the Company's disclosure controls and procedures are properly implemented and asserting the accurate, complete, timely and fair presentation of public disclosures. The Disclosure Committee is comprised of the Company's CFO, Chief Accounting Officer, General Counsel, Chief Audit Executive, Head of Information Security, and senior members of our external reporting, financial planning and analysis, and tax departments. The Disclosure Committee meets quarterly prior to the issuance of required quarterly SEC filings, and in these meetings relevant cybersecurity risks would be discussed.

companyName: NeueHealth, Inc.

ticker: NEUE


text: We recognize the security of our banking operations is critical to protecting our customers, maintaining our reputation and preserving the value of the Company. Our board of directors is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM"). The Company maintains a cybersecurity and information technology ("IT") risk management program designed to prevent, detect and respond to information security threats, which are fully integrated into the Company's ERM program.

companyName: HAWTHORN BANCSHARES, INC.

ticker: HWBK


text: We periodically engage third parties to conduct risk assessments, including penetration testing and other vulnerability analyses. Our finance department, with the assistance of outside technical advisors, regularly conducts internal assessments of different systems to evaluate the efficacy of our risk management processes. As a result of these assessments and testing, we have evaluated known risks and hardened both our on-premises and cloud-based environments. Additionally, our program includes cybersecurity training and testing for all employees—during onboarding and quarterly thereafter. The training focuses on cyber threat awareness, phishing, and other attack methods and is supplemented by testing initiatives, including semi-annual phishing tests.

companyName: Motus GI Holdings, Inc.

ticker: MOTS


text: a risk management team responsible for managing our cybersecurity risk assessment processes and acts as a check and balance on our information security team which is responsible for maintaining, monitoring, and updating our security controls as well as managing our response to cybersecurity incidents;

companyName: Vertex, Inc.

ticker: VERX


text: Our cybersecurity incident response and vulnerability management processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our CISO and our Nominating and Governance Committee Chair and member. These officials work with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response and vulnerability management processes include reporting to the Nominating and Governance Committee of the board of directors for certain cybersecurity incidents.

companyName: Enovix Corp

ticker: ENVX


text: Pathward has a formal Enterprise Risk Management ("ERM") department. The Company's Chief Risk Officer is responsible for developing and executing the risk framework and ERM plan for the Company. The Company has implemented a three lines of defense model. The first line of defense ("1LOD") is responsible for owning, measuring, and managing the risks and controls. The second line of defense ("2LOD") is responsible for monitoring risk and controls in support of management. The third line of defense ("3LOD") is the independent audit function.

companyName: PATHWARD FINANCIAL, INC.

ticker: CASH


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan. We design and assess our program based on the Center for Internet Security ("CIS") Controls. While this does not imply that we meet any particular technical standards, specifications or requirements, we use the CIS Controls framework as a guide to help us identify, assess and manage cybersecurity risks relevant to our business.

companyName: Singular Genomics Systems, Inc.


text: Although, to date, cybersecurity incidents have not materially impacted our business strategy, results of operations, or financial condition, there can be no assurances that they will not do so in the future. to "Item 1A. Risk factors" in this Annual Report for additional information about cybersecurity-related risks.

companyName: Limitless X Holdings Inc.

ticker: LIMX


text: We maintain a comprehensive cybersecurity risk management program (the “Cybersecurity Program”) aligned with the National Institute of Standards and Technology (NIST) cybersecurity framework. Strategic investments in this area have prioritized: • migration to cloud-based managed solutions to replace legacy systems; • workflow automation; • integration of digital and mobile tools for field service technicians; and • expansion of remote monitoring capabilities for our compressor fleets.

companyName: Flowco Holdings Inc.

ticker: FLOC


text: In addition, the Board receives regular updates via the Chair of the Risk and Sustainability Committee and various management committees, including the ORCC, Group internal audit, Group Risk and Group internal controls, and annual updates from the Global CISO and CIO on the state of cybersecurity across the Group. The Board is also notified of any relevant issues or incidents which have occurred or are reasonably likely to occur.

