text: Given our current stage of cybersecurity development, we have not experienced any cybersecurity incidents to date. However, we recognize that the absence of a formalized cybersecurity framework may leave us vulnerable to cyberattacks, data breaches, and other cybersecurity incidents. Such events could potentially lead to unauthorized access to, or disclosure of, sensitive information, disrupt our business operations, result in regulatory fines or litigation costs, and negatively impact our reputation among customers and partners.

companyName: La Rosa Holdings Corp.

ticker: LRHC


text: The Board as a whole also oversees the Company's cybersecurity risks. Our Chief Information Officer updates the Board periodically regarding the actions management is taking to mitigate the Company's cybersecurity risks and enhance the Company's cybersecurity protection. Management routinely evaluates the Company's existing security processes, procedures and systems in order to determine whether additional enhancements are needed to further reduce the likelihood and impact of a future cybersecurity event. Some of the Company's current safeguards include multi-factor authentication for remote access to systems; performing email phishing test campaigns; email spam filtering; restricted internet firewall rules; limiting memory stick and external hard drive use; requiring timely application of security and software patches on servers; antivirus endpoint protection upgrades; performing 24-hour/7-day a week network monitoring; and improving our backup and recovery strategy, among others.

companyName: CENTURY ALUMINUM CO

ticker: CENX

secItem: Item 1C


text: The Company's VP of IT, reporting to the CIO, oversees cybersecurity and IT infrastructure. The VP of IT remains continuously informed on emerging cybersecurity threats, industry developments, and evolving risk management techniques, ensuring the Company's ability to prevent, detect, mitigate, and remediate cybersecurity incidents. The VP of IT supervises internal cybersecurity teams and external service providers, assesses and manages material cybersecurity risks, and oversees risk mitigation strategies. With extensive global experience in managing complex information systems and deploying advanced cybersecurity technologies, the VP of IT also holds a recognized certification from a leading cybersecurity training and research institute.

companyName: TIC Solutions, Inc.

ticker: TIC


text: security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; awareness training of our employees, incident response personnel and senior management;

companyName: Plymouth Industrial REIT, Inc.


text: Our CISO reports to our Chief Financial Officer and leads our cybersecurity risk management efforts and our dedicated information security team. Our CISO has 20 years of information security experience, including over four years as a director in the information security management practice of a big four accounting firm. He holds multiple information security certifications and has a B.S. in Network Security. Our CISO leads our Information Security Steering Committee ("ISSC"), comprised of key executives and operating personnel from across the company, that oversees ongoing day-to-day management of our risks to information systems. The ISSC tracks risks and security initiatives, reviews the results of annual cybersecurity risk assessments, reviews the results of internal and third-party information security audits and assessments, identifies significant risks that threaten the achievement of security commitments and identifies controls to mitigate such risks. The CISO, along with other members of the ISSC and information security teams, remains apprised of developing cybersecurity trends through communications with the intelligence and law enforcement communities, vendors and industry engagement so that our cybersecurity risk management and governance controls and processes address new and evolving cybersecurity threats.

companyName: Paylocity Holding Corp

ticker: PCTY


text: Internal Communication of Cybersecurity Matters The VPIT regularly informs the executive leadership team of cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks we face. Furthermore, significant cybersecurity matters, and strategic risk management decisions are escalated to the Board on a timely basis, ensuring that the Board has comprehensive oversight and can provide guidance on critical cybersecurity issues.

companyName: Orion Group Holdings Inc

ticker: ORN


text: Our Board of Directors has ultimate oversight of cybersecurity risk, which it manages as part of our enterprise risk management program, while the Audit Committee is directly responsible for oversight of the Company's cybersecurity and is briefed by the Security Council on a quarterly basis. Members of the Audit Committee receive updates on a quarterly basis from senior management, including leaders from our Information Security, Product Security, Compliance and Legal teams regarding matters of cybersecurity. This includes existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any) and status on key information security initiatives. Our Board members also engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.

companyName: DHI GROUP, INC.

ticker: DHX


text: Material Risks & Integrated Overall Risk Management has strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. Our risk management team works to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.

companyName: BIOXYTRAN, INC

ticker: BIXT


text: We face certain ongoing risks from cybersecurity threats that, if realized, could materially affect us, including our business operations, results of operations or financial condition.

companyName: Primoris Services Corp

ticker: PRIM


text: We maintain a Cybersecurity Risk Committee (CRC) that is comprised of management level representatives from key organizations and functions within the Company and led by our Global Head of Cybersecurity. The CRC is responsible for our enterprise-wide cybersecurity risk management framework established by certain members of our senior management, including the review and approval of significant strategies, policies, procedures, processes, controls, and systems designed to identify, assess, monitor, and report the major risk factors facing the Company. In addition, the CRC provides guidance to senior management on risk appetite, risk profile and approves the effectiveness of the Company's enterprise-wide cybersecurity risk framework and such other duties as directed by the Board. The CRC also assists in the oversight of decisions that affect cybersecurity compliance with applicable laws, regulations, and corporate policies.

companyName: BIOMARIN PHARMACEUTICAL INC

ticker: BMRN


text: Company relies on in-house information-technology specialists to assist in managing relevant risks. Any cybersecurity incident would be reported promptly to management and material and potentially material incidents would be assessed by management and the Audit Committee for remediation and future prevention and detection.

companyName: AmpliTech Group, Inc.

ticker: AMPG


text: Our cybersecurity program is managed by the Annovis Incident Management Committee (the "AIMC"). The AIMC serves as the core team responsible for managing the enterprise-wide cybersecurity policy, maintenance and compliance across all platforms. The AIMC is responsible for the detection and initial assessment of potential cybersecurity threats and incidents. The AIMC classifies detected cyber incidents to allow prioritization, response and escalation. Incidents are documented for internal reporting processes and regularly shared with senior management.

companyName: Annovis Bio, Inc.

ticker: ANVS


text: As referenced above, our IT Security team, in consultation with our Privacy Office, is primarily responsible for frontline assessments and management of day-to-day risks from cybersecurity threats, including the monitoring and detection of cybersecurity incidents and the execution of DaVita's cybersecurity and privacy incident response plans, as needed. Pursuant to the plan, the teams are responsible for assessing and classifying cybersecurity incidents and coordinating the response to such incidents, including managing both internal and external reporting obligations and remediation efforts. Our key personnel responsible for privacy and cybersecurity expertise include our CIO, CISO and CPO. Their qualifications include expertise in international privacy laws, compliance, global IT strategy, and security responsibilities, helping to ensure a comprehensive approach to risk management. Our CISO holds a Certified Chief Information Security Officer certification from EC-Council and a Certified Information Security Manager certification from ISACA. Our CPO is a Certified Information Privacy Professional and a Certified Compliance and Ethics Professional, and has more than two decades of experience in creating and implementing privacy and data protection programs that enable multinational organizations to respect and protect personal data and execute mission critical business strategies.

companyName: DAVITA INC.

ticker: DVA


text: Matthews has also established a cross-functional Artificial Intelligence ("AI") Council to ensure that artificial intelligence is used legally, ethically, effectively, and commercially successfully across its business. The Matthews AI Council includes key members of its IT and legal functions, including its Chief Information Security Officer ("CISO"). The Matthews AI Council serves as an extension of its cybersecurity program with a specific focus on artificial intelligence systems.

companyName: MATTHEWS INTERNATIONAL CORP

ticker: MATW


text: Company recognizes the critical importance of cybersecurity in safeguarding sensitive information, maintaining operational resilience, and protecting stakeholders' interests. This cybersecurity policy is designed to establish a comprehensive framework for identifying, assessing, mitigating, and responding to cybersecurity risks across the organization.

companyName: AgEagle Aerial Systems Inc.

ticker: UAVS


text: The Information Security Program is led by the Company's Information Security Officer (ISO) who works with the Privacy Officer, Security Officer, and IT Manager to review and identify security risks and controls within each functional area of the Bank. Risk assessments are updated at least annually or more frequently if circumstances warrant. Status and compliance with the program is reported by the ISO to the Information Technology Steering Committee and the Board annually or more frequently if circumstances warrant. The report discusses material matters relating to the program including the risk assessment; risk management and control decisions; service provider arrangements; results of monitoring and testing; security breaches and management's responses; gaps; and recommendations for changes to the program.

companyName: COMMUNITY BANCORP /VT

ticker: CMTV


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program is aligned with the Company's business strategy. It shares common methodologies, reporting channels, and governance processes that apply to other areas of enterprise risk, including legal, compliance, strategic, operational, and financial risk. Key elements of our cybersecurity risk management program include: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment; • the use of external service providers, where appropriate, to assess, test, or otherwise assist with aspects of our security controls; • training and awareness programs for team members that include periodic and ongoing assessments to drive adoption and awareness of cybersecurity processes and controls; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.

