text: As of the date of this Annual Report on Form 10-K, we are not aware of any previous cybersecurity incidents that have materially affected our business, financial condition, results of operations, cash flows, reputation and prospects or that are reasonably likely to have such a material effect. While we have implemented a cybersecurity program, the techniques used to infiltrate information technology systems continue to evolve. Accordingly, we may not be able to timely detect threats or anticipate and implement adequate security measures. For additional information regarding risks relating to privacy and cybersecurity, see "Item 1A—Risk Factors—Risks Related to Our Business."

companyName: Nauticus Robotics, Inc.

ticker: KITT


text: Our cybersecurity risk assessment process includes quarterly reviews of our cybersecurity controls, annual third-party penetration tests and annual internal assessments of our cybersecurity program as informed by the NIST Cybersecurity Framework. The results of our assessments are discussed with management and the audit committee of our board of directors. We have also established incident response processes for reporting to the audit committee for certain cybersecurity incidents, as appropriate.

companyName: Easterly Government Properties, Inc.

ticker: DEA

secItem: Item 1C


text: Role of the Board On an annual basis, the Board reviews and approves the overall enterprise risk management approach and processes implemented by management to identify, assess, manage, and mitigate risk. The Board has delegated its responsibility for oversight of the Company's cybersecurity and information security framework and risk management to the Audit Committee. The Audit Committee receives information and updates at least quarterly and actively engages with senior leaders with respect to the effectiveness of the Company's cybersecurity and information security framework, data privacy, and risk management. In addition, the Audit Committee receives reports summarizing threat detection and mitigation plans, audits of internal controls, training and certification, and other cyber related priorities and initiatives, as well as timely updates from senior leaders on material incidents relating to information systems security, including cybersecurity incidents. The Audit Committee includes members with experience in risk management including risks related to cybersecurity.

companyName: RPC INC

ticker: RES


text: We evaluate the effectiveness of our cybersecurity threat risk management through the assessment and testing of our processes and practices. We periodically engage consultants, auditors and other third parties to perform assessments on our cybersecurity measures. The assessments include information security maturity evaluations, independent environmental security control reviews, operating effectiveness and penetration testing. We make adjustments to our cybersecurity processes and practices as necessary based on the information provided by the third-party assessments and reviews.

companyName: CEVA INC

ticker: CEVA


text: WhiteHorse Finance, Inc. (the "Company," "we," "us," or "our") maintains structured processes to proactively assess, identify, manage, and mitigate material risks from cybersecurity threats. The Company's business remains dependent on the communications and information systems of WhiteHorse Advisers, LLC (the "Investment Adviser") and other third-party service providers. The Investment Adviser manages the Company's day-to-day operations and has implemented a cybersecurity program that applies to the Company and its operations and is subject to periodic updates, reviews, and independent assessments.

companyName: WhiteHorse Finance, Inc.

ticker: WHF


text: We employ a formal risk management process for the identification, assessment, monitoring, acceptance, communication, consultation, and review of cyber-related risks which is designed in accordance with industry practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology Cybersecurity Framework and International Organization Standard 27005. The Company's information security standards are externally audited on an annual basis against the System and Organizational Controls (SOC) and compliance with Payment Card Industry Data Security Standard (PCI DSS). Our program is reviewed on a periodic basis against the Federal Financial Institutions Examination Council's (FFIEC) Cybersecurity Assessment Tool and the National Institute of Standards and Technology Cybersecurity Framework in order to measure our cybersecurity preparedness, evaluate whether our cybersecurity preparedness is aligned with risks, determine potential areas of improvement or enhancement for the Company's risk management practices and controls, and inform our risk management strategies.

companyName: SYNOVUS FINANCIAL CORP

ticker: SNV


text: As of the date of this report, we do not believe that any risks from cybersecurity threats, including those resulting from any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition. Despite our security measures, however, there can be no assurance that we, or third parties with which we interact, will not experience a cybersecurity incident in the future that will materially affect us. For more information on our cybersecurity related risks, see Item 1A - Risk Factors - "Our business may be harmed due to failure to successfully implement information technology solutions or a lack of reasonable safeguards to maintain data security, including adherence to data privacy laws and physical security measures."

companyName: Kimball Electronics, Inc.

ticker: KE


text: We recognize the importance of identifying, assessing, and managing material risks associated with cybersecurity threats. Our cybersecurity risk management program is integrated into our overall enterprise risk management ("ERM") process which provides an ongoing procedure, effected at all levels of the Company across business units and corporate functions, to identify and assess risk, monitor risk, and take appropriate mitigating action. Central to our risk management process is the Risk Committee, which is a management committee that oversees the identification and assessment of the key risks affecting our operations and reviews the controls established with respect to these risks. The Risk Committee is comprised of key members of management, including the President, Chief Financial Officer, Chief Legal Officer, Chief Information Security Officer, Chief Privacy Officer, and other senior executives of the Company. Our Risk Committee collaborates with subject matter experts, as needed, to gather insights for identifying and assessing material cybersecurity risks, their severity, and potential mitigations.

companyName: BROADRIDGE FINANCIAL SOLUTIONS, INC.

ticker: BR


text: Our cybersecurity governance framework is designed to manage cybersecurity risks at all levels of the organization. As part of this governance framework, our Board of Directors regularly devotes time during its meetings to review and discuss the most significant risks facing the Company, including cybersecurity threats, and management's process for identifying, prioritizing, and responding to them. The Audit Committee of the Board of Directors assists the Board in overseeing the significant risk exposures facing the Company and regularly reviews cybersecurity risks at its committee meetings. Cybersecurity risks are integrated into the broader company risk management system through our Information Security and Privacy Committee ("ISPC"), which is a subcommittee of our Enterprise Risk Committee (the "ERC"), is co-chaired by the Chief Information Security Officer and Chief Privacy Officer and consists of senior leaders across the company. The ISPC is charged with oversight, advisory, and decision-making responsibilities with respect to information security and privacy risks. The Chief Information Security Officer is responsible for communicating cybersecurity risks to the Audit Committee and Board of Directors. Our cybersecurity program, led by our Chief Information Security Officer, who reports to our Chief Risk and Compliance Officer, has a team of dedicated, experienced cybersecurity professionals responsible for day-to-day security operations and strategic cybersecurity programs. The Chief Information Security Officer has over 20 years of experience in security risk management, with over 10 years of experience leading cybersecurity teams. All employees are responsible for protecting Western Union's data and systems and are required to follow Western Union's cybersecurity policies.

companyName: Western Union CO

ticker: WU


text: Our director of information security, who reports both to our chief risk officer and our chief information officer, manages the Bank's cybersecurity governance framework designed to protect the confidentiality, integrity, and availability of the Bank's information technology assets and data under our control. Our director of information security has more than 25 years of experience in information technology with the Bank in successively more responsible roles and has led teams to design, secure, and implement numerous technology solutions. Our information security department is responsible for developing, documenting, and approving our information security control standards, guidelines, and procedures, in line with the policies and standards set forth by our board of directors and the Bank Technology Governance Committee.

companyName: Federal Home Loan Bank of Boston


text: We have established physical, electronic, and organizational measures to safeguard and secure our systems to prevent a data compromise. Our approach includes, among other things: • conducting regular network and endpoint monitoring, vulnerability assessments, and penetration testing to improve our information systems, as such term is defined in Item 106(a) of Regulation S-K is scheduled on 2024 IT plan; • requiring regular cybersecurity training programs for employees, management and directors; • comparing our processes to standards set by the National Institute of Standards and Technology ("NIST"); • leveraging the NIST incident handling framework to help us identify, protect, detect, respond, and recover when there is an actual or potential cybersecurity incident; • operating threat intelligence processes designed to model and research our adversaries; • conducting regular phishing email simulations for all employees and all contractors with access to corporate email systems to enhance awareness and responsiveness to such possible threats; • maintaining copies of production data in two separate locations; • running a backup for our data on a daily basis and these files are held for several months; • testing the backup and recovery systems frequently; • employing a multi-factor authorization for employees who are working remotely, in order to mitigate risks of compromising email accounts; and • holding an insurance policy to mitigate risks for cybersecurity incidents. These approaches vary in maturity across our business and we work to continually improve them.

companyName: HCW Biologics Inc.

ticker: HCWB


text: To assist with management oversight, the CDIO chairs a security council which supports risk management by providing input into cyber security strategy and helps prioritize monitoring, mitigation and remediation across operational groups. This security council is comprised of senior leaders from a cross-functional group of departments including Legal and Regulatory, Corporate Security, Network Engineering, Internal Audit, Finance & Accounting and Risk and IT Infrastructure. In addition, we have established processes and response teams that are responsible for monitoring and making determinations regarding the materiality of cybersecurity incidents. The members of these teams have extensive expertise in evaluating the potential impact and materiality of events in the context of Frontier's business and financial position, reputational and industry risk, and legal and regulatory environment, and there are procedures in place to escalate material incidents for consideration by the Audit Committee.