companyName: Flutter Entertainment plc

ticker: FLUT


text: We have not encountered cybersecurity incidents or identified risks from cybersecurity threats that have materially impaired our operations or financial standing. For a discussion of whether and how any risks from cybersecurity threats are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition, refer to Item 1A. Risk Factors – titled "Our business depends on numerous complex information systems. Any failure to maintain these systems, a network disruption, or breaches in data security could cause a material adverse effect on our business", which is incorporated by reference into this Item 1C.

companyName: DAKTRONICS INC /SD/

ticker: DAKT


text: The Audit Committee of the Board of Directors (the "Board") oversees our cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. Each quarter, our CTO updates the Audit Committee on the development and effectiveness of our cyber risk management program. In addition, the Audit Committee is responsible for periodically reviewing and discussing with management our practices with respect to cybersecurity and information security risk management. In addition, cybersecurity risks are reviewed by the Board as part of the Company's corporate risk mapping exercise.

companyName: STEM, INC.

ticker: STEM


text: Our board of directors is responsible for understanding the primary risks to our business, including risks from cybersecurity threats. The board of directors is responsible for reviewing our advisor's cybersecurity policies with management and evaluating the adequacy of the program, compliance and controls with management.

companyName: KBS Real Estate Investment Trust III, Inc.

ticker: KBSR


text: Management maintains the cybersecurity risk prevention program which includes ongoing employee education and procedures for cybersecurity incident prevention, detection and response. The Company retains third parties, including IT professionals and legal counsel, specializing in cybersecurity risk management to assist in implementing cybersecurity controls. The Company oversees and identifies material risks from cybersecurity threats associated with its use of third-party service providers by reviewing SOC 1 or SOC 2 reports (whichever is more applicable) for key outsourced systems, including all systems which house protected health information or personally identifiable information. The cybersecurity risk prevention program is part of the Company's overall risk management program.

companyName: HEALTHCARE SERVICES GROUP INC

ticker: HCSG


text: The board of directors, as a whole, has oversight responsibility for our strategic and operational risks. The audit committee assists the board of directors with this responsibility by reviewing and discussing our risk assessment and risk management practices, including cybersecurity risks, with members of management. The audit committee, in turn, periodically reports on its review with the board of directors. Management is responsible for day-to-day assessment and management of cybersecurity risks and reports regularly to the audit committee.

companyName: Rafael Holdings, Inc.

ticker: RFL


text: Our Board of Directors maintains oversight responsibility for how we manage risk, and it charges management with assessing and mitigating that risk through the development, implementation and maintenance of our risk management processes, including our cybersecurity program. Our internal audit department, which reports to the Audit Committee, administers our enterprise risk assessment and, in coordination with our legal and compliance functions, is responsible for ongoing enterprise risk management assessments. Our internal audit department also regularly reports to the Board of Directors and its committees on risk-related issues.

companyName: Mueller Water Products, Inc.

ticker: MWA


text: We presently do no engage third parties to assist with evaluating the effectiveness of our risk-management and cybersecurity practices. The Company did not have any material cybersecurity breaches during the year ended December 31, 2023.

companyName: SUI Group Holdings Ltd.

ticker: SUIG


text: b The Incident Management Plan - Technology and Data, developed by our cybersecurity team, follows a structured process for escalating, assessing and categorizing cybersecurity incidents, and IREN's response process, including remediation and post-incident activities. This is designed to be a systematic and coordinated approach to managing cybersecurity incidents.

companyName: IREN Ltd

ticker: IREN


text: We face several cybersecurity risks in connection with our business. While cybersecurity threats, including those resulting from any previous cybersecurity incidents, have not materially affected, and we do not believe they are reasonably likely to materially affect, our Company, including our business strategy, results of operations, or financial condition, to date, we have, like other companies in our industry, from time to time, experienced threats and cybersecurity incidents relating to our, and our third-party vendors', data and information systems. However, there can be no assurance that our controls and procedures in place to monitor and mitigate the risks of cyber threats, including the remediation of critical information security and software vulnerabilities, will be sufficient and/or timely and that we will not suffer material losses or consequences in the future. Additionally, we do not have in place insurance coverage designed to address certain aspects of cyber risks.