companyName: Nuburu, Inc.

ticker: BURU


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with our internal information technology ("IT") team who reports to our Chief Executive Officer, to manage the risk assessment and mitigation process.

companyName: IMMUNIC, INC.

ticker: IMUX


text: Managing Material Cybersecurity Risks As a part of our overall risk management strategy, Information Security Risk conducts risk assessments on the technology environment as well as application systems implemented to support the various business functions of Hilltop based on the Gramm-Leach-Bliley Act guidance. Risks are identified from the Enterprise Risk Management and Internal Audit assessments of IT and Information Security. Information Security then quantifies the incidents and risks that have been identified and reports to the Operations & Strategy Committee, which is comprised of executives from across the enterprise representing disciplines including compliance, regulatory, information technology, risk, finance, and operations, if they meet certain thresholds. The necessary controls are identified to address the risk and this control evaluation contributes to the assessment of the residual risk value. In 2024, additional assessments were completed utilizing the FFIEC Cybersecurity Assessment Tool and the Ransomware Self-Assessment Tool for the enterprise.

companyName: Hilltop Holdings Inc.

ticker: HTH


text: Our risk-based policies, procedures, and practices are integrated into our overall risk management program and have been implemented across the organization to manage and mitigate risks from cybersecurity threats. We continuously assess risks from cybersecurity threats and monitor our information systems for potential vulnerabilities. We conduct regular reviews and tests of our information security program including penetration and vulnerability testing, and other exercises to evaluate the effectiveness of our program and improve our cybersecurity posture. These evaluations provide the Company with an unbiased view of its environment and controls. All identified cybersecurity incidents, technology outages or failures and vulnerabilities identified during these assessments are inventoried in a centralized tracking system and reported to impacted users and to management on a regular basis. A multi-step approach is applied to identify, prioritize, report, and remediate these vulnerabilities. Response and resolution times (commonly known as SLAs) are established for remediation of any incidents or outages detected, depending on their nature and potential impact. Our cybersecurity policies, procedures and practices are integrated with our overall risk management program by inclusion of cybersecurity and information systems metrics in our enterprise-wide comprehensive risk assessment process and risk appetite statement, the involvement of our Chief Risk Officer in the MAT and oversight of cybersecurity risk by our Enterprise Risk Management Committee and the Risk Committee of the Board of Directors.

companyName: BankUnited, Inc.

ticker: BKU


text: We engage third-party providers to assist us with our cybersecurity risk management and strategy. Examples of services provided by these third-party providers include threat monitoring, incident response support, testing, mitigation strategies, updates on emerging trends and developments and policy guidance. Prior to exchanging any sensitive data or integrating with any key third-party provider, we assess their security fitness against our risk posture and request changes as we deem necessary. Security controls are imposed through comprehensive standard terms and conditions that include privacy and incident reporting requirements, and third parties are periodically re-evaluated for security risk.

companyName: EASTMAN KODAK CO

ticker: KODK


text: We regularly use both outsourced and in-house information security expertise to employ a variety of administrative, technical, and physical data safeguards designed to both deter and mitigate cybersecurity risks, including cyber incident response procedures, endpoint threat detection and response solutions, employee training, third-party risk reviews, penetration testing, technical control reviews, vulnerability assessments, and enterprise-wide risk assessments. These policies and procedures, which are based on the National Institute of Standards and Technology framework, align with international standards under ISO/IEC 27001 and are reviewed annually, including via an annual assessment of relevant IT SOX controls and Payment Card Industry Data Security Standard reviews performed both by external Qualified Security Assessors and authorized members of our internal information security team. Our third-party due diligence processes also include procedures for identifying cybersecurity threats associated with third-party service providers. Cybersecurity risks are also identified and evaluated through our enterprise risk management (ERM) processes, which are overseen by the Audit Committee of our Board of Directors. Through our ERM processes, key stakeholders across the business identify, assess, and manage risk, including material cybersecurity risks. These processes enable us to monitor and assess the evolving landscape of cybersecurity risks.

companyName: AVIS BUDGET GROUP, INC.

ticker: CAR


text: For the fiscal year ended June 30, 2025, management has identified a material weakness in our internal controls over our information technology systems, as described in greater detail in Item 9A. In response, we have taken several steps to enhance our cybersecurity efforts. Those steps include increasing the scope of our Multi-Factor Authentication requirement to include additional tertiary information systems, improving password security, upgrading our anti-virus software, upgrading our threat detection tools, implementing additional threat detection tools, and replacing and/or decommissioning hardware that has known vulnerabilities.

companyName: FONAR CORP

ticker: FONR


text: Material Cybersecurity Incidents We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors" within this report when evaluating our business and related risk.

companyName: 5E Advanced Materials, Inc.

ticker: FEAM


text: In the event of an unexpected cybersecurity incident, the engineers immediately report to the Company's management. They are equipped with pre-established response plans to address such situations effectively and mitigate potential risks.

companyName: RICHTECH ROBOTICS INC.

ticker: RR


text: We maintain an Incident Response Plan that provides a documented framework for responding to actual or potential cybersecurity incidents, including timely notification of and escalation to the appropriate management committees and Bank Board. The Incident Response Plan is coordinated through the Chief Operations Officer, and key members of management are embedded into the Plan by its design. The Incident Response Plan facilitates coordination across multiple parts of our organization and is evaluated at least annually.

companyName: PEOPLES BANCORP OF NORTH CAROLINA INC

ticker: PEBK


text: As part of the Company's broader information security program, the cybersecurity program includes a defense-in-depth model that utilizes a variety of techniques and tools for protecting against, detecting, responding to and recovering from cybersecurity incidents. The Company's cybersecurity program is designed to prioritize detection, analysis and response to known and anticipated cyber threats and effective management of cyber risks and resilience against cybersecurity incidents. The Company's program leverages portions of several industry and regulatory frameworks, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF"), NIST 800-53, International Organization for Standardization Information Security Management Systems ("ISO 27001"), the CIS Critical Security Controls, the System and Organization Controls 2 Type 2 ("SOC2 Type 2"), the Payment Card Industry Standards ("PCI") and the Health Insurance Portability and Accountability Act ("HIPAA").

companyName: ROBERT HALF INC.

ticker: RHI


text: The Board, in coordination with the Audit Committee, oversees the Company's ERM process, including the management of risks arising from cybersecurity threats. The Board and the Audit Committee each receive regular presentations and reports on cybersecurity risks from the Sr. Director, IT. The Board and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. The Board and the Audit Committee regularly discuss topics that include regulatory compliance, incident response and data privacy and on at least an annual basis, discuss the Company's approach to cybersecurity risk management with members of management.

companyName: WABASH NATIONAL Corp

ticker: WNC


text: VF's IT systems have been subject to cybersecurity incidents in the past and there is no guarantee that future cybersecurity incidents will not have a material impact in the future. To learn more about risks from cybersecurity threats, see the following risk factors in Item 1A of this Part I, under the headings, "VF relies significantly on information technology. Any inadequacy, interruption, integration failure or security failure of this technology could harm VF's ability to effectively operate its business," and "VF is subject to cybersecurity, information security and privacy risks that could negatively affect its business operations, results of operations or reputation."

companyName: V F CORP

ticker: VFC


text: Role of Management In addition to the risk management activities undertaken by the ERM Committee, our corporate information security organization, led by our CISO, is responsible for our overall information security strategy, policy, security engineering, operations and cyber threat detection and response. The current CISO has more than 27 years of technology industry leadership, cybersecurity expertise and engineering and operations experience. The corporate information security organization manages and continually enhances the Company's enterprise security structure with the goal of preventing cybersecurity incidents to the extent feasible, while simultaneously increasing our system resilience to minimize the business impact should an incident occur. Central to this organization is our cyber incident response team, which is responsible for the Company's protection, detection and response capabilities. In the event of a cybersecurity incident, the Company is equipped with an incident response plan that includes: (i) detection and analysis, (ii) containment and eradication, and (iii) remediation and (iv) preparation for future incidents. Incident responses are led by our Information Security team and supported by Legal, Compliance and other functions as appropriate. The CISO and the Chief Digital Solutions Officer provide regular updates to the Board and the Audit Committee concerning the Company's technology and cybersecurity programs, associated risks and the Company's efforts to help mitigate those risks.

companyName: S&P Global Inc.