companyName: Frontier Communications Parent, Inc.


text: Independent Penetration Testing. On an annual basis, we engage with an independent third-party provider to perform various penetration tests of the environment. The penetration tests review our customer facing applications, our response to social engineering activities, overall external attack surface and internal vulnerabilities. Issues identified from the penetration tests are tracked and escalated to ensure appropriate remediation occurs before closure.

companyName: FNB CORP/PA/

ticker: FNB


text: One of the functions of our Board of Directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board of Directors administers its cybersecurity risk oversight function directly as a whole and through its committees. Particularly, the Audit Committee of the Board of Directors oversees our cybersecurity risk and receives regular reports from our Vice President of Information Technology on various cybersecurity matters, including risk assessments, mitigation strategies, areas of emerging risks, incidents and industry trends, and other areas of importance.

companyName: Danimer Scientific, Inc.


text: Strategy and Governance Under the ultimate direction of our Chief Executive Officer, our Information Security Committee has primary responsibility for overseeing our management of cybersecurity risks. It is chaired by our Chief Information Security Officer ("CISO") who reports directly to our Chief Technology Officer. Other members of the committee include representation from information technology, quality, product, operations, sales, and compliance as well as advisory support from internal audit.

companyName: Butterfly Network, Inc.

ticker: BFLY


text: At the management level, the Enterprise and Risk Management Committee (the "ERM Committee") discusses cybersecurity topics, including any potentially material cybersecurity incidents, as part of its oversight of the company's significant risks. Our Chief Information Officer, collaborating with the broader management team, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants.

companyName: Bloom Energy Corp

ticker: BE


text: The Company currently manages its cybersecurity risk through a variety of practices that are applicable to all users of our information technology and information assets, including our officers and directors, contractors, and vendors. The Company uses a combination of technology and monitoring to promote security awareness and prevent security incidents, including network and passwords protocols, third party firewalls, and antivirus protections.

companyName: OKMIN RESOURCES, INC.

ticker: OKMN


text: We use third-party service providers to perform a variety of functions throughout our business, such as cloud-based infrastructure hosting, data hosting, and encryption and authentication services. We have a vendor management program to manage cybersecurity risks associated with our use of these providers, which may include regular security assessments, audits, and compliance checks. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider.

companyName: Cytek Biosciences, Inc.

ticker: CTKB


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors' cybersecurity committee is responsible for overseeing the Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.

companyName: NETGEAR, INC.

ticker: NTGR


text: Our board of directors addresses the review of our IT and cybersecurity risk management as part of its general oversight function. The board of directors' audit and risk committee is responsible for overseeing our cybersecurity risk management processes.

companyName: Silence Therapeutics plc

ticker: SLN


text: Physical Security Policy (the "PSP"). The PSP establishes guidelines related to selecting IT operation sites, designating security zones, using, inspecting, and storing IT Assets, designing restricted-access and security controls, and monitoring compliance with safety and security standards. The goal of the PSP is to minimize risks of damage, destruction, unauthorized access, inadvertent disclosure, misuse, loss, or theft of the Company's IT Assets. In accordance with the PSP, the Company: (i) evaluates IT operation sites based on their susceptibility to natural disasters, crime and theft, and unauthorized access; (ii) requires the use of keycards or biometrics in order to enforce security zones and give users the least amount of access required to do their jobs; (iii) requires systems and devices that store confidential data to be maintained and protected in accordance with the Company's Confidential Data Policy; and (iv) requires visitors at the Company's office to complete a sign-in log, wear a visitor badge, and be escorted by a designated employee at all times.

companyName: AMERICAN SHARED HOSPITAL SERVICES

ticker: AMS


text: The information security team is responsible for monitoring, managing and assessing cybersecurity risks and threats on a day-to-day basis. In particular, the information security team monitors, assesses and mitigates threats and is responsible for improving and strengthening the Company's cybersecurity environment. As discussed below, the information security team works with nationally recognized third parties and licenses various cybersecurity tools and products to assist with assessing and managing cybersecurity risks. The information security team regularly interacts and discusses cybersecurity matters with our Chief Executive Officer, Chief Financial Officer and Chief Operating Officer as part of our company-wide risk management system. The information security team has plans and processes in place to escalate certain cybersecurity issues to senior management and the Board or the Audit Committee, including for consideration of whether, when and how to publicly disclose any material cybersecurity event. In addition, we maintain insurance to help reduce our exposure from potential losses should a cybersecurity incident arise.

companyName: SANFILIPPO JOHN B & SON INC

ticker: JBSS


text: Our approach to controlling these risks is designed and assessed based on our selection and implementation of certain controls from the National Institute of Standards and Technology (NIST) Cyber Security Framework (CSF). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. These controls are implemented to help us identify our critical assets and systems, protect them through preventative measures, detect attempts to compromise their confidentiality, integrity, and availability, respond to attacks by containing their progression and notifying relevant parties, and recover effectively if successfully compromised.

companyName: Fluence Energy, Inc.

ticker: FLNC


text: A key component of our risk management and strategy surrounds data protection. We have implemented strict access controls for each individual employee to ensure only authorized personnel can access sensitive and confidential data. All digital communication is pre-screened for potentially malicious actions through a dedicated email security provider. For additional protection, we have implemented multi-factor authentication along with email encryption to ensure data is protected while at rest and in transit. We are also protected through a multilayered approach to security through the ESET Protection Platform, which provides formidable defense through cyber threat prevention, detection and response.

companyName: Lodging Fund REIT III, Inc.


text: Our Board of Directors is responsible for the oversight of cybersecurity risks and threats. The Board has delegated certain information security and data privacy oversight to the Audit Committee and the Compliance, Quality and Risk Committee (CQRC) of the Board. The CQRC oversees compliance with information security and data privacy laws, while the Audit Committee has oversight responsibility for cybersecurity risks related to accounting, audit and financial matters. The CQRC, Audit Committee and management report to the Board on a periodic basis regarding our information security and data privacy functions, including any cybersecurity threats.

companyName: AtriCure, Inc.

ticker: ATRC


text: As part of our risk management program, we regularly conduct vulnerability assessments, as well as internal user training and tabletop exercises. We also conduct self and third-party assessments of our cybersecurity risk management program to evaluate effectiveness and alignment with NIST and CMMC standards and industry best practices.

companyName: ESCO TECHNOLOGIES INC

ticker: ESE


text: Oversight of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Company is assessed on an ongoing basis, as well as how such risks could materially affect the Company's business strategy, operational results, and financial condition. Cybersecurity risk remains heightened to the financial industry, including the Company, and a failure in or breach of our systems or infrastructure, or those of a material third party or service provider, could cause disruption and adversely impact the Company's operations. TIAA and the Advisers continue to invest in the cybersecurity program to protect against emerging threats, including threats against third parties and service providers. The Company has not experienced any material cybersecurity incident, and the Company is not aware of any cybersecurity risks that are reasonably likely to materially affect its business.

companyName: Nuveen Churchill Direct Lending Corp.

ticker: NCDL


text: Oversight of risks relating to IT and cybersecurity has been delegated by our Board to its Audit Committee. The Audit Committee includes members of the Board who, in addition to each being designated as an "audit committee financial expert," possess backgrounds and experience which we believe enable them to provide effective oversight of our IT and cybersecurity risks. Our management routinely reports to the Audit Committee on the status of the Company's Cybersecurity Program at the Audit Committee's quarterly meetings. Routine reports generally detail any testing, observations or developments concerning the Cybersecurity Program that occurred during the prior quarter. The results of periodic testing related to the Cybersecurity Program are also described in the Chief Compliance Officer's annual report to the Board, provided pursuant to Rule 38a-1 under the 1940 Act. The crisis response team leader also collaborates with the Audit Committee chair to ensure that the Board is apprised of any material cybersecurity incident and consults with the Audit Committee chair in connection with any material decisions or actions related thereto.

companyName: Main Street Capital CORP

ticker: MAIN


text: As of the filing of this Annual Report on Form 10-K, we are not aware of any cybersecurity incidents that have occurred that have materially affected us, including our business strategy, results of operations or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. If as a result of any future attacks our information technology systems are significantly damaged, cease to function properly or are subject to a significant cybersecurity breach, we may suffer an interruption in our ability to manage and operate the business, and our business strategy, results of operations or financial condition could be adversely affected. See "Risk Factors – Information Technology Risks."

