text: The Board and the committees of the Board oversee our risk profile and exposures relating to matters within the scope of their authority. Among other matters, the Audit Committee is charged with oversight of Resideo's risks relating to enterprise-wide cybersecurity, including review of the state of the Company's cybersecurity policies and programs and steps management has taken to monitor and control such exposures. Cybersecurity review with the CISO is a regular standing calendar item of the Audit Committee in connection with its overall ERM program oversight. In addition, our Information and Technology Committee coordinates with Audit Committee on the oversight of our product technology and software cybersecurity program. The Audit Committee and Information and Technology Committee, together with the CISO, provide the full Board with visibility into the risks that impact us and the plans to mitigate them. The CISO's reports to the committees and the Board include insights on operations, business cyber risks, emerging threats and key strategic initiatives driving improved security capabilities, and special topics around what the Company is doing to strengthen Resideo's security posture.

companyName: RESIDEO TECHNOLOGIES, INC.

ticker: REZI


text: Additionally, we work closely with the Chief Technology Officer of our subsidiary QR to oversee all aspects of cybersecurity risk management for the QRPay system.

companyName: QMIS TBS Capital Group Corp.

secItem: Item 1C


text: To date, there have been no confirmed cyber security breaches, unauthorized intrusions or threats detected within our mainframe operating systems, our encrypted e-mail servers, or our advanced firewall protections, and we have not identified risks from known cybersecurity threats, that have materially affected or that are reasonably likely to materially affect our business. However, future incidents could have a material impact on our business strategy, results of operations or financial condition. For additional discussion of the risks posed by cybersecurity threats, see "Item 1A. Risk Factors – We and our hotel managers and franchisors rely on information technology in our operations, and any material failure, inadequacy, interruption, cyber-attack or security failure of that technology could harm our business."

companyName: Lodging Fund REIT III, Inc.


text: Cybersecurity Risk Oversight Our executive management team is responsible for the development of our policies and procedures and for managing any exception to the same. In particular, our DIS oversees information security compliance, as described above. The board of directors of the Company has ultimate oversight of cybersecurity-related risk and activities, including the review and approval of our policies and procedures related to cybersecurity. The Information Security Program is approved on an annual basis. Cybersecurity risk management is also incorporated into our overall enterprise risk management model, which is updated on a quarterly basis and subject to oversight by our board of directors.

companyName: FIVE STAR BANCORP

ticker: FSBC


text: Access control is tightly managed with single sign-on, multi-factor authentication, and sensitive data access limited by least-privilege authorization appropriate for job duties and reviewed quarterly. Internal Risk Assessments are performed quarterly to identify areas of risk to mitigate or eliminate to improve security.

companyName: FOXO TECHNOLOGIES INC.

ticker: FOXO


text: Our Chief Financial Officer meets on a periodic basis with the Audit Committee of the board of directors to discuss management's ongoing cybersecurity risk management programs. Information will be provided about the sources and nature of cyber-security risks we face, how management assesses likelihood and severity of the impact of such risks, progress on any active projects as well any current developments in the cybersecurity landscape. At the Audit Committee's discretion, material findings may be escalated to the entire board of directors. The chair of the Audit Committee is a Chief Financial Officer with existing cyber-security and risk management responsibilities at a similar public company.

companyName: CERO THERAPEUTICS HOLDINGS, INC.

ticker: CERO


text: We have implemented and maintain various cybersecurity processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, trade secrets, personal information, and data of our customers (including their end-users) ("Information Systems and Data").

companyName: Fastly, Inc.

ticker: FSLY


text: Jeff Housman. Mr. Housman was appointed Chief People & Services Officer of RBI in April 2021 and previously served as Chief Human Resources Officer beginning in February 2017 as well as Head of Global Business Services from January 2015 to January 2017. Mr. Housman joined Burger King in April 2013 serving in finance, real estate and business services roles. Prior to joining Burger King, Mr. Housman worked in investment banking at J.P. Morgan, and he holds an MBA from Columbia Business School and a Bachelor's in Business Administration from Emory University.

companyName: Restaurant Brands International Limited Partnership

ticker: RSTRF


text: We maintain a comprehensive process for assessing, identifying and managing material risks from cybersecurity threats, including risks relating to disruption of business operations or financial reporting systems, intellectual property theft; fraud; violation of privacy laws and other litigation and legal risk; and reputational risk, as part of our overall risk management system and processes. We address cybersecurity risks and threats through a strategic program based on the National Institute of Standards and Technology (NIST) Cybersecurity Framework. Our dedicated cybersecurity team oversees and implements our cybersecurity management program, compliance with applicable legal and third-party data protection and data privacy requirements, and our incident response and crisis management plans.