ticker: SPGI


text: Our Board of Directors is acutely aware of the critical nature of managing risks associated with cybersecurity threats. Our Board has established robust oversight mechanisms to ensure effective governance in managing risks associated with cybersecurity threats because we recognize the significance of these threats to our operational integrity and stakeholder confidence.

companyName: Flywire Corp

ticker: FLYW


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of our management, including our CIO, who has over 15 years of experience in IT management. Our CIO reports directly to our leadership team and provides regular reports.

companyName: Immunocore Holdings plc

ticker: IMCR


text: Members of the Global Information Security Team possess expertise in various disciplines that are key to effectively managing our information security program. Team members represent relevant functions within the organization (e.g., Risk and Compliance, Security Operation Center & Network Engineering and Operational Technology). Global Information Security Team members have multiple years of experience working for large enterprises in the information technology and information security space. This includes, but is not limited to, expertise in data infrastructure, operations and information security and risk and compliance. In addition, our CIO and certain members of the Global Information Security Team are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity incidents through their participation in incident response protocols.

companyName: AMKOR TECHNOLOGY, INC.

ticker: AMKR


text: We apply a risk-based approach to mitigate cybersecurity risks associated with our use of third-party service providers and cybersecurity considerations affect the selection and oversight of these third-party service providers. We perform due diligence on third parties that have access to our most critical systems, data or facilities that house such systems or data.

companyName: BALCHEM CORP

ticker: BCPC


text: Our IT management is responsible for notifying the Cybersecurity Governance Committee of cyber incidents they become aware of from software alerts, third-party vendors, employees or by other means. The Cybersecurity Governance Committee will review such incidents, including activities by IT management to evaluate the severity of the incidents, and will provide details of any cybersecurity events, including those not deemed to have a material impact, to our Internal Controls and Disclosure Committee for reporting to our Audit Committee. In addition, our Chief Financial Officer, Senior Manager of IT and Director of Internal Audit maintain an ongoing dialogue with the Audit Committee during the year regarding emerging or potential cybersecurity risks.

companyName: FTC Solar, Inc.

ticker: FTCI


text: Additionally, we use processes to oversee and identify material risks from cybersecurity threats associated with our use of third-party technology and systems, including third party penetration tests, external security audits of our data loss prevention mechanisms and require that our vendors comply with Service Organization Control Type II requirements.

companyName: SES AI Corp

ticker: SES


text: In the last three fiscal years to date, we have not identified any risks from cybersecurity threats or become aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business, results of operations, or financial condition.

companyName: FEDEX CORP

ticker: FDX


text: The underlying controls of our cybersecurity capabilities are designed to prevent, detect, mitigate and remediate cybersecurity risks and are based on recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF") and the International Organizational Standardization ("ISO") 27001 Information Security Management System Requirements.

companyName: SUPERIOR ENERGY SERVICES INC


text: As part of Abbott's cybersecurity program, Abbott regularly engages with assessors and third party advisers to perform various services, including assessments of process design and operating effectiveness; security testing and attestation; periodic assessment of enterprise cybersecurity maturity; industry benchmarking; and thought leadership related to continuous improvement of processes, training, technology, and data.

companyName: ABBOTT LABORATORIES

ticker: ABT


text: Board of Directors Oversight of Cybersecurity Material Risks – Governance The Board of Directors, or the Board, is keenly aware of the critical nature of cybersecurity risks, particularly in its business as a public utility providing a life sustaining product. The Board, in partnership with the Executive team, has created a robust cybersecurity program, with meaningful oversight measures and tools for tracking and managing cyber risks and threats. The Company understands the importance of its product and services to the communities that it serves and is dedicated to maintaining high stakeholder confidence in its operations.

companyName: YORK WATER CO

ticker: YORW


text: The Audit Committee oversees cybersecurity risk management, including the policies, processes, and practices that management implements to operationalize our cybersecurity risk management program. The Audit Committee will promptly receive information regarding any material cybersecurity incident that may occur, including any ongoing updates. The Audit Committee periodically discusses our approach to cybersecurity risk management with our CFO, who oversees the Company's information systems.

companyName: Longevity Health Holdings, Inc.

ticker: XAGE


text: To protect against cybersecurity threats, DTE Energy employs a dedicated cybersecurity team led by the Chief Information Officer. The cybersecurity team is responsible for implementing proper safeguards to mitigate the risk of cyber threats, including but not limited to firewalls, continuous monitoring, and training. DTE Energy also engages with third parties to conduct cybersecurity maturity assessments to provide an independent and objective view of our cybersecurity and assess opportunities for improvement. The National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) is the basis for these assessments to manage cyber risks, mature and monitor existing security controls, and communicate security posture coherently. The NIST CSF provides a common language to understand, manage, and express cyber risks internally and externally.

companyName: DTE Electric Co


text: Peabody's Board of Directors maintains direct oversight over cybersecurity risks and oversees an enterprise-wide approach to risk management, designed to support the achievement of organizational objectives to enhance long-term performance and stockholder value. The Board, as a whole, and through its committees, is responsible for the oversight of risk management and Peabody's management is responsible for the day-to-day management of the risks the Company faces. Senior leadership, including Peabody's CISO, regularly briefs the Board on cybersecurity matters and the Board is informed of cybersecurity incidents deemed to have a moderate or higher business impact, even if such incidents are determined to be immaterial, on an ongoing basis.

companyName: PEABODY ENERGY CORP

ticker: BTU


text: Risk Management Strategy Xerox Holdings maintains a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. This program is integrated within the Company's enterprise risk management system and addresses both the corporate information technology environment and customer-facing products and services. The underlying controls of the cyber risk management program are based on recognized leading practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) and the International Organization for Standardization (ISO) 27001 Information Security Management System Requirements.

companyName: XEROX CORP


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees and violation of data privacy or security laws.

companyName: Prime Medicine, Inc.

ticker: PRME


text: Identifying and assessing cybersecurity risks is integrated into our overall risk management program and processes. Cybersecurity risks related to our business, technical operations, data, and privacy, along with cybersecurity risk-related compliance issues, are identified and addressed through a framework consisting of third-party assessments, internal information technology audits, information security assessments, and risk and compliance reviews. We conduct regular privacy and cybersecurity reviews of systems, audit applicable data and information policies, perform penetration and vulnerability testing using third-party tools to test security controls, perform regular training and assessments for the Board of Directors and employees, monitor emerging data privacy and information security laws and regulations, and implement applicable changes to improve our overall security posture. We regularly engage third-party auditors to assess our cybersecurity program and compliance with all applicable "best practices" and regulations. The Company adjusts its information security policies, standards, processes and practices as necessary based on the information provided by have in place a robust incident response process that helps ensure our preparedness for a cybersecurity incident including our ability to detect, analyze, contain, remediate, and recover from a security incident as well as conduct post-incident analysis to avoid future incidents. Incident response process activities are overseen by cross-functional leadership in Risk Management, Operations, Information Security, Compliance, and Information Systems. Security events and incidents are evaluated, ranked by severity, and prioritized for response and remediation. Incidents are evaluated to determine materiality and operational, business, and overall privacy impacts. We conduct regular exercises and drills to simulate responses to various cybersecurity incidents. The incident response team, including management, coordinates with technical and business stakeholders to further analyze risks and enhance detection, mitigation, and remediation strategies incorporated in the incident response program.

companyName: FARMERS & MERCHANTS BANCORP

ticker: FMCB


text: While we have been subject to a number of cybersecurity threats and experienced non-material incidents in the past, they have not had a material adverse effect on our business, financial condition or results of operations. Our third party services providers have been also subject to a number of cybersecurity threats and incidents but to date, none of those threats and incidents have had a materially adverse effect on our business, financial condition or results of operations.

companyName: Compass, Inc.

ticker: COMP


text: Our Information Security Risk Management program is based on recognized industry governance frameworks, including the International Organization for Standardization. It provides a framework to identify, assess, and control cybersecurity threats and incidents. We perform an annual information security risk assessment with the assistance of independent security companies, with the aim to embed information security principles and objectives into our culture, business operations, and support functions.

companyName: CLARIVATE PLC

ticker: CLVT


text: As of December 31, 2024, we are not aware of any cybersecurity threats or incidents that have materially affected us; however, there can be no guarantee that we will not be the subject of future attacks, threats or incidents that may have a material impact on our business strategy, results of operations or financial condition. Additional information on cybersecurity risks we face can be found in Part I, Item 1A, Risk Factors, of this Annual Report on Form 10-K under the heading "A breach of, or failure in, information technology systems on which we rely could materially and adversely impact us," which should be read in conjunction with the foregoing information.