companyName: Container Store Group, Inc.


text: The information required by Item 106 of Regulation S-K is included throughout the Prospectus and is incorporated by reference herein.

companyName: Uniti Group Inc.

ticker: UNIT


text: Our board of directors has overall responsibility for oversight of our risk management policies and procedures. Its audit committee (the "Audit Committee") is responsible for ensuring that management has processes in place designed to identify cybersecurity risks to which we are exposed and implement processes and programs to manage them and mitigate and remediate any incidents. The audit committee also reports material cybersecurity risks to our full board of directors on an as-needed basis, but no less than annually.

companyName: Vaxxinity, Inc.

ticker: VAXX


text: The Director of IT acts as the Incident Manager and meets regularly with our Incident Response Team, including members of Financial Risk Management, IT Security and Human Resources senior management to discuss the necessary measures to take prior to and during an incident. In the event of an incident, the Incident Manager meets regularly with the executive leadership team and keeps them apprised of the status of any incident during the incident response. Our Board and the audit committee also receive prompt and timely information from the Director of IT and executive leadership regarding any cybersecurity risks that meet certain reporting thresholds, as well as ongoing updates regarding any such risk. Finally, the Incident Response Manager briefs corporate leadership on lessons learned from the incident during or after the recovery phase.

companyName: Scilex Holding Co

ticker: SCLX


text: The Company actively maintains an enterprise risk management program. Management's role is to identify, mitigate, guide and review the efforts of our business units, consider whether the residual risks are acceptable, and approve plans to deal with serious risks. Cybersecurity is a key risk management category within our enterprise risk management program.

companyName: ARMSTRONG WORLD INDUSTRIES INC

ticker: AWI


text: Although risks from cybersecurity threats have to date not materially affected us, our business strategy, results of operations or financial condition, we have, from time to time, experienced threats to and breaches of our and our third-party vendors' data and systems. For more information, please see Item 1A. Risk Factors the section titled "Risk Factors—Risks Relating to Information Technology, Intellectual Property, Data Security and Privacy—Compromises of our data security could cause us to incur unexpected expenses and may materially harm our reputation and results of operations."

companyName: ThredUp Inc.

ticker: TDUP


text: Our response process to cybersecurity incidents is designed to escalate certain incidents to members of management depending on the circumstances, including our Manager of IT Infrastructure. Our Manager of IT Infrastructure works with our incident response team to help us to mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response policy includes reporting to the board of directors committee responsible for certain cybersecurity incidents.

companyName: Aspira Women's Health Inc.

ticker: AWHL


text: Our Cybersecurity organization, which includes corporate and product security, is led by our CISO. Our CISO, reporting directly to our Chief Technology Officer ("CTO"), is responsible for developing and implementing our cybersecurity program, including setting the directional security strategy and continuous improvement plans for the overall security program. Our CISO has over a decade of experience as a leader of cyber-security and technology risk management programs in both healthcare and medical device manufacturing organizations. This experience is coupled with obtaining and maintaining multiple industry certifications, including Certified Information Systems Security Professional certifications (CISSP), and Certified Information Security Manager (CISM). The CTO ensures cyber-security measures are prioritized across research and development, software engineering, and our IT functions.

companyName: INSULET CORP

ticker: PODD


text: As part of our overall risk management approach, we prioritize the identification and management of cybersecurity risk at several levels, including Board oversight, executive commitment and employee training. Our Audit Committee, comprised of independent directors from our Board, oversees the responsibilities relating to the operational (including information technology ("IT") risks and data security) risk affairs of the Company. Our Audit Committee is informed of such risks through quarterly reports from our cybersecurity leadership and it reports any material findings and recommendations to the full Board for consideration.

companyName: NEWMONT Corp /DE/

ticker: NEM


text: Our cybersecurity program includes the following risk management practices: a formal cybersecurity risk assessment is performed annually in collaboration with our enterprise risk management function, resulting in updates to plans and actions that are incorporated into improvement projects;

companyName: TE Connectivity plc

ticker: TEL


text: The SVP, E&O is supported by critical internal positions within the Partnership, including but not limited to the Director of Information Technology, Vice President of Operational Technology and dedicated IT and OT resources with cybersecurity responsibilities. The SVP, E&O is further supported by various external parties, including but not limited to cybersecurity service providers, consultants, and other third parties engaged on an as-needed basis.

companyName: Summit Midstream Partners, LP


text: We engage consultants or other third parties in connection with our risk assessment processes. These service providers assist us in designing and implementing our cybersecurity policies and procedures and monitor and test our safeguards.

companyName: Jaguar Health, Inc.

ticker: JAGX


text: Our Board, and Nominating and Audit Committees, gave significant consideration over the past several years to the appropriate Board and Committee oversight structure for risks associated with technology and cybersecurity. The full Board receives briefings from management on enterprise-wide technology, cybersecurity risk management and the overall technology and cybersecurity environment by management. Specifically, the full Board receives biannual reports from the Chief Digital Solutions Officer and the CISO.

companyName: S&P Global Inc.

ticker: SPGI


text: Third-Party Assessments: We engage cybersecurity firms to regularly evaluate our cybersecurity posture, helping identify and mitigate risks posed by evolving threats.

companyName: FREQUENCY ELECTRONICS INC

ticker: FEIM


text: Governance of Cybersecurity Risks Pursuant to its charter, the Audit Committee of the Board has the primary responsibility for oversight and review of guidelines and policies with respect to risk assessment and risk management, including cybersecurity. The Company's Chief Executive Officer, President, and Chief Financial Officer are responsible for assessing and managing cybersecurity risks. Given our currently limited resources, we do not have dedicated personnel with specific cybersecurity expertise. When appropriate, the Company's management will report on cybersecurity issues and presents information to our Audit Committee and/or our full Board on cybersecurity matters.

companyName: EXICURE, INC.

ticker: XCUR


text: We have not experienced any significant cybersecurity incidents to date. However, we recognize that the absence of a formalized cybersecurity framework may leave us vulnerable to cyberattacks, data breaches and other cybersecurity incidents. Such events could potentially lead to unauthorized access to, or disclosure of, sensitive information, disrupt our business operations, result in regulatory fines or litigation costs and negatively impact our reputation among investors, shareholders, customers and partners.

companyName: Western Uranium & Vanadium Corp.

ticker: WSTRF


text: We have a comprehensive program designed to mitigate cybersecurity risk. We have adopted and require employees to abide by our personally identifiable information policy to help protect personal employee, vendor and tenant information. Employees are required to complete regular cybersecurity training and education annually, which is followed-up with quarterly testing and re-training, as necessary. We also maintain an incident response plan which outlines our response and action in the event of a major cybersecurity incident. The cybersecurity incident response plan sets forth a process for detecting and responding to cybersecurity incidents, determining their scope and risk, developing an appropriate response to mitigate and remediate the incident, communicating effectively to all stakeholders and participants and reducing the likelihood of similar future incidents. In the event of a real or perceived cybersecurity incident, the Vice President – Technology Solutions would, as soon as practicable, inform management's technology solutions steering committee, the members of which would then collaborate with the Vice President – Technology Solutions to manage material risks.

companyName: CBL & ASSOCIATES PROPERTIES INC

ticker: CBL


text: The SIMT, together with other internal and external advisors, has developed a Security Incident Management Policy ("Security Policy") and Cybersecurity Incident Management Process ("CIM Process") to help guide our response to any potential cybersecurity incidents or threats. These documents are reviewed on a periodic basis by the SIMT, and the Audit Committee will be apprised of the SIMT's actions and potential improvements to the Security Policy and CIM process.

companyName: PubMatic, Inc.

ticker: PUBM


text: With over a decade of dedicated service to BNED, our current CISO brings a wealth of experience and expertise to the organization, including over three decades of Information Technology ("IT") experience. The last two decades have focused on IT security and innovative ways to manage and lead a security team. Previously, the CISO was the Director of IT Security and Infrastructure at The Children's Place Inc. The CISO is experienced in deploying a Zero Trust framework, Identity and Access Management programs, Email and Web Gateways, managing IT compliance for SOX, PCI, and ADA, and has developed and introduced new information security and computer risk management programs based on the National Institute of Standards and Technology (NIST) Cybersecurity Framework across numerous platforms for multiple retail chains.

companyName: Barnes & Noble Education, Inc.

ticker: BNED


text: The Audit & Cyber Committee and the full Board participate in discussions with management and amongst themselves regarding cybersecurity risks. The Audit & Cyber Committee reviews the Company's cybersecurity program, which includes discussion of management's actions to identify and detect threats, recent enhancements to the Company's defenses, and management's progress on its cybersecurity initiatives. In addition, the Board and the Audit & Cyber Committee discuss recent threats and how the Company is managing those threats.