companyName: FOXO TECHNOLOGIES INC.

ticker: FOXO


text: The Bank has an Information Security Department comprised of specialized professionals that is responsible for the day-to-day, hands-on management of the cybersecurity risk and that handles the processes and procedures to mitigate and implement protective, proactive and reactive measures to protect the Bank against those risks. The Bank's Information Security Department is responsible for developing, documenting, and approving the Bank's technical information security control standards, guidelines, and procedures designed to preserve the confidentiality, integrity, and availability of the Bank's information technology assets and data under the Bank's control.

companyName: Federal Home Loan Bank of New York


text: We maintain incident response and recovery frameworks, tested twice yearly through backup restorations to critical systems, to improve our preparedness to effectively manage and mitigate cybersecurity incidents.

companyName: Alto Ingredients, Inc.

ticker: ALTO


text: Monitor Cybersecurity Incidents The Senior Vice President of Technology ("SVP Technology") is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. The SVP Technology implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, we believe we have a well-defined incident response plan governing our assessment, response and notifications internally and externally upon the occurrence of a cybersecurity incident.

companyName: TANGER PROPERTIES LTD PARTNERSHIP /NC/


text: VanEck has adopted the National Institute of Standards and Technology's ("NIST") cybersecurity framework as its security outline. The program is reviewed annually. Using the NIST framework as a guide, VanEck's cybersecurity program is organized around the following program domains: Identify critical assets, data, systems and capabilities, cybersecurity strategy and governing elements, threats and cybersecurity risks Protect

companyName: VanEck Bitcoin ETF

ticker: HODL


text: We maintain basic processes to identify and manage cybersecurity risks. These include regular system updates, employee training, and monitoring for unauthorized access. When needed, we work with external IT consultants to assess our systems.

companyName: Zentrum Holdings, Inc.


text: As part of our cybersecurity procedures, we leverage a number of security controls, including network and device monitoring and system backup procedures. We work to mitigate risks from cybersecurity threats stemming from third-party vendors by providing them with access only to systems that they need to provide services to us.

companyName: Akari Therapeutics Plc

ticker: AKTX


text: As of the date of this report, other than the foregoing, the Company is not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition and that are required to be reported in this report. For further discussion of the risks associated with cybersecurity incidents, see the cybersecurity risk factors in Item 1A. Risk Factors in this report.

companyName: MARIMED INC.

ticker: MRMD


text: In 2024 and 2023, we did not identify any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. Despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurance that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors—Cybersecurity vulnerabilities or other failures in information systems could result in information theft, data corruption and significant disruption of our business operations."

companyName: Royalty Pharma plc

ticker: RPRX


text: The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.

companyName: QUICKLOGIC Corp

ticker: QUIK


text: As part of our ongoing information security program, the Company utilizes periodic independent third-party experts to conduct assessments of our program's effectiveness. These experts are also leveraged to design and orchestrate tabletop exercises where multiple business functions and leadership levels navigate incident scenarios based on industry trends and relevant threats, to help determine our level of preparedness for various cybersecurity incidents.

companyName: Sandisk Corp

ticker: SNDK


text: Senior management has appointed a Cybersecurity Council that is responsible for identifying, escalating, and facilitating the assessment and determination of the materiality of cybersecurity incidents and threats. The Cybersecurity Council is made up of representatives of IT, Legal and Finance, as well as ad hoc additional members depending on the circumstances of the incident or threat. The members of the Cybersecurity Council do not have specific expertise in cybersecurity risk other than the Vice President of Information Technology ("VP IT") who has more than 20 years of experience, and engages with trusted third-party experts for support and guidance when additional expertise is required. In December 2024, the VP IT exited the company, and IT expert advice to the Cybersecurity Council is currently provided by an external cybersecurity specialist. This specialist has extensive experience managing cybersecurity functions in his prior external roles, where he was responsible for overseeing cybersecurity strategy and operations, including incident response, threat intelligence, security awareness training programs, risk assessments and remediation, and regulatory and compliance matters.

companyName: CODEXIS, INC.