companyName: American Healthcare REIT, Inc.

ticker: AHR


text: We are also focused on building strong relationships with the appropriate government and law enforcement agencies and with other businesses, industry groups and cybersecurity services to better understand the cybersecurity risks in our environment, enhance our defenses and improve our resiliency against cybersecurity threats.

companyName: FEDERAL NATIONAL MORTGAGE ASSOCIATION FANNIE MAE

ticker: FNMA


text: The Board and its Security & Technology Committee also receive prompt and timely information regarding any cybersecurity incidents that meet established reporting thresholds, as well as ongoing updates regarding any such incidents until they have been addressed. At least annually, the Board discusses the Company's approach to cybersecurity risk management with the Company's CSO, CIO, and Chief Legal & Risk Officer, and other members of management.

companyName: TTEC Holdings, Inc.

ticker: TTEC


text: Processes to detect cybersecurity events and improve incident response, including routine testing of incident response, recovery and business continuity plans and processes; and Third-party risk management process to manage cybersecurity risk with service providers, suppliers, and vendors.

companyName: F&M BANK CORP

ticker: FMBM


text: As of the date of this report, we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. In 2023, the Company reinforced its business continuity plan in an effort to provide increased oversight of our third-party service providers and suppliers. Risks from cybersecurity threats that are reasonably likely to materially affect the Company, its business strategy and results of operations or financial condition, include (but are not limited to): data loss; a disruption to our operations; a compromise or corruption of confidential or proprietary information; damage to our employee and business relationships and reputation; increased burden of regulatory compliance; and/or litigation and liability. See our related risk factors in "Item 1A. Risk Factors" for more information about the Company's risks from cybersecurity threats and how such threats may impact the Company's business, operations, and financial results.

companyName: Wingstop Inc.

ticker: WING


text: Blackstone tests its cybersecurity defenses regularly through automated and manual vulnerability scanning, to identify and remediate critical vulnerabilities. In addition, it conducts annual "white hat" penetration tests to validate its security posture. Blackstone examines its cybersecurity program every two to three years with third parties, evaluating its effectiveness in part by considering industry standards and established frameworks, such as the National Institute of Standards and Technology and Center for Internet Security, as guidelines. Further, Blackstone engages in cyber incident tabletop exercises and scenario planning exercises involving hypothetical cybersecurity incidents to test its cyber incident response processes. Blackstone's Chief Security Officer (the "CSO") and members of Blackstone's senior management, Legal and Compliance, Technology and Innovations ("BXTI"), and Global Corporate Affairs participate in these exercises. Learnings from these tabletop exercises and any events Blackstone experiences are reviewed, discussed, and incorporated into its cybersecurity framework as appropriate. In addition to Blackstone's internal exercises to test aspects of its cybersecurity program, Blackstone periodically engages independent third parties to analyze data on the interactions of users of Blackstone information technology resources, including Blackstone employees, and conduct penetration tests and scanning exercises to assess the performance of Blackstone's cybersecurity systems and processes.

companyName: Blackstone Real Estate Income Trust, Inc.

ticker: BSTT


text: Role of the Board of Directors and the Audit Committee As part of the Board of Directors' role in overseeing the Company's enterprise risk management program, which includes our cybersecurity risk management framework, the Board is responsible for exercising oversight of management's identification and management of, and planning for, material cybersecurity risks that may reasonably be expected to impact the Company. While the full Board has overall responsibility for risk oversight, the Board has delegated oversight responsibility related to risks from cybersecurity threats to the Audit Committee. The Audit Committee is responsible for overseeing the strategic direction, objectives, and effectiveness of the Company's cybersecurity risk management framework, taking into account the Company's risk exposures and progress of its risk management processes. The Audit Committee is informed of the Company's cybersecurity risk management and receives an overview of its cybersecurity program from management at least quarterly. Material cybersecurity risks are also discussed during separate Board meetings as part of the Board's risk oversight generally.

companyName: Quipt Home Medical Corp.

ticker: QIPT


text: These members of management and the Cybersecurity Executive Committee are informed about, and monitor the prevention, mitigation, detection, and remediation of, cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. Our cybersecurity playbooks and incident response plan outline our procedures, communication protocols, and information escalation processes applicable throughout the lifecycle of a cybersecurity incident. The playbooks and plans cover information flow from discovery of a possible issue through the reporting of it to Information Services management, the Cybersecurity Executive Committee, and Board as necessary. As discussed above, members of management (our President, Chief Information Officer, and Director of Information Security) report to the entire Board about cybersecurity threat risks, among other cybersecurity related matters, at least twice per year, with the Audit Committee receiving more frequent updates as needed to assist in maintaining or enhancing cybersecurity posture in financial reporting, and monitoring attack and penetration testing results.

companyName: Southwest Gas Holdings, Inc.

ticker: SWX


text: Management Oversight The controls and processes employed to assess, identify and manage material risks from cybersecurity threats are implemented and overseen by our Chief Financial and Operating Officer. Our Head of IT is responsible for the day-to-day management of the cybersecurity program and provides regular briefings for our senior management team on cybersecurity matters, including threats, events, and program enhancements.

companyName: MARINUS PHARMACEUTICALS, INC.


text: In designing and carrying out cybersecurity controls, Park follows the National Institute of Standards and Technology Cyber Security Framework for measuring readiness to respond, Sarbanes Oxley for assessment of internal controls, the Gramm-Leach-Bliley Act regarding information security, the Office of Comptroller of the Currency's Cybersecurity Supervision Work Program, Interagency Guidance on Third-Party Relationships: Risk Management, other applicable regulatory guidelines, and federal and state laws.

companyName: PARK NATIONAL CORP /OH/

ticker: PRK


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Director of Cybersecurity and Technology Operations (who reports directly to the Vice President & Head of Technology), internal security staff or third-party experts as part of the Board's continuing education on topics that impact public companies.

companyName: Rexford Industrial Realty, Inc.

ticker: REXR


text: The CIO and CISO are responsible for the maintenance of the incident response program that is designed to protect our information systems and information from cybersecurity threats and oversee the incident response team which responds to any cybersecurity threats or incidents in accordance with our cybersecurity incident response plan. The cybersecurity incident response team is responsible for monitoring, preventing, detecting, mitigating and remediating cybersecurity threats and incidents and reports such threats and incidents to the CISO (or other relevant stakeholders). Depending on the threat or incident level, the CISO will engage the cybersecurity crisis management team and the cyber incident disclosure committee to determine proper escalation with significant incidents being reported to the Board.

companyName: HERC HOLDINGS INC

ticker: HRI


text: The Company's Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated to its Audit Committee (the "Committee") oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of the Company's cybersecurity risk management program.

companyName: O-I Glass, Inc. /DE/

ticker: OI


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. For more information regarding cybersecurity risks that may affect or Company, see "Item 1A. Risk Factors" included in this Report.

companyName: NEKTAR THERAPEUTICS

ticker: NKTR


text: Jill Granat. Ms. Granat was appointed General Counsel and Corporate Secretary of RBI in December 2014. Ms. Granat served as Senior Vice President, General Counsel and Secretary of Burger King Worldwide and its predecessor since February 2011. Prior to this time, Ms. Granat was Vice President and Assistant General Counsel of Burger King Corporation from July 2009 until February 2011. Ms. Granat joined Burger King Corporation in 1998 as a member of the legal department and served in positions of increasing responsibility with Burger King Corporation.

companyName: Restaurant Brands International Limited Partnership

ticker: RSTRF


text: Our Board of Directors provides direction and oversight over the Company's enterprise-wide risk management program, including risks related to cybersecurity. The entire Board of Directors is provided regular updates regarding the Company's information technology policies, procedures, risks and operating status. These updates include updates on the Company's cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape.

companyName: FIRST CAPITAL INC

ticker: FCAP


text: Like all companies that utilize technology, we face significant cybersecurity threats that include, among other things, attempts to gain unauthorized access to sensitive student and employee information; attempts to compromise the integrity, confidentiality and/or availability of our systems, hardware and networks, and the information on them; insider threats; malware; ransomware; threats to the safety of our directors, officers and employees; and threats to our facilities, infrastructure and service. As cybersecurity threats may arise, the cybersecurity team focuses on responding to and containing the threat and minimizing any business impact, as appropriate. In the event of a perceived threat or possible cybersecurity incident, the cybersecurity team is trained to assess, among other factors, student safety impact, data and personal information impact, the possibility of business operations disruption, projected cost, if any, and potential for reputational harm, with support from external technical, legal and law enforcement support, as appropriate.