companyName: U-Haul Holding Co /NV/

ticker: UHAL


text: Risks from cybersecurity threats have, to date, not materially affected us, our business strategy, results of operations or financial condition. We discuss how cybersecurity Governance

companyName: Certiplex Corp


text: Our program is designed to protect the confidentiality, integrity, and availability of information technology systems and data. The state of our program maturity and regulatory compliance is regularly reviewed by third-party cybersecurity auditors and assessors. Among the key features of our cybersecurity risk management processes are the following: • policies and procedures designed to comply with data security and privacy obligations; • security technology and tools deployed in our IT environment that help us to identify and manage critical cybersecurity risks, as well as to detect and respond to incidents; • security awareness training offered to our workforce, and specialized incident response training for our cybersecurity team; • a Security Operations Center that monitors and responds to incidents; and • a third-party risk management program that includes diligence and contracting processes for vendors and service providers based on their respective function and risk profile.

companyName: JETBLUE AIRWAYS CORP

ticker: JBLU


text: During the year ended December 31, 2023, the Company has not identified risks from cybersecurity threats, including as a result of prior cybersecurity incidents, that have materially affected or are reasonably anticipated to materially affect the Company, including its business strategy, results of operations, or financial condition. Nevertheless, the Company recognizes cybersecurity threats are ongoing and evolving. For more information on the Company's cybersecurity risks, refer to Item 1A, "Risk Factors".

companyName: QHSLab, Inc.

ticker: USAQ


text: Our Vice President of Information Technology (our VP of IT) has primary responsibility for monitoring, assessing and managing our material risks from cybersecurity threats. He oversees a dedicated information technology team that is responsible for managing enterprise-wide information security strategy, policy, standards, architecture and processes, and is regularly informed of, and monitors, the prevention, detection, mitigation and remediation of cybersecurity threats and incidents. Our VP of IT has over 26 years of information technology experience, has earned a graduate degree in Cybersecurity and Information Assurance, and maintains relevant industry designations including Certified Information Systems Security Professional and Certified Information Security Manager certifications.

companyName: Natural Grocers by Vitamin Cottage, Inc.

ticker: NGVC


text: The Board of Directors has delegated the oversight of cybersecurity risks to the Audit Committee. Our cybersecurity program is led by the company's senior vice president, chief information officer, along with our vice president, chief information security officer. Management provides an operational update to the Audit Committee each quarter. In addition, the Audit Committee and our full Board of Directors receive an annual overview of the cybersecurity program, cybersecurity threat landscape, investments, and opportunities to enhance the company's systems and security of products and operations.

companyName: THERMO FISHER SCIENTIFIC INC.

ticker: TMO


text: At the management level, our information security steering committee, with oversight by our VP of IT and General Counsel, is responsible for leading our cybersecurity risk management program and enterprise cybersecurity matters. Under the information security steering committee, we have a cybersecurity risk and compliance committee, led by our Senior Director of Security and Compliance and Senior Director of Cybersecurity, Data, and Connectivity, which is primarily responsible for operational review of cybersecurity threats and incidents as part of our incident response process. The cybersecurity risk and compliance committee receives reports from our cybersecurity team and monitors the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents. For potentially material cybersecurity threats and incidents, we escalate these to the information security steering committee, which, with additional oversight and support from our CEO, would raise such threats and incidents to our Audit Committee Chair and, as appropriate, to our Board as they arise.

companyName: Lucid Group, Inc.

ticker: LCID


text: We have implemented technical solutions designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, antimalware and endpoint protection functionality, and access and identity controls. We regularly evaluate, monitor, and improve these solutions. As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards.

companyName: UNIVERSAL SAFETY PRODUCTS, INC.

ticker: UUU


text: As detailed in our risk factors included in Item 1A, Chubb recognizes the significant risks posed by cybersecurity and data protection challenges, which could adversely affect our business, financial condition, and results of operations. We have implemented a risk-based approach to identify and assess the cybersecurity threats that could affect our business and information systems, and we evaluate changes and enhancements to our technology environment as well as conduct third-party assessments to confirm that they meet our information security control requirements. Our cybersecurity program and control environment incorporate appropriate industry standards and best practices, such as the National Institute of Standards and Technology Cyber Security Framework (NIST CSF), and are designed to comply with numerous U.S. federal and state and international laws, rules, and regulations governing the protection of personal and confidential information of our clients and employees. We use various tools and methods to assess, identify, and manage cybersecurity risk that are tested regularly, including the following:

companyName: Chubb Ltd

ticker: CB


text: We leverage the support of third-party information technology and security providers, including for periodic security testing and vulnerability scanning, as part of our risk management process, designed to identify, assess, and manage cybersecurity risks.

companyName: LENZ Therapeutics, Inc.

ticker: LENZ


text: We identify, assess and manage material risks from cybersecurity threats by following written policies and procedures, which are in compliance with the International Organization for Standardization (ISO) 27001 Information Security Management System. The output of this process is then integrated with our enterprise risk management (ERM) program. The ERM program is managed cross-functionally, with input from various senior management representatives across our business operations, and is used to assess risks to our business based on their potential likelihood and magnitude of impact. Our information technology organization provides the inputs to our ERM process related to material cybersecurity risks and mitigation plans. The information technology team is responsible for the prevention, detection, mitigation and remediation of cybersecurity incidents. Cybersecurity incidents are documented and triaged in accordance with a defined process. Incidents deemed to be significant are escalated to the Audit Committee of our Board of Directors after appropriate assessment by the information technology organization and other internal stakeholders. In the event an incident highlights an emerging or previously unidentified cybersecurity risk, such risk is then synthesized into the ERM process.

companyName: REGENXBIO Inc.

ticker: RGNX


text: Cyber Risk Management and Strategy We have implemented a number of technical and organizational safeguards designed to manage our risks from cybersecurity threats and to protect against, detect and prepare to respond to cybersecurity incidents. These include employee training, incident response capability reviews and exercises, cybersecurity insurance and business continuity mechanisms. Additionally, we engage a third-party cybersecurity firm to assist with security features such as network and endpoint monitoring, cloud system monitoring and assessment of our incident response procedures.

companyName: IPG PHOTONICS CORP

ticker: IPGP


text: All cybersecurity threats are documented by our Security Incident Response Team, with incidents exceeding a certain threshold escalated to our CISO. Critical incidents involving confirmed data breaches, ransomware, or system-wide outages trigger immediate Security Management Committee involvement and require the board of directors to be informed of significant or material cybersecurity incidents within 24 hours.

companyName: Ingram Micro Holding Corp

ticker: INGM


text: In addition, our board of directors is responsible for the oversight of risk management. In that role, our board of directors, with support from the Company's cybersecurity advisors, are responsible for ensuring that the risk management processes designed and implemented by management are adequate and functioning as designed. To carry out those duties, our board of directors receive reports from our management team regarding cybersecurity risks, and the Company's efforts to prevent, detect, mitigate and remediate any cybersecurity incidents. These reports are delivered at least quarterly, with additional information and trainings provided at least twice per year.

companyName: HBT Financial, Inc.

ticker: HBT


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report, including "If our information technology systems or data, or those of third parties with whom we work, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; and other adverse consequences."

companyName: Autolus Therapeutics plc

ticker: AUTL


text: As part of the executive team reporting to the Board, our CTO oversees our cybersecurity policies and processes, including those described in "Risk Management" above. The processes by which our CTO is informed of and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents include log review from IT and operations teams or reports received from network systems and applications if any unusual activity occurs, such as email system notification of items opened that could be malicious.

companyName: Foxx Development Holdings Inc.

ticker: FOXX


text: Our Incident Response Team ("IRT"), which includes members from various functional areas within the Company, including our data center operations, software, internal information systems, customer support, legal, and marketing departments, which are responsible for managing and mitigating any cybersecurity incidents at the Company. This team operates under the policy procedures that are outlined in our Cybersecurity Incident Response Plan. This process includes notifying executive management when a cybersecurity breach or incident takes place, and taking necessary containment and mitigation steps to address the incident. Our comprehensive approach is designed to provide minimal impact on our operations and maintain the confidentiality and integrity of the personal information we handle.

companyName: TIGO ENERGY, INC.

ticker: TYGO


text: Recognizing the complexity and evolving nature of cybersecurity threats, incidents and risks, we engage third-party experts, including managed IT service providers and cybersecurity consultants, to evaluate and support our risk management systems. We also have processes to assess third party risks, and we perform third-party risk management to identify and mitigate risks from third party providers, such as vendors, suppliers, CROs, and other business partners associated with our use of third-party service providers.