ticker: CDXS


text: We recognize the importance of assessing, identifying, and managing material risks from cybersecurity threats. Our policies, standards, and procedures for assessing, identifying, and managing material risks from cybersecurity threats are integrated into our overall risk management system. In this regard, we use various tools and processes to help prevent, identify, and resolve any identified vulnerabilities and security incidents in a timely manner. These include, but are not limited to, internal reporting, periodic employee awareness updates, engaging experts and third-party monitoring and detection tools.

companyName: BARNWELL INDUSTRIES INC

ticker: BRN


text: The Company's Chief Operating Officer (COO) assumes a pivotal role in overseeing the cybersecurity risk management program. The COO collaborates with business leaders on the matters of cybersecurity across the Company.

companyName: HYPERION DEFI, INC.

ticker: HYPD


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, cybersecurity risk is addressed through our quality management system and processes and overseen by our audit committee of the board of directors. We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including, for example, professional services firms, including legal counsel and certain cybersecurity service providers.

companyName: AETHLON MEDICAL INC

ticker: AEMD


text: Infinera has comprehensive and integrated enterprise risk management and cybersecurity risk management programs which use structured, proactive, and continuous processes to identify, understand, assess, mitigate, and report on enterprise and cybersecurity risks in alignment with business objectives. Our risk management program is used to guide and strengthen our cybersecurity posture to engender trust with customers, employees, and stockholders while protecting the confidentiality, integrity, and availability of our systems and data.

companyName: Infinera Corp


text: Usage of on prem hardware firewall VLANs in order to keep less secure hardware such as printers and scanners on their own VLAN to minimize attack vectors Our Board of Directors has oversight of our enterprise risk assessment and risk management processes, as well as the steps taken to mitigate these risks, including for cybersecurity matters. The Audit Committee of our Board of Directors has oversight of cybersecurity risk assessment and risk management policies as part of its risk management oversight responsibilities. Any significant cybersecurity matters, including those related to incidents, are escalated to the Board of Directors.

companyName: Dalrada Technology Group, Inc.

ticker: DHTI


text: TIAA has instituted an enterprise cybersecurity program designed to identify, assess, and mitigate cyber risks applicable to TIAA, the Company, and other products, subsidiaries and affiliates of TIAA and their respective third-party service providers.

companyName: Nuveen Global Cities REIT, Inc.


text: employee training programs regarding cybersecurity risks and the usage of secure software or platforms designed to protect our IT systems against cybersecurity risks, such as two-factor authentication systems, anti-virus and ransomware programs or the usage of secure cloud platforms for computing our IT systems;

companyName: Viewbix Inc.

ticker: VBIX


text: Through WHLR, the Company retained an information technology expert third party company to assist in managing relevant risks. In particular, the Company outsources its information technology function and monitoring to a third party provider whereby it benefits from a professionally managed network monitoring, management, maintenance, detection and response system and a 24/7 security operations center with both onsite and remote support services. Any cybersecurity incident would be reported to the Company promptly by our third party consultant and material and potentially material incidents would be assessed by management and the Audit Committee for remediation and future prevention and detection.

companyName: CEDAR REALTY TRUST, INC.

ticker: CDR-PC


text: Our cybersecurity risk management program is intended to protect the confidentiality, integrity, and availability of our critical IT systems, information and IP. Cybersecurity risks are among the risks evaluated and considered by, our broader enterprise risk management program, which is designed to identify, assess, prioritize and mitigate risks across the organization to enhance our resilience and support the achievement of our strategic objectives.

companyName: Glimpse Group, Inc.

ticker: GGRP


text: We have developed and implemented a cybersecurity program designed to provide structured and thorough cybersecurity risk management and governance. Our cybersecurity program prioritizes, among other things, prevention of unauthorized access;

companyName: MOTORCAR PARTS OF AMERICA INC

ticker: MPAA


text: Our programs are regularly evaluated by external experts with the results of those reviews reported to the senior leadership team and the Board of Directors. We also actively engage with key vendors, industry participants, and intelligence communities as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures.

companyName: Clearwater Paper Corp

ticker: CLW