companyName: Legacy Education Inc.

ticker: LGCY


text: We believe that cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to affect the Company, including its business strategy, results of operations or financial condition. See Item 1A, Risk Factors, of Part I of this Annual Report for the discussion of our risks related to cybersecurity.

companyName: UpHealth, Inc.


text: Cincinnati Financial Corporation - 2023 10-K - Page 43 Associates involved in this area stay informed of industry trends and evolving threats using various resources including government authorities, peers, continuous education, industry publications, news outlets and other external parties that provide pertinent information. We take administrative, technical and internal accounting control measures to protect against cybersecurity incidents, including actions to monitor for, prevent, detect, mitigate and remediate any incidents that occur. These measures and actions include endpoint controls, multi-factor authentication and general cybersecurity education directed at our workforce and independent agents.

companyName: CINCINNATI FINANCIAL CORP

ticker: CINF


text: We have developed a well-defined and frequently updated information security incident response plan that outlines procedures to be followed in the event of a cybersecurity incident. The plan is periodically drilled with incident response team members and includes robust processes for identification, categorization, escalation and reporting of incidents. Employees are regularly trained on key cybersecurity subjects to ensure awareness.

companyName: LITHIA MOTORS INC

ticker: LAD


text: The Company recognizes the risk that cybersecurity threats pose to our operations and considers cybersecurity an integral component of our overall risk management strategy. We have adopted the U.S. Department of Commerce's National Institute of Standards and Technology (NIST) Cybersecurity Framework to guide our cybersecurity program.

companyName: CNX Resources Corp

ticker: CNX


text: Our Vice President, Enterprise Application's experience includes a Certified Information Systems Security Professional ("CISSP") certification, which is designed for security professionals with extensive knowledge in contemporary cybersecurity and information security practices. In addition, our Chief Executive Officer has broad expertise in overseeing cybersecurity programs, incident response teams, and information technology departments.

companyName: KILROY REALTY CORP

ticker: KRC


text: Management is responsible for identifying risks that threaten achievement of the control activities stated in the management's description of the services organizations systems. Management has implemented a process for identifying relevant risks that could affect the organization's ability to provide secure and reliable service to its users. The risk assessment occurs annually, or as business needs change, and covers identification of risks that could act against the company's objectives as well as specific risks related to a compromise to the security of data. See "Item 1A. — Risk Factors — Risks Related to Our Company and Business — A material breach in security relating to our information systems and regulation related to such breaches could adversely affect us."

companyName: My Size, Inc.

ticker: MYSZ


text: As of the date of this Annual Report, we have not encountered risks from cybersecurity threats that have materially affected, or are reasonably likely to materially affect, our business strategy, results of operations or financial position.

companyName: AMERICAN REBEL HOLDINGS INC

ticker: AREB


text: We face risks related to cybersecurity such as unauthorized access, cybersecurity attacks and other security incidents, including as perpetrated by hackers and unintentional damage or disruption to hardware and software systems, loss of data, and misappropriation of confidential information. To identify and assess material risks from cybersecurity threats, we maintain an enterprise-wide information security program designed to identify, protect, detect and respond to and manage reasonably foreseeable cybersecurity risks and threats. To protect our information systems from cybersecurity threats, we use various security tools that help prevent, identify, escalate, investigate, resolve and recover from identified vulnerabilities and security incidents in a timely manner.

companyName: PROKIDNEY CORP.

ticker: PROK


text: The Company's management team is responsible for the day-to-day management of cybersecurity risks it faces, including the Company's Executive Vice President and Chief Operating Officer and Director of Information Security. The Company's current Director of Information Security has over 29 years of experience. For the past 8 years, the Company's Director of Information Security has successfully managed teams, implementing and maintaining robust cybersecurity and data protection controls to safeguard the Company's information assets. The Company's Director of Information Security reports directly to our Executive Vice President and Chief Operating Officer, who possesses extensive expertise gained through over 30 years in various risk, operations and leadership roles. This combined experience ensures exceptional guidance and oversight of our cybersecurity program.

companyName: ALERUS FINANCIAL CORP

ticker: ALRS


text: Our management team is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our information security organization is comprised of internal and external security and technology professionals. We continue to make investments in information security resources to mature, expand, and adapt our capabilities to address emerging cybersecurity risks and threats. In addition, we have newly formed a multifunctional cybersecurity committee comprised of information technology, operations, risk, and finance members who will meet quarterly to assess new vulnerabilities and threats, update risk assessments and assess the implementation of the Company's cybersecurity risk management program. This committee will report periodically to the management team on matters involving cybersecurity risks and incidents.

companyName: TERAWULF INC.

ticker: WULF


text: We have implemented a monitoring and detection system to help promptly identify cybersecurity incidents. We also require our employees and contractors to receive annual cybersecurity awareness training. We perform cybersecurity tabletop exercises to test the effectiveness of our incidence response plan ("IRP") and implement post-incident "lessons learned" to enhance our response. We provide our system users with access consistent with the principle of least privilege, which requires that such users be given no more access than necessary to complete their job functions. We have also implemented a multi-factor authentication process for employees accessing company information. We use encryption methods to protect sensitive data. This includes the encryption of our customer data, financial information, and other confidential data. We have programs in place to monitor our retained data with the goal of identifying personal identifiable information and taking appropriate actions to secure the data.

companyName: HighPeak Energy, Inc.

ticker: HPK


text: Cyber Liability Insurance. Through consultant driven data, analytics and peer benchmarking, we secured and maintain specific coverage to mitigate certain losses associated with cyber-attacks and other information security incidents, addressing both first-party and third-party losses from incident response, including for example, cyber extortion, data loss, business interruption, contingent business interruption, regulatory penalties, media liability, social engineering coverage, system failures and bricking/hardware replacement.

companyName: BrightSpire Capital, Inc.

ticker: BRSP


text: Incident Disclosure and Materiality Our incident management procedures include identification, evaluation, definition, and escalation based on the determination of materiality. This determination involves the Company's IT, Legal, and Compliance teams, executive officers, and cyber insurance provider. Breach notifications and escalation to the Audit Committee would also be based on the materiality determination. The collaboration among IT, Legal, and Compliance helps ensure and prevent gaps with laws and regulations. Each quarter, the VP of IT provides an update on key cybersecurity projects and any material breaches at the quarterly Audit Committee meeting, at which both the internal and external auditors are present.

companyName: Fluent, Inc.

ticker: FLNT


text: While cyber-attacks are common threats to all businesses, the Company did not experience a material cyber security incident in either fiscal year 2025 or 2024.

companyName: EDUCATIONAL DEVELOPMENT CORP

ticker: EDUC


text: Report. Following the conclusion of a security investigation, the SIRT prepares a report for the Information Security Governance Committee, as appropriate. The report includes information about the incident, details about the response and includes recommendations to prevent similar security events from occurring in the future. Additionally, the Information Security Team provides the Audit Committee and the Board with regular updates on cybersecurity matters, including recent cybersecurity threats and incidents and ongoing efforts to prevent, detect and respond to internal and external cybersecurity threats.

companyName: Cars.com Inc.

ticker: CARS


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, operational risks; intellectual property theft; fraud; extortion; harm to robots, employees or customers; violation of privacy or security laws and other litigation, legal and reputational risks. We have implemented several cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage such material risks.

companyName: Serve Robotics Inc. /DE/

ticker: SERV


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage the cybersecurity risks that are relevant to our business.

companyName: ITT INC.

ticker: ITT


text: Cybersecurity is an important part of our risk management processes. Our Chief Financial Officer is the primary person in our company responsible for overseeing the cybersecurity risk management program. He has had oversight of our cybersecurity and risk management programs since the second half of 2021. This is not a full-time function for our Chief Financial Officer and because he is not an experienced computer professional, he relies to a large degree on our outside information technology, or IT, support firm. He is also immediately alerted of any cybersecurity breaches that occurs by our third-party vendors or by others so that appropriate measures may be taken timely.

companyName: Transcode Therapeutics, Inc.

ticker: RNAZ


text: Our board's Security and Technology Committee ("STC") reviews the overall status of management's information security program, including any significant issues, significant emerging risks, strategies, and other information to ensure that information security management practices appropriately address potential risks. It is also responsible for the exposure and containment of technology risks, including security risks.

companyName: Federal Home Loan Bank of Indianapolis


text: Board of Director Oversight Our Audit Committee has primary responsibility for overseeing risk management, including with respect to cybersecurity. The Audit Committee monitors management's compliance, and reports to the Board of Directors. The CISO, who is responsible for developing our cybersecurity strategy and managing our cybersecurity risks, reports directly to the Audit Committee on these matters.