companyName: Karuna Therapeutics, Inc.


text: The Company recognizes the importance of cybersecurity in safeguarding its information systems and data. Our cybersecurity measures primarily rely on standard security protocols provided by Microsoft Outlook and OneDrive, which include encryption, multi-factor authentication, and access controls to protect against unauthorized access and data breaches.

companyName: Coeptis Therapeutics Holdings, Inc.

ticker: COEP


text: From time to time, the CISO and other members of our executive leadership team discuss cybersecurity-related matters with the full Board at its scheduled meetings. Outside of scheduled meetings, management also periodically notifies or updates the Cybersecurity Committee or the Board, as appropriate, regarding certain types of cybersecurity incidents and matters.

companyName: Dynatrace, Inc.

ticker: DT


text: The Company has established processes to assess, identify, and manage material risks arising from cybersecurity threats. These processes are integrated into the Company's' overall risk management system. Specifically: • The addition of an experienced Chief Information Security Officer ("CISO") with over 25 years of experience to lead the IT Cybersecurity and Compliance team. • Yearly risk assessment designed to help identify material cybersecurity risks to our Information Systems and Data. • A security incident response team that is responsible for managing our cybersecurity risk, security controls, response, and reporting cybersecurity incidents. • A cyber and data security incident response plan with policies and procedures for identifying, managing, and recovering from cybersecurity incidents, including escalating tiers of notification and reporting depending on an incident's nature and severity. • The use of third-party service providers, where appropriate, to manage, assess, test, and assist with aspects of our security controls, such as:

companyName: LEE ENTERPRISES, Inc

ticker: LEE


text: The CISO has held several senior-level information technology roles in his twenty-six-year tenure with the Company and has served in his current role since 2021. In his various roles, he has been responsible for providing senior leadership in the areas of information security, IT governance risk & compliance, business continuity, and disaster recovery.

companyName: HARTFORD INSURANCE GROUP, INC.

ticker: HIG


text: Cyberattacks represent a potentially significant risk to the Company and our industry. We rely on subsidiaries of Cheniere, through our service agreements with them, as further discussed in Note 12—Related Party Transactions of our Notes to Financial Statements, and the board of directors of CQP's general partner (the "Board"), which has oversight of our operations, to implement policies and procedures that are intended to manage and reduce this risk.

companyName: Sabine Pass Liquefaction, LLC


text: Information security and data privacy have been, and continue to be, vitally important to the Company. Our Board, in coordination with the Audit Committee, provides oversight of the Company's major information technology risk exposures, including those related to cybersecurity, data privacy and data security, and oversees the steps management has taken to monitor and mitigate such risk exposures. Cybersecurity and related matters are recurring topics at Audit Committee meetings and the Company's Chief Information Officer ("CIO") and Chief Information Security Officer ("CISO") regularly provide the Audit Committee, and periodically the entire Board, with updates on the Company's cybersecurity risk profile and strategy. These updates include both qualitative and quantitative information on the effectiveness of the Company's cybersecurity controls.

companyName: CASEYS GENERAL STORES INC

ticker: CASY


text: Our Chief Information Security Officer, with oversight from the Chief Technology Officer and Chief Operations Officer, is primarily responsible for assessing and managing cybersecurity risks. Our Chief Information Security Officer has extensive cybersecurity knowledge and skills gained from over 25 years' experience in the field. He holds a Certified Information Systems Security Professional certification, issued by ISC, which is a globally recognized credential demonstrating expertise in information security and risk management. Our Chief Information Security Officer stays up to date on developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition also informs our program of prevention, detection, mitigation, and remediation of cybersecurity incidents.

companyName: FOOT LOCKER, INC.


text: Our Board of Directors and Chief Executive Officer, in collaboration with our Chief Information Officer and Chief Risk Officer, oversee cybersecurity processes, risks, and threats.

companyName: INDEPENDENT BANK CORP /MI/

ticker: IBCP


text: We engage with independent third-party auditors to perform SOC2 assessments on an annual basis. We also engage with a third party to conduct penetration testing at least annually to identify threats and assess their potential impact to system security. Any vulnerabilities identified in this process are triaged by our information security team and handled in accordance with our vulnerability management process.

companyName: Ibotta, Inc.

ticker: IBTA


text: The Audit Committee reports to the full Board regarding cybersecurity activities. The full Board also receives briefings from management on cyber risk issues and best practices. Our management team is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for developing and maintaining our overall cybersecurity risk methodology and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel;

companyName: SurgePays, Inc.

ticker: SURG


text: Incidents & Risks We have not experienced a material cybersecurity incident and although we are subject to ongoing and evolving cybersecurity threats, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. For more information on our cybersecurity risks, see "Technology Risks" identified in the "Risk Factors" section of Part 1 of Item 1A herein.

companyName: Baker Hughes Co

ticker: BKR


text: Our Chief Information Officer oversees our Information Technology Team and is responsible for the development and implementation of strategy for our information systems, networks, infrastructure, cybersecurity and data analytics. She has more than 25 years of experience in the field of information technology and is a member of our senior leadership team.

companyName: Ventas, Inc.

ticker: VTR


text: In addition, we have experienced unrelated incidents involving unauthorized access to certain confidential information and systems. Typically, these incidents have involved attempts to commit fraud by taking control of a customer's systems and/or emails, often by exploiting insider access or using compromised credentials. In other cases, the incidents have involved unauthorized access to certain of our customers' private information, including credit card information, financial data, social security numbers or passwords. Some of these incidents have occurred at third-party providers, including third parties who provide us with various systems and/or services. For example, in 2023, one of our third-party vendors experienced a cybersecurity incident due to a previously unknown (i.e., zero-day) vulnerability in a popular file sharing software the vendor used called MOVEit Transfer. To date, none of these incidences have materially affected or are reasonably likely to materially affect the Company or our financial position or results of operations.

companyName: TRICO BANCSHARES /

ticker: TCBK


text: On a regular basis, the CISO reports to the CRO information security risk issues, risk mitigation progress and developments, and information security enhancement initiatives. The CISO also reports the status of information security-related key risk indicators to the CRO. The CISO reports to the TOC monthly on information security developments and emerging risks, both in the industry and specific to the Company. The CISO and CRO report on the information security program to the TOC and the ERMC and review and propose updates to the information security policy to the ERMC.

companyName: EAGLE BANCORP INC

ticker: EGBN


text: To operate our business, we rely upon certain third-party service providers to perform a variety of functions, such as outsourced business critical functions, clinical research, professional services, SaaS platforms, managed services, cloud-based infrastructure, content delivery, encryption and authentication technology, corporate productivity services, and other functions. We are developing certain vendor management processes designed to help to manage cybersecurity risks associated with our use of certain of these providers. Depending on the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, our vendor management process may include reviewing the cybersecurity practices of such provider, contractually imposing obligations on the provider related to the services they provide and/or the information they process, conducting security assessments, conducting on-site inspections, requiring their completion of written questionnaires regarding their services and data handling practices, and conducting periodic re-assessments during their engagement. For our largest third-party provider, our Contract Research Organization ("CRO") which is helping us manage our global trial of Berubicin, we are currently conducting a security assessment and review including their cybersecurity practices, protocols and protections, handling of information protected by HIPAA, and physical security.

companyName: CNS Pharmaceuticals, Inc.

ticker: CNSP


text: IT networks and related systems are critical to the operation of our business and essential to our ability to successfully perform day-to-day operations. We have implemented security measures and controls to mitigate risks to our IT networks and related systems, including the risks of disruption, release of confidential information, and corruption of data. This includes a variety of technological tools and systems, including both company-owned IT and technology services provided by outside parties to support our critical functions, and in particular, the following: External port penetration testing; violation report reviewed routinely for any abnormalities; employee training and testing on cyber risks;

companyName: Omega Flex, Inc.

ticker: OFLX


text: We continually evaluate cybersecurity threats and our ability to monitor for or mitigate against these threats based on information from our vendors, partners, and our own internal research and exposures. As we are undergoing multiple system upgrades and digital transformation efforts, we will be further evaluating and implementing security measures and best practices in our new systems as we phase out legacy systems. We conduct regular scans, penetration, and vulnerability testing as part of our overall security practice, and as part of our Payment Card Industry Digital Security Standard (PCI-DSS) compliance. Our auditors perform an independent analysis on parts of our information security practices, predominantly in their assessment of our PCI compliance. We regularly conduct cybersecurity training for our employees, including training for some of the most common breach vectors seen in the industry. For our key partners who help develop or key vendors who provide information systems or have access to our information systems, we require security training or review their information security practices.

companyName: PETMED EXPRESS INC

ticker: PETS


text: We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data.