companyName: INNODATA INC

ticker: INOD


text: In the event of a cybersecurity incident, we have developed and implemented a communication and disclosure framework, which includes processes for escalating communication of the event to members of our internal disclosure committee for assessment of materiality and disclosure, executive management team members, internal and external legal counsel, internal and external audit teams, and other internal stakeholders. Significant cybersecurity events and strategic risk management decisions would be directed to the Audit and Risk Committee for additional comprehensive oversight of the Company's response measures and public disclosure of the event as appropriate. While we have experienced cybersecurity incidents in the past, none have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition.

companyName: UPBOUND GROUP, INC.

ticker: UPBD


text: Our Audit Committee of the Board of Directors is responsible for oversight of our risk assessment, risk management, disaster recovery procedures and cybersecurity risks. Periodically during each year, the Audit Committee receives an overview from our Chief Financial Officer of our cybersecurity threat risk management and strategy processes, including potential impact on the Company, the efforts of management to manage the risks that are identified and our disaster recovery preparations. Members of the Board of Directors regularly engage in discussions with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.

companyName: VAPOTHERM INC


text: Our PCO is an experienced embedded systems engineer and chief engineer with nearly 20 years' experience in the development, product assurance, and security of critical and highly regulated embedded and other computer systems in medical, aviation, and military products and services. In performing her role, she regularly reviews cybersecurity risks, controls, program policy and processes, including training, and oversees and advises teams performing policy and program development, implementation and updates. Our PCO is regularly apprised of product and service cybersecurity events, threats and activities including with respect to incidents, protection vulnerabilities, software update needs and lifecycle status.

companyName: RTX Corp

ticker: RTX


text: The Head of IT is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. The Head of IT, together with certain other senior management personnel, is responsible for approving functional budgets, implementing approved, phase-appropriate policies, plans and guidelines, helping prepare for potential cybersecurity incidents, reviewing security assessments and other security-related reports and overseeing cybersecurity processes.

companyName: ACELYRIN, Inc.


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers and other members of senior management are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight function directly as well as through our audit committee.

companyName: Sana Biotechnology, Inc.

ticker: SANA


text: Our assessment of risks associated with the use of third-party vendors is part of our overall cybersecurity risk management framework. If a third-party vendor is unable to provide a SOC 1 or SOC 2 report, our information security team takes additional steps to assess their cybersecurity preparedness and our initiation or continued engagement with them. Additionally, third-party vendors are required to include security and privacy addendums to our contracts where applicable and are reassessed periodically as necessary depending on the risk level that has been assigned to the third-party vendor. Our legal team also requires that our third-party vendors report cybersecurity incidents to us so the impact of the incident on us can be assessed.

companyName: ALIGN TECHNOLOGY INC

ticker: ALGN


text: Conduct after-action evaluation to identify what went well, what did not go well and improve VanEck systems on the back of an issue VanEck employs third-party firms to assess its cybersecurity posture, conduct penetration testing, and forensic analysis.

companyName: VanEck Bitcoin ETF

ticker: HODL


text: Farmer Mac also maintains a privacy and security incident response program to prepare for, detect, respond to, and recover from cybersecurity incidents. That program includes processes to triage, assess severity for, escalate, contain, investigate, and remediate any cybersecurity incident, as well as to comply with any applicable legal obligations and to mitigate brand and reputational damage. Farmer Mac also conducts regular tabletop exercises to test and fortify the controls of its cybersecurity incident response program. Farmer Mac's security operations center and incident response team assesses the severity and priority of incidents on a rolling basis, with escalations of cybersecurity incidents provided to Farmer Mac's management team. If a cybersecurity incident is determined to be a material cybersecurity incident, Farmer Mac's incident response plan defines the process for any required regulatory disclosures.

companyName: FEDERAL AGRICULTURAL MORTGAGE CORP

ticker: AGM


text: Additionally, we monitor emerging laws, industry standards, and regulations related to information security and data protection. Although we have not experienced any cybersecurity incidents or threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition to date, and though we are actively monitoring our networks and access points by implementing security updates regularly, we cannot provide any assurance that there will not be incidents or threats in the future that may materially affect us, including our business strategy, results of operations, or financial condition.

companyName: Mawson Infrastructure Group Inc.

ticker: MIGI


text: We regularly assess risks from cybersecurity threats, monitor our information systems for potential vulnerabilities and test those systems pursuant to our cybersecurity policies and procedures, which are integrated into the Company's overall risk management framework. To protect our information systems from cybersecurity threats, we use various security tools that help us identify, escalate, investigate, resolve, and recover from security incidents in a timely manner. We also conduct annual risk-based penetration testing and provide cybersecurity training for applicable employees. Where appropriate, we engage external advisors and consultants to assist with various aspects of our cybersecurity program and processes.

companyName: Seaport Entertainment Group Inc.

ticker: SEG


text: We manage cyber risk and assess internal maturity capabilities by leveraging the National Institute of Standards and Technology (NIST) framework, in conjunction with the Center for Internet Security (CIS) top 18 risk framework. Internal and external assessments are conducted for best practice benchmarking. Outputs from these assessments are used to develop strategic priorities, and to develop tactical action plans to continue to mature our cyber posture. CONMED leverages technologies, external consultants and vendors to support our risk management strategies, threat insights, trends, and mitigation approaches. In addition, CONMED has published corporate policies that support our cybersecurity efforts, such as our employee handbook, and has proactively implemented protection measures such as endpoint encryption, endpoint monitoring (EDR), remote access, VPN, and multi-factor authentication. Policies and procedures must go through a controlled review process by senior management to ensure relevant updates are being incorporated in our policies.

companyName: CONMED Corp

ticker: CNMD


text: The CSO Office implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and advanced compliance systems to identify and mitigate potential vulnerabilities. The CSO Office collaborates closely with key departments within the Company, including the office of our Chief Technology Officer ("CTO"), Engineering, IT, DevOps, Support, and Production, to implement our Vulnerability Management Remediation Plan. This collaboration is aligned with industry standards of the Software Development Life Cycle, underscoring our commitment to maintaining robust security protocols across all phases of our operations.

companyName: JFrog Ltd

ticker: FROG


text: Our management, including our Chief Information Officer ("CIO"), in consultation with our Chief Information Security Officer ("CISO"), reviews with the Audit Committee quarterly, or more frequently as determined to be necessary or advisable, regarding our cybersecurity security policies, practices and protective measures, threat intelligence, cybersecurity incidents and related risks. At least quarterly, our CIO also provides the Audit Committee with an update on our enterprise security program that includes procedures and policies for testing vulnerabilities, responding to cybersecurity threats, and training and evaluating our employees. The Audit Committee and management also update our Board of Directors at least quarterly on our cybersecurity performance and risk profile and the effectiveness of our cybersecurity processes. We also have protocols in place for escalating certain cybersecurity incidents to the Audit Committee and the Board of Directors.

companyName: Broadcom Inc.

ticker: AVGO


text: The CSO leads the Information Security group within Information Technology, which manages the controls designed to identify, detect, protect against, respond to and recover from cybersecurity threats and cybersecurity incidents. This group includes a cybersecurity operations team that is responsible for information technology security monitoring and incident response activities, the latter covering the response coordination to cyber-attacks under the leadership and pursuant to the direction of the CSO. The Company engages in a continuous risk monitoring process that seeks to identify the likelihood and impact of internal and external threats to our information security systems and data, and assesses the sufficiency of the controls in place to mitigate these threats to acceptable levels on a risk-based basis. The CSO and CIO together lead efforts to design, implement and operate controls deemed necessary, commensurate with the materiality and criticality of identified risks and the sensitivity of the information assets and systems used throughout the organization. Our current CSO has a bachelor's degree in Computer Information Systems and a master's degree in Cybersecurity, and has over 20 years of experience building and executing information and cybersecurity strategies. Prior to joining CNA, our CIO served in a variety of roles at another major U.S. insurance company, both in business and technology, and has over 20 years of experience working with major U.S. Property & Casualty insurers.

companyName: CNA FINANCIAL CORP

ticker: CNA


text: As of the date of this report, no cybersecurity incidents have had, either individually or in the aggregate, nor are we aware of any cybersecurity risks that are reasonably likely to have, a material adverse impact our business strategy, results of operations, or financial condition. Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. For additional discussion of the risks we face from cybersecurity threats, see risk factor titled "Our management information systems and databases could be disrupted by system security failures, cyber threats or by the failure of, or lack of access to, our Enterprise Resource Planning system. These disruptions could negatively impact our sales, increase our expenses, subject us to liability and/or harm our reputation." in Item 1A. "Risk Factors."

companyName: Boot Barn Holdings, Inc.

ticker: BOOT


text: We have implemented processes for assessing, identifying, and managing material risks from cybersecurity threats. These processes are designed to preserve the confidentiality, integrity, and availability of our information systems and the information residing therein. Our cybersecurity incident response plan is based on the NIST 800-61r2 "Computer Security Incident Handling Guide." This plan is used to process security events identified through our real-time, 24x7 monitoring, and conducts security incident tabletop exercises. The incident response plan includes detailed steps for incident leadership, escalation to established partners, response protocols based on the type of incident, responsibilities for follow-up and reporting, and steps to capture lessons learned and improvement opportunities. Our vulnerability management processes include real-time monitoring for vulnerabilities and standardized reporting for managing remediation efforts. Our cybersecurity risk management processes are integrated into our overall risk management system to ensure alignment with our business objectives and strategies. We engage assessors, consultants, auditors and other third parties to execute certification audits, penetration tests, and security framework risk assessments. These external entities provide specialized expertise and insights to enhance the effectiveness of our cybersecurity risk management processes.

companyName: EXPONENT INC

ticker: EXPO


text: Data Breaches: Unauthorized access to sensitive data, such as business strategy, financial records, or operational data, can lead to financial loss, legal repercussions, and damage to the organization's reputation. International Seaways, Inc.

companyName: International Seaways, Inc.

ticker: INSW


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, and other types of third-party service providers for critical business operations. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.

companyName: Sprout Social, Inc.

ticker: SPT


text: Within our organization, we have established a cybersecurity governance structure. This structure includes key individuals on the Company's disclosure committee responsible for detecting and reporting cybersecurity incidents and events, and our Board of Directors which is responsible for cybersecurity risk oversight, with review of IT governance and data security being the responsibility of the audit committee. Throughout the year, the Board of Directors receives briefings and assessments of the Company's risks related to IT, data governance, cybersecurity and overall data security. In furtherance of its risk oversight responsibility, the audit committee provides complaint reporting procedures for the confidential, anonymous submissions by employees and others of concerns regarding questionable accounting, auditing and any other matters. These submissions are collected by an independent organization specializing in those services, and are conveyed to the chair of the audit committee and our general counsel and chief compliance officer. Additionally, in 2022, we developed an enhanced Employee Self Service portal, designed to serve as a knowledge base where employees can log in to explore the latest IT solutions, tips and resources in addition to reviewing the status of their service request.

companyName: STERLING INFRASTRUCTURE, INC.

ticker: STRL


text: On an operating level, our cybersecurity program is managed by a dedicated Chief Information Security Officer (CISO), reporting to our Chief Information Officer (CIO), who together lead a geographically dispersed team comprised of our employees, highly skilled contractors and other key functional third-party resources. Our CISO holds a Masters of MIS in Information Security and prior to joining Ribbon, served as the Director of Information Security & Privacy at Ericsson for the Americas. Prior to Ericsson, she held cybersecurity positions at Walgreens, Fortunes Brands Home & Security, and W.W. Granger. She is a Certified Information Security Manager, has operated her own security firm, and has over 19 years of cybersecurity experience, including her time as a US Navy Operations and Training Manager. Our CIO has held that position (or Head of IT) at Ribbon for over 6 years. He has over 25 years of experience in the IT area including over eight years overseeing IT cybersecurity, cybersecurity roadmaps and IT general controls. During his career he has overseen initial ISO 27001 certifications, as well as the implementation of over 30 cybersecurity platforms. The CIO and CISO are part of our cybersecurity council, which also includes our CEO, CFO and other key leaders. The cybersecurity council meets monthly to review the cybersecurity metrics, new potential threats, and progress against the cybersecurity roadmap. Key matters from these monthly council meetings are presented to the Audit Committee.

companyName: Ribbon Communications Inc.

ticker: RBBN


text: The Committee receives regular reports from management on our cybersecurity risks. In addition, management updates the Committee on any incidents it considers to be significant or potentially significant.

companyName: Stride, Inc.

ticker: LRN


text: Management Oversight Primary responsibility for the oversight of the assessment, identification and management of our cybersecurity risks rests with our Senior Vice President, Information Technology. Under her direction, these risk mitigation efforts are designed, tested, and implemented by our Senior Director, Information Security & Infrastructure. Collectively, the Cybersecurity Leadership Team has over 50 years of experience in the field of Information Technology, holding relevant academic degrees and industry certifications, including the Certified Cloud Security Professional and Certified Information Systems Security Professional designations. The Cybersecurity Leadership Team oversees our information technology governance programs, tests our compliance with standards, remediates known risks, and leads our employee cybersecurity training program.

companyName: CubeSmart

ticker: CUBE


text: Our Chief Technology Officer ("CTO") has overall responsibility for our information technology program, which includes the Company's cybersecurity risk management program. Our Chief Information Security Officer ("CISO") is directly responsible for the Company's cybersecurity risk management program, which is designed to protect and preserve the integrity, confidentiality, and continued availability of the information owned by, or in the care of, the Company. Our CTO has over 25 years of information technology experience, including systems development, technology strategy, and vendor management; our CISO has over 30 years of information technology and cybersecurity risk management program management experience. Prior to joining Brighthouse Financial, both our CTO and CISO previously served in roles that involved leading and overseeing information technology and cybersecurity risk management programs at other public companies in the financial services industry. In addition, our CTO serves on a cross-departmental, management-level risk committee that oversees the Company's enterprise risks, including cybersecurity risks. This enterprise-level risk committee is informed about and monitors the prevention, mitigation, detection, and remediation of cybersecurity incidents.

companyName: Brighthouse Financial, Inc.

ticker: BHF


text: Board Oversight of Cybersecurity Risks The Board would be made aware of any material risks associated with cybersecurity threats. The Board currently receives periodic updates from the Company's CCO regarding the overall state of the Adviser's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.

companyName: BC Partners Lending Corp


text: Our associates receive annual, mandatory information security training, which includes information regarding specific policies and procedures and education on risks such as phishing attacks, social engineering, password management and privacy. New associates receive cybersecurity training as part of their orientation process.

companyName: Artisan Partners Asset Management Inc.

ticker: APAM


text: We maintain processes for assessing, identifying, and managing cybersecurity risks. These processes are designed to protect our information assets and operations from both internal and external cyber threats, including protecting employee and patient information from unauthorized access or attack, and to secure our networks and systems. Our cybersecurity and data privacy programs are aligned to, among others, the U.S. National Institute of Standards and Technology (NIST) Cybersecurity Framework to assess, identify and manage material risks from cybersecurity threats. We employ a combination of physical, procedural, and technical safeguards, regular system tests, incident simulations, and routine policy and procedure reviews to identify risks and enhance our practices.

companyName: Nurix Therapeutics, Inc.

ticker: NRIX


text: As part of our processes, we also engage third parties and industry experts to conduct audits and other assessments of our cybersecurity system. These assessments include vulnerability assessments, penetration testing and table-top exercises. The results of these reviews help to identify areas for continued focus, improvement and/or compliance. We also regularly evaluate our cybersecurity position against benchmarks of our peers and industry leaders, and expect our strategy and management approach to change as the general cybersecurity landscape evolves.

companyName: SEMTECH CORP

ticker: SMTC


text: Role of the Board and Management Our Board of Directors has the ultimate responsibility for oversight of our risk management framework. The Board receives information and periodic updates and actively engages with management with respect to the effectiveness of the Company's cybersecurity and information security framework, data privacy, and risk management. In addition, as necessary, the Board of Directors receives reports summarizing threat detection and mitigation plans, audits of internal controls, training and certification, and other cyber priorities and initiatives, as well as timely updates from management on material incidents relating to information systems.

companyName: Skillz Inc.

ticker: SKLZ


text: Our audit committee is responsible for overseeing our cybersecurity risk management processes, including regarding cybersecurity threats. Our CFO, Anshul Maheshwari, and Vice President of Information Technology, Michael Vedda, provide briefings to our audit committee on the effectiveness and progress of our cybersecurity risk management program on regular basis. Mr. Vedda has more than 20 years of experience and engages with trusted third-party experts for support and guidance when additional guidance is required. Prior to joining SI-BONE, he managed cybersecurity functions, where he was responsible for overseeing cybersecurity strategy and operations, including incident response, threat intelligence, security awareness training programs, risk assessments and remediation, and regulatory and compliance matters. Our board of directors receives regular reports from our audit committee chair regarding our cyber risk management programs, potential cybersecurity risks, efforts to mitigate such risks, and the audit committee's oversight of these activities.