companyName: TANGER PROPERTIES LTD PARTNERSHIP /NC/


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Global IT Manager. The Global IT Manager is informed about and monitors the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of the cybersecurity risk management and strategy processes described above, including our incident response plan.

companyName: McEwen Inc.

ticker: MUX


text: The Audit Committee has oversight responsibility for risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements, cooperation with law enforcement, and related effects on financial and other risks, and it reports any findings and recommendations, as appropriate, to the full Board for consideration. Senior management regularly discusses cyber risks and trends and, should they arise, any material incidents with the Audit Committee.

companyName: Cardiff Oncology, Inc.

ticker: CRDF


text: Our information security program is subject to periodic internal audits and independent third-party reviews. We use third party security firms for security consulting, including configuration reviews and assessments, as well as performing periodic (no less frequently than annual) penetration tests to evaluate the integrity of our systems. We also conduct monitoring and testing activities, such as phishing simulations.

companyName: Artisan Partners Asset Management Inc.

ticker: APAM


text: prompt incident reporting directly to the Company's CFO l; and escalation to the Company's audit committee and board of directors as warranted based upon the nature of the identified issue.

companyName: Cyclo Therapeutics, Inc.


text: The Company engages third parties to test and advise on the Program, including to conduct our annual external penetration test. At times, the Company may engage external experts to support the Program by, for example, facilitating an internal audit, advising on a cybersecurity incident or advising on legal and regulatory requirements.

companyName: PJT Partners Inc.

ticker: PJT


text: The Audit Committee and Technology Committee of the Board of Directors provide oversight of Company cybersecurity risks. The Technology Committee conducts a minimum of one cybersecurity program update per year, including a review of capital spend, budget, and staffing, as well as periodic reports on cybersecurity threats, awareness training, and key risk indicators related to the Company's progress on risk mitigation activities. Annually, the Audit Committee reviews and recommends to the Board approval of management's recommendations on cybersecurity insurance. The Technology Committee reviews the Company's oversight related to cybersecurity risks, to ensure that Board oversight of such risks remains appropriate and that risks are appropriately managed.

companyName: Bankwell Financial Group, Inc.

ticker: BWFG


text: We conduct internal vulnerability scans, penetration tests, and breach simulation exercises, reinforcing our controls and our readiness to respond to potential threats. Recognizing the complexity and evolving nature of cybersecurity threats, we regularly engage with a range of external experts, including cybersecurity consultants, auditors and advisers, in evaluating and testing our risk management systems. Our collaboration with these third parties includes cybersecurity audits and testing, threat assessments and tabletop exercises, along with regular consultation on security enhancements.

companyName: WORLD KINECT CORP

ticker: WKC


text: We recognize that third parties that provide information systems used by the Adviser to provide services to the Company can be subject to cybersecurity incidents that could impact the Company. To mitigate third party risk, Franklin Templeton maintains a vendor code of conduct, which is designed to require third party vendors to comply with our requirements for maintenance of passwords, as well as other confidentiality, security, and privacy procedures. All third party vendors must complete a cyber incident reporting questionnaire to ensure timely notification of any potential cybersecurity breaches. Third-party IT vendors are also subject to additional diligence requirements.

companyName: Franklin BSP Capital Corp

ticker: FRBP


text: To date, risks from cybersecurity threats have not materially affected us, and we currently do not expect that the risks from cybersecurity threats are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. Despite our efforts to ensure the integrity of our computer systems, software, networks, and other technology assets, we may not be able to anticipate, detect, or recognize threats to our systems and assets, or to implement effective preventive measures against all cyber threats, especially because the techniques used are increasingly sophisticated, change frequently, are complex, and are often not recognized until launched. See the risk factor "We depend on information technology for our business and are subject to risks related to cybersecurity threats and incidents, including those affecting our third-party suppliers and other service providers. A failure of our information systems or any cybersecurity breaches or unauthorized disclosure of confidential information could have a material adverse effect on our business, disrupt our business, and adversely impact our reputation and results of operations." in Part I, Item 1A of this Form 10-K.

companyName: AUTONATION, INC.

ticker: AN


text: We are subject to risks from cybersecurity threats and incidents. As of December 31, 2024, we do not believe such risks have materially affected or are reasonably likely to materially affect the Company, including the Company's business strategy, results of operations or financial condition. However, there can be no assurance that the Company will not be materially affected by such risks in the future. For additional information regarding risks from cybersecurity threats, refer to Item 1A, "Risk Factors", in this Annual Report on Form 10-K.

companyName: Seritage Growth Properties

ticker: SRG


text: Mattel seeks to identify vulnerabilities and mitigate risks from cybersecurity threats posed by its use of third-party technology, information systems, and service providers through oversight by Mattel's information technology ("IT") organization through a variety of processes, including conducting onboarding due diligence, imposing contractual obligations related to privacy and information security, and regularly monitoring the performance of third parties providing critical support systems.

companyName: MATTEL INC /DE/

ticker: MAT


text: Our Vice President Information Technology, or VP IT, and Senior Information Security Manager, or Senior ISM, are responsible for assessing and managing material risks from cybersecurity threats, as well as managing and responding to material cyber incidents if any occur. Our VP IT has a bachelor's degree in management information systems and more than 25 years experience managing enterprise information-technology systems and resources. Our Senior ISM has an undergraduate degree in management information systems, an MBA and multiple professional cybersecurity certifications, has specialized in cybersecurity for more than a decade and is focused primarily on cybersecurity.

companyName: IMPINJ INC

ticker: PI


text: Like other businesses, we have been, and expect to continue to be, subject to attempts at unauthorized access, mishandling or misuse, computer viruses or malware, cyber-attacks and intrusions, and other events of varying degrees. To date, we have not experienced a material security breach, nor are we aware of any third-party outside service providers that have experienced a cybersecurity breach. As a result, we have not incurred any significant expenses from information security breaches or any penalties or settlements related to the same. As of December 31, 2024, we do not believe that any risks from any cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, our results of operations, or our financial condition. For a discussion of risks from cybersecurity threats that could materially affect us, please see Part I. Item 1A. "Risk Factors — Risks Related to Information Technology, Cybersecurity, and Data Protection."

companyName: Invitation Homes Inc.

ticker: INVH


text: Our Senior Vice President, Chief Financial Officer and Treasurer, Senior Vice President, General Counsel and Corporate Secretary, and Senior Vice President and Chief Accounting Officer work collaboratively with the MSP to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with a written information security incident response plan that we have adopted. These members of our management team, together with the MSP, monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents and will report such threats and incidents to the Audit Committee when appropriate.

companyName: CTO Realty Growth, Inc.

ticker: CTO


text: Our cybersecurity risk assessment and management processes are implemented and maintained by members of our management team, led by our chief information officer, who has 15 years of experience in information technology roles and supported by our director of information security, who holds several certifications in the field of information security and technology. In addition to our chief information officer, our internal management security committee includes our chief executive officer, chief financial officer, chief operations officer and chief legal officer, as well as others within our organization in information technology roles.

companyName: Iridium Communications Inc.

ticker: IRDM


text: Company is committed to protecting the personal data shared by its clients and partners. The Company employs a combination of industry-standard security technologies, procedures, and organizational measures to safeguard personal data from unauthorized access, use, or disclosure. Employees receive extensive training to ensure the privacy and confidentiality of client information.

companyName: FDCTECH, INC.

ticker: FDCT


text: Our employees are a key element of our cybersecurity risk management program. All of our employees are required to adhere to our cybersecurity practices, and undertake routine training to raise awareness and reinforce safe practices. Our training program includes bi-annual online training courses, group tabletop exercises, phishing and malicious email simulations, and information security bulletins. We also maintain policies that govern, and provide specific guidance to employees regarding how they may use our information systems.

companyName: STANDARD MOTOR PRODUCTS, INC.

ticker: SMP


text: Management's role in assessing and managing material risks from cybersecurity threats involves leadership, governance, resource allocation, and proactive risk management. Management's involvement is crucial in safeguarding the Company's digital assets, reputation, and long-term success. Our Cybersecurity Team provides periodic reports to our Audit Committee, as well as our Co-CEOs, and other members of senior management as appropriate.

companyName: Planet 13 Holdings Inc.

ticker: PLNH


text: As part of our cybersecurity risk management program, we maintain processes around third-party vendor risk management, including a framework for managing third-party information security risks. This framework, which applies to select third parties who have access to our systems and/or process our information, includes processes for assessing and reviewing the cybersecurity practices of such third-parties, including a review of available security audit reporting and certifications and inclusion of security requirements in contracts, as appropriate.

companyName: TScan Therapeutics, Inc.