companyName: SI-BONE, Inc.

ticker: SIBN


text: Assessing, identifying and managing cybersecurity related risks are integrated into our overall enterprise risk management (ERM) process. Cybersecurity related risks are included in the risk universe that the ERM function evaluates to assess top risks to the enterprise on an annual basis. To the extent the ERM process identifies a heightened cybersecurity related risk, risk owners are assigned to develop risk mitigation plans, which are then tracked to completion. The ERM process's annual risk assessment is presented to the Board of Directors.

companyName: LOCKHEED MARTIN CORP

ticker: LMT


text: Disclosure of the Board's Roles and Responsibilities Our Board of Directors oversees risks from cybersecurity threats using a multi-faceted approach that involves the NCG Committee and Audit Committee and various executive roles. Additionally, our Transformation and Chief Information & Digital Officer and CSO report on cybersecurity to the full Board.

companyName: T-Mobile US, Inc.

ticker: TMUS


text: Please refer to the risk factor titled "Cyber-attacks and breaches could cause operational disruptions, fraud or theft of sensitive information" in "Risk Factors" in Part I, Item 1A of this Form 10-K for more information on risks posed by cybersecurity threats to the Company.

companyName: HEALTHCARE SERVICES GROUP INC

ticker: HCSG


text: The ISP, together with related risk and compliance resources, is designed to proactively manage the risk of threat from cybersecurity incidents through (i) implementing protocols to take cybersecurity considerations into account in adopting and onboarding our technology resources, (ii) monitoring IT controls to better ensure compliance with cybersecurity and other related legal and regulatory requirements, (iii) assessing adherence by critical and material third parties we partner with to ensure that the appropriate risk management standards are met, (iv) ensuring essential business functions remain available during a business disruption, and (v) regularly developing and updating response plans to address potential IT or cyber incidents should they occur. AB's security, risk and compliance resources are designed to prioritize IT and cybersecurity risk areas, identify solutions that minimize such risks, pursue optimal outcomes and maintain compliance standards. We also rely on AB's ISP to maintain an operation security function that has a real time response capability that triages potential incidents and triggers impact mitigation protocols.

companyName: AB Private Credit Investors Corp


text: The CIO, along with the head of our Cybersecurity team, periodically reports, no less than quarterly, to our Board and our executive officers regarding the state of our cybersecurity risk management program, including information on the status of ongoing efforts to manage and mitigate cybersecurity risks, as well as recent cybersecurity trends and events and any updates to cybersecurity matters.

companyName: PBF Energy Inc.

ticker: PBF


text: Our Chief Financial Officer has served as a biotechnology executive for 20 years, whose responsibilities have included direct oversight of his companies' cybersecurity risks. Our Senior Director, Head of IT has served as an Information Technology professional for over ten years and has held senior IT positions across several companies including a large pharmaceutical company.

companyName: Cartesian Therapeutics, Inc.

ticker: RNAC


text: Compliance with industry standards and regulatory frameworks : Our information security management system is ISO 27001 certified. In addition, we align our standards to comply with South Korea's industrial technology protection law (Act on Prevention of Divulgence and Protection of Industrial Technology), which prevents technologies vital to South Korean national security or economic competitiveness from being divulged to or shared with foreign countries or corporations without the government's approval.

companyName: MAGNACHIP SEMICONDUCTOR Corp

ticker: MX


text: The Company's information technology department, including a dedicated security operations group, plays a crucial role in implementing practices aligned with the Information and Cyber Security Policy and Program requirements. Responsibilities include the maintenance and monitoring of systems, network(s), and application access and error logs, identification of unauthorized access attempts, adherence to access controls standards, configuration management, and the implementation of controls to mitigate risks related to information availability, integrity, and confidentiality.

companyName: HERITAGE FINANCIAL CORP /WA/

ticker: HFWA


text: Management's Role in Assessing and Managing Material Risks from Cybersecurity Threats Our Security Team is responsible for evaluating, reporting and advising about security threats and risks, defining and leading the enterprise security program to protect Logitech business against security threats, maintaining and updating the security framework, monitoring the level of compliance with the security framework across Logitech digital assets, products and services, providing enterprise-wide security services, defining security policies, standards and guidelines, advising on secure architectures, performing assessments and due diligence checks internally and with business partners, providing security guidance for digital projects, creating and deploying security training programs, managing security incidents and breaches, and conducting threat intelligence and managing vulnerabilities.

companyName: LOGITECH INTERNATIONAL S.A.

ticker: LOGI


text: The Company maintains cybersecurity insurance coverage in an amount that management believes to be appropriate for the Company's risk profile.

companyName: ACCO BRANDS Corp

ticker: ACCO


text: In the event of a security incident, Bancorp has developed an Incident Response Plan (IRP) to guide necessary actions. The IRP is a well-established document that is updated at least annually. It provides guidance before, during and after a confirmed or suspected security incident, outlining how to minimize the duration and damage of an incident, identifying a response team and streamlining actions to reduce recovery time.

companyName: Stock Yards Bancorp, Inc.

ticker: SYBT


text: During the fiscal year ended December 31, 2024, we did not experience any material impact to our business, financial position or operations resulting from previously identified cyberattacks or other information security incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material breaches. For a discussion of these risks, see "Item 1A—Risk Factors—Risk Related to Our Business and Industry—Our business and operations could suffer in the event of an actual or perceived information security incident such as a cybersecurity breach, system failure, or other compromise of our systems and/or information, including information held by a third-party contractor or vendor."

companyName: Xenon Pharmaceuticals Inc.

ticker: XENE


text: At Matthews, the Audit Committee of the Board of Directors is responsible for overseeing the Company's cybersecurity risk management efforts. The Company's Audit Committee regularly reviews and evaluates cybersecurity risks, the design and effectiveness of the Company's cybersecurity program, as well as its contingency plans, and the procedures and policies implemented by management to identify, manage, and mitigate such risks. The Chief Information Officer ("CIO") and CISO provide regular reports to the Audit Committee, which include information about cyber-risk management, the effectiveness of the Company's cybersecurity framework, direct or emerging threats to the Company, program maturity and strategy, third-party risk management, and benchmarking against its industry peers.

companyName: MATTHEWS INTERNATIONAL CORP

ticker: MATW


text: Role of the Board The Audit Committee of the Board of Directors is responsible for the primary oversight of our information security programs, including relating to cybersecurity. The Audit Committee receives regular reports from our Chief Product and Technology Officer, Chief Information Security Officer and the Chief Information Officer on, among other things, our cyber risks and threats, the status of projects to strengthen our information security systems, assessments of our security program, and our views of the emerging threat landscape. Our Senior Vice President and head of Internal Audit reports directly to the Audit Committee and is responsible for reporting to the Committee on our company-wide enterprise risk assessment, and that assessment also includes an evaluation of cyber risks and threats. The Chair of the Audit Committee regularly reports to the Board on cybersecurity risks and other matters reviewed by the Committee. In addition, the Board receives separate presentations on cybersecurity risk from our Chief Product and Technology Officer. Furthermore, all Board members are invited to attend each Audit Committee meeting and have access to the materials for each Audit Committee meeting.

companyName: SIRIUS XM HOLDINGS INC.

ticker: SIRI


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, our Information Technology department and third-party providers work with our senior leadership team to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business. Our senior leadership team evaluates material risks from cybersecurity threats against our overall business objectives and reports to the audit committee of our Board of Directors ("Audit Committee"), which evaluates our overall enterprise risk.

companyName: Vital Farms, Inc.

ticker: VITL


text: We implement and maintain various information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical infrastructure, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data related to our employees and customers ("Information Systems and Data").

companyName: Sprout Social, Inc.

ticker: SPT


text: We proactively address cybersecurity risk through a comprehensive cybersecurity program to identify, protect, detect, respond to, and manage any reasonably foreseeable cybersecurity risks and threats. We use a multi-faceted approach including, but not limited to, third-party assessments, internal cybersecurity audits, IT security, governance, risk, and compliance reviews. To defend, detect, and respond to cybersecurity incidents, we, among other things, require mandatory third-party cybersecurity training and testing for all employees, perform periodic user access reviews across the organization, perform penetration testing using external third-party tools and techniques to test security controls, employ multifactor authentication and biometrics login tools, take steps to verify whether vendors have appropriate cybersecurity programs, and conduct frequent security assessments to identify and remedy vulnerabilities.

companyName: MILLER INDUSTRIES INC /TN/

ticker: MLR