ticker: TCRX


text: The Audit Committee of our Board oversees our risk management process, including the management of risks from cybersecurity threats. Our CIO, Mr. Oren Kochavi, is an accomplished executive with 14 years of experience leading information technology, enterprise systems, information security, and related technology functions. Mr. Kochavi holds an MBA in Business Administration and multiple professional certifications, and is responsible for the day-to-day administration of our cybersecurity program and reports to the Audit Committee on cybersecurity matters. The Audit Committee receives periodic reports and presentations addressing cybersecurity risks, recent developments, evolving standards, results of vulnerability assessments, findings from third-party and independent reviews, current threat intelligence, technological trends, and relevant developments regarding security considerations arising with respect to our peers and third parties. According to our procedures, the Audit Committee is promptly informed of any cybersecurity incident that meets established reporting thresholds and receives ongoing updates until the matter is fully resolved.

companyName: Pluri Inc.

ticker: PLUR


text: The Company's cybersecurity risks and strategies are overseen by both management, including our CISO, Chief Information Officer (CIO), VP, Enterprise Risk Management, and Executive Risk Committee (ERC), and the Company's Board and relevant Board committees, including the Risk Management, Technology & Innovation Committee (RMTIC). This structure reinforces that the Company's most critical risks are effectively monitored and communicated to the Board, and management, including for purposes of making any required disclosures in a timely manner. Cybersecurity risk assessments, subsequent findings, and response plans, including risks arising in connection with the Company's use of vendors and third parties, are integrated within the Company's Enterprise Risk Management framework.

companyName: Employers Holdings, Inc.

ticker: EIG


text: (or the third parties we rely on) may not be able to fully, continuously, or effectively implement security controls as intended. As described above, we utilize a risk-based approach and judgment to determine whether and how to implement certain security controls and it is possible that we may not implement the necessary controls if we are unable to recognize or underestimate a particular risk. In addition, security controls, no matter how well designed or implemented, may only mitigate and not fully eliminate cybersecurity risks.

companyName: NEPHROS INC

ticker: NEPH


text: Conduct after-action evaluation to identify what went well, what did not go well and improve VanEck systems on the back of an issue VanEck employs third-party firms to assess its cybersecurity posture, conduct penetration testing, and forensic analysis.

companyName: VanEck Bitcoin ETF

ticker: HODL


text: The Company's Board of Directors (the "Board") recognizes the importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Board is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM"). The Company's cybersecurity policies, standards, processes and practices are integrated into the Company's ERM program In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of its systems and the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: EQUITY BANCSHARES INC

ticker: EQBK


text: Any material cybersecurity incidents. In addition to these scheduled meetings, the Risk Committee, the CISO, the CDO, the CRO, and other members of management maintain ongoing dialogues with respect to emerging or potential cybersecurity threats. The Risk Committee also receives reports and updates from management regarding significant cybersecurity developments so that the Board of Directors can be promptly notified, as and when appropriate, of any threats or incidents as well as management's proposed responses.

companyName: Metropolitan Bank Holding Corp.

ticker: MCB


text: The Company's CRO is responsible for identifying, controlling and mitigating risks that could impact the Company's operations. Our CRO's decades of experience managing the various risks faced by financial institutions is helpful for developing and executing our cybersecurity strategies in a manner that is aligned with the overall risk management framework of the Company.


text: Key components of our cybersecurity risk management program include: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, incident response personnel and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers and vendors.

companyName: Clearwater Analytics Holdings, Inc.

ticker: CWAN


text: The Company's information security organization seeks to employ cybersecurity best practices, including implementing new technologies to proactively identify and monitor new vulnerabilities and reduce risk, conducting due diligence of third-party vendors' information security programs, maintaining security policies and standards and regularly updating and testing our response planning and protocols. The information security organization also works in partnership with our Internal Audit function to identify cybersecurity risks and review cybersecurity-related internal controls with third parties as part of the overall internal controls process. The information security organization also gains valuable information to improve our threat and risk awareness capabilities as a member of an industry information sharing and analysis organization, which provides strategic and tactical information sharing channels. Additionally, employees are provided mandatory cybersecurity awareness training on an annual basis, which includes information about how to identify and report cybersecurity concerns and incidents. The information security organization also conducts phishing simulations and testing scenarios through tabletop exercises and assessment activities, to help ensure compliance with our cyber policies and procedures. We maintain a cybersecurity insurance policy and have retained relevant incident response services. Additionally, we maintain an offensive security team that works both independently and with third party cybersecurity professionals to conduct security assessments of our enterprise-wide cybersecurity practices, including penetration testing, and identify areas for continuous improvement within the information security program.

companyName: COLGATE PALMOLIVE CO

ticker: CL


text: Our IT Manager oversees our governance programs in partnership with our CEO and CFO, oversees testing of our compliance with government standards in China, remediates known risks, and leads our employee training program around cybersecurity.

companyName: FingerMotion, Inc.

ticker: FNGR


text: Threats of security incidents and the impact of actual security incidents are initially assessed and managed by the CISO and CIO as described above. CNA has further implemented response plans that provide the basis for appropriate response to an unauthorized occurrence from a technical perspective, as well as from disclosure and regulatory perspectives.

companyName: CNA FINANCIAL CORP

ticker: CNA


text: AHFC's and HCFI's Company Operating Committees advise and support each company's President on company operations and other matters of corporate importance which includes, among other things, matters regarding cybersecurity. The Company Operating Committees may report on certain matters directly to the North American Regional Operating Board. Confidentiality Committees have also been established at AHFC and HCFI whose roles include, among other things, the safeguarding of personally identifiable information of our customers and associates from data security breaches. Members of our Confidentiality Committees include the Risk Management Officers, the Chief Information Security Officer or other information technology representative, and members from various areas throughout our companies.

companyName: AMERICAN HONDA FINANCE CORP


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Company are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, the Company has not identified any risks from cybersecurity threats that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition.

companyName: Overland Advantage


text: Following these risk assessments, if material risks and/or gaps are identified, we will re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our Chief Information Security Officer who reports to our Chief Information Officer, to manage the risk assessment and mitigation process.

companyName: RAMBUS INC

ticker: RMBS


text: During the period covered by this report, we have not identified risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect MetLife, including its business strategy, results of operations or financial condition. For further discussion of MetLife's risks related to cybersecurity, see "Risk Factors — Operational Risks — We May Fail to Protect the Confidentiality, Integrity or Availability of Our Systems or Data, Including As a Result of a Failure in Our Cybersecurity or Other Information Security Systems or Our Disaster Recovery Plans or Those of Our Vendors."

companyName: METLIFE INC

ticker: MET


text: We regularly assess risks from cybersecurity threats; monitor our information systems for potential vulnerabilities; and test those systems pursuant to our information technology policies, processes, and practices, which are integrated into our overall risk management program. To protect our information systems from cybersecurity threats, we use various security tools that are designed to help identify, escalate, investigate, resolve, and recover from security incidents in a timely manner. The Company's Chief Information Officer is responsible for developing and implementing our information security program and reporting on cybersecurity matters to the Board. Our Chief Information Officer has over a decade of experience leading cybersecurity oversight, and others on our IT security team have cybersecurity experience or certifications. We view cybersecurity as a shared responsibility, and we periodically perform simulations and tabletop exercises at a management level and engage external resources and advisors as needed. All employees are required to complete cybersecurity trainings each month through online trainings and simulations.

companyName: SIGA TECHNOLOGIES INC

ticker: SIGA


text: In the event of a cybersecurity breach Westwood management notifies our Board as soon as practicable, along with affected parties including clients, regulatory bodies, third parties and employees, as necessary and required by applicable laws and regulations.

companyName: WESTWOOD HOLDINGS GROUP INC

ticker: WHG


text: Board of Directors provides direct oversight of cybersecurity risk and has delegated to its audit committee the responsibility of reviewing and discussing with management our risk exposures relating to cybersecurity. The Board of Directors and the audit committee will receive regular updates from management on cybersecurity matters and are promptly informed by management about any significant new threats or incidents. In the future, management and our third-party service providers will conduct reviews at least once annually of our cybersecurity readiness to ensure continuous improvement in our cybersecurity strategies.

companyName: Processa Pharmaceuticals, Inc.

ticker: PCSA


text: Investment in Cybersecurity Program The cybersecurity threat landscape is dynamic and volatile, and requires significant investment on the part of the Company in several key areas including investing in our employees through talent recruitment, retention, training and development, investing in external resources including procuring and deploying the correct tools to monitor, evaluate, and address threats, investing employee resources to maintain effective processes, and investing in strategic relationships to monitor evolving risks including third-party service provider vulnerabilities. While our third-party service providers have experienced cybersecurity incidents and we have experienced threats to our data and systems, to date, we are not aware that we have experienced a breach that had a material impact on our operations or business, however, cybersecurity risks that may materially impact the Company are discussed in more detail in Item 1A of Part I, "Risk Factors," under the heading "Cybersecurity and Information Technology Risks," which should be read in conjunction with the foregoing information.

companyName: CONAGRA BRANDS INC.

ticker: CAG


text: The use of antivirus software, virtual private networks, email security, as well as other software to prevent and detect data intrusions.

companyName: SOLESENCE, INC.

ticker: SLSN


text: Employees are required to complete initial cybersecurity training upon commencement of employment and, thereafter, on an annual basis. The training is designed by a third party service provider. The Managing Owner carries cyber insurance. The Managing Owner maintains formal cybersecurity procedures that are considered during contract review with respect to third party vendors handling and having access to information.

companyName: GLOBAL MACRO TRUST


text: The Audit Committee is central to the Board's oversight of cybersecurity risks and bears the primary responsibility for this domain. The Audit Committee is composed of board members with diverse expertise including, risk management, and finance, which we believe equips them to oversee cybersecurity and other risks effectively.

companyName: SAB Biotherapeutics, Inc.

ticker: SABS


text: We, in coordination with external experts, have implemented a cyber and data security incident response plan that has four overarching and interconnected stages: 1) preparation for a cybersecurity incident, 2) identification, analysis, and notification of a security incident by external experts, as applicable, 3) containment, eradication, and recovery, and 4) post-incident analysis and learnings for future preparedness. Such incident responses are managed by our outsourced IT managed services provider, CFO, and department managers, who, together, comprise our primary incident response team. As part of our cybersecurity risk management process, our incident response team logs and tracks privacy and security incidents across the Partnership, vendors, third party service providers, and other business partners. Cyber and data security incidents are evaluated to determine materiality, as well as operational, business, and privacy impact, ranked by severity, and prioritized for response and remediation. Significant incidents are evaluated by the primary incident response team to determine whether further escalation is appropriate, and any incident assessed as potentially being or potentially becoming material is immediately escalated for further assessment and reported to the CEO. We consult with outside counsel and other subject matter experts regarding materiality analysis, disclosure, and other compliance matters, as appropriate, and our executive officers, with input from the Board of Managers, as appropriate, make the final materiality determinations and disclosure and other compliance decisions. Our management apprises the Partnership's independent public accounting firm of matters and any relevant developments.

companyName: DORCHESTER MINERALS, L.P.

ticker: DMLP


text: We maintain a third-party cyber risk management program to identify and oversee cybersecurity risks presented by third party providers, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. In the event we identify a risk, we communicate the risk to the third party and monitor the remediation. In the event of a critical risk that may cause imminent or material damage to us or our customers, our policy provides that we cease operating with such third party until the risk is remediated.

companyName: Shockwave Medical, Inc.


text: The Audit Committee of the Board of Directors has the primary responsibility of assisting our Board in the oversight of policies and processes pertaining to the ERM program and specifically considers risks and controls relating to, among other things, data and cybersecurity. Risks associated with cybersecurity threats are a top priority for ongoing oversight by the ERM team and the Enterprise Risk Committee. Our Vice President, Legal and Corporate Secretary, oversees the activities of the Enterprise Risk Committee and, together with the Chief Information Security Officer (CISO), briefs the Audit Committee and the Board of Directors on information security risk matters as a part of regular ERM reports, with a deep dive focused on information security at least annually (or more frequently if appropriate).

companyName: H&R BLOCK INC

ticker: HRB


text: As part of the above processes, we engage with third parties, including annually having a qualified third-party review our incident response plan and our cybersecurity measures to help identify areas for continued focus, improvement and compliance.

companyName: Profound Medical Corp.

ticker: PROF


text: Our information security program aligns with recommended practices in security standards issued by ISO, AICPA (SSAE18), National Institute of Standards and Technology ("NIST") and other industry sources. Specifically, we maintain several ISO certifications (ISO 27001, 27701, 27017, 27018, 27036), NIST 800-171 compliance, and SOC 1 and 2 Type 2 reports to comply and adhere to industry standard practices. We have invested in our data security team, information security program, and security environment in order to identify, prevent, and mitigate cybersecurity threats and promptly identify and respond to cybersecurity incidents when they occur. Maintaining, monitoring, and updating our information security program to ensure that it remains reasonable and appropriate to changes in the security threat landscape, available technology, security vulnerabilities, and legal and contractual requirements applicable to us, is a continuous effort.

companyName: Dayforce, Inc.

ticker: DAY


text: We engage consultants, or other third parties in connection with our risk assessment processes. These service providers assist us with designing and implementing our cybersecurity policies and procedures, as well as to monitor and test our safeguards, and investigations on an as needed basis. We contractually require third-party service providers to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us.

companyName: Merus N.V.


text: In addition, Interparfums SA has adopted an IT Charter that defines the rights and obligations of employees and users of their information system, to ensure that the information technology resources are used in a secure environment complying with the procedures of internal control, and regularly performs penetration testing. Beginning in January 2024, Interparfums SA commenced enrolling all employees of Interparfums SA in cybersecurity training. United States based operations provides specific user IDs, and employees are instructed to set up passwords that are not easy to guess, keep passwords confidential, and immediately change such employee's password if such employee believes it has been compromised. All desktop and laptop computers must be password protected and must be changed every 90 days. In addition, employees must not knowingly input erroneous, fraudulent, fictitious or otherwise inappropriate data into any application/system and report any suspicious activity to ITUS. Company employees are prohibited from downloading any files or software for personal use, and not create any independent data connections from Company offices that attempt to sidestep the Company's network security policy or mechanisms.

companyName: INTERPARFUMS INC

ticker: IPAR


text: In order to mitigate risks of cybersecurity incidents, critical business and operational data are backed up at night and stored offsite for security purposes and to restore data in the event of a breach. Additionally, we provide cybersecurity awareness training of our employees, incident response personnel, and senior management. executive management team is primarily responsible for assessing and managing our material risks from cybersecurity threats.

companyName: Limitless X Holdings Inc.

ticker: LIMX


text: The General Partner has written procedures and policies that govern the Partnership's general cybersecurity program. These policies and procedures include, among other things, the identification of risks, locations of information, management of third party risk and incident response, among other factors, and are designed to address real world concerns.

companyName: NESTOR PARTNERS


text: Cybersecurity user awareness training is mandatory for all new hires and for existing employees on an annual basis to help protect our employees and the Company against cybersecurity threats. This annual training is customized to address specific cybersecurity challenges and scenarios that we may face within the real estate investment industry. Novel cybersecurity threats to the Company that are identified by our IT team are communicated to all employees by email, as needed, in an effort to promote awareness and protect the Company from cyber attacks.

companyName: ACADIA REALTY TRUST

ticker: AKR


text: Our Board of Directors oversees management's processes for identifying and mitigating risks, including cybersecurity and information security risks. Our Audit Committee of our Board of Directors regularly reviews our technology and cybersecurity program and effectiveness, and internal audits of our program. Our Audit Committee also receives regular cybersecurity updates and education on a broad range of topics, including: • current cybersecurity landscape and emerging threats; • status of ongoing cybersecurity initiatives and strategies; • incident report and learnings from any cybersecurity events; and • compliance with regulatory requirements and industry standards.

companyName: RadNet, Inc.

ticker: RDNT


text: The identification, detection, prevention and remediation of known or potential IT security vulnerabilities, including those arising from third-party hackers, hardware or software, is extremely costly and time consuming. We do not have the manpower, expertise or financial resources to effectively identify, detect, prevent or remediate cybersecurity risks. No assurance or guarantee whatsoever can be given that we will not be seriously damaged by the exploitation of our cybersecurity vulnerabilities.

companyName: Peak Bio, Inc.


text: WTW has been certified by ISO 27001 and identifies, categorizes and manages cyber risks according to frameworks such as SOC 2 - Type 2 and the National Institute of Standards and Technology ('NIST') Framework. Additionally, WTW undertakes vulnerability scanning, and engages third parties from time-to-time to conduct penetration testing to help WTW identify and reduce the threat of known and emerging cybersecurity risks.

companyName: WILLIS TOWERS WATSON PLC

ticker: WTW


text: The Board and Audit Committee receive regular reports from management no less than quarterly, and on an ad hoc basis, on information and operational technology risks, including cybersecurity and data security risks, as well as on the status of projects to strengthen our information security systems, assessments of our security program, and the emerging threat landscape.

companyName: CALIFORNIA WATER SERVICE GROUP

ticker: CWT