companyName: SOMNIGROUP INTERNATIONAL INC.

ticker: SGI


text: We engage subject matter experts such as consultants and auditors to assist us in establishing processes to assess, identify and manage potential and actual cybersecurity threats, to actively monitor our systems internally using widely accepted digital applications, processes, and controls, and to provide forensic assistance to facilitate system recovery in the case of an incident. The Chief Information Security Officer oversees and establishes the parameters of our engagement with these experts to ensure we obtain the supplement assistance needed in this area, if any.

companyName: Red Rock Resorts, Inc.

ticker: RRR


text: We recognize the importance of cybersecurity in safeguarding sensitive information, maintaining operational integrity, and working to ensure the safety and efficacy of our products. We evaluate and monitor cybersecurity risk as part of our overall enterprise risk management program, which considers cybersecurity risks alongside other company risks as part of our overall risk assessment process. In addition, the risk oversight responsibility of our Board of Directors and its committees is supported by our cybersecurity risk assessment program, which includes policies and processes that are designed to provide visibility and information about the identification, assessment, and management of critical risks and management's risk mitigation strategies to our Board of Directors and personnel that are responsible for risk assessment. These policies also govern the security of our products and the protection of customer and patient data and provide for vulnerability remediation, regular system updates and patches, employee training on cybersecurity and HIPAA best practices, incident reporting, and the use of encryption to secure sensitive information. To identify, assess, and manage material cybersecurity risks, our team uses a cybersecurity risk assessment process aligned with leading frameworks such as the National Institute of Standards and Technology's Cyber Security Framework and HIPAA. Our cybersecurity risk assessment program provides the underlying basis for the activities of our team to identify and mitigate risks from, as well as develop risk management and response strategies for, evolving and emerging cybersecurity threats.

companyName: ACCURAY INC

ticker: ARAY


text: Risk Assessment: No less frequently than annually, we complete an assessment to identify potential cybersecurity threats and vulnerabilities to better prioritize and mitigate our cybersecurity risk. The assessment includes, among other things, evaluating the nature, sensitivity and location of information the Company collects, processes and stores and the resiliency of the underlying technologies, the validity and effectiveness of the Company's security policies, controls and processes and the cybersecurity preparedness of the third-party vendors used by the Company. We complete internally managed weekly vulnerability testing and monthly penetration testing. To supplement our internal assessment, we also engage third-party consultants to assess system configurations through configuration review and annual penetration testing.

companyName: VINEBROOK HOMES TRUST, INC.


text: The Technology Steering Committee is informed of risks from cybersecurity threats through regular reports from the Company's management, including our CTO. Our CTO and the CISO, who is employed by IPM, oversee our cybersecurity risk management program. The CISO is chiefly responsible for developing, maintaining, and enforcing cybersecurity and cyber risk-related policies; ensuring the Company and its subsidiaries satisfy requirements of relevant regulations, industry standards, and third-party risk assessment requirements; keeping abreast of developing security threats, and helping both the Board and the Technology Steering Committee understand potential security problems that might arise from the changing threat landscape; and overseeing and implementing regular security awareness training of all employees on cybersecurity, and supporting effective communication with users to limit security vulnerabilities. The CISO regularly reports to our CTO who reports to the Technology Steering Committee on a quarterly and more frequently as needed, on the state of our cybersecurity risk management program and provides updates on cybersecurity matters.

companyName: NewtekOne, Inc.

ticker: NEWT


text: We evaluate potential cybersecurity risks associated with third-party service providers, including through a periodic vendor security review process overseen by our Head of Cybersecurity.

companyName: Alector, Inc.

ticker: ALEC


text: Cyber criminals are becoming more sophisticated and effective every day, and they are increasingly targeting financial institutions. All companies utilizing technology are subject to threats and potential breaches of their cybersecurity programs. Any significant disruption in or unauthorized access to our computer systems or those of third parties that we utilize in our operations, including those relating to cybersecurity or arising from cyber-attacks, could result in a loss or degradation of service, unauthorized access, disclosure or destruction of data, including customer and bank information. To mitigate the threat to our business, we take a comprehensive approach to cybersecurity risk management and make securing the data customers and other stakeholders entrust to us a top priority. Our board of directors (the "Board"), through our Audit Committee, and our management, are actively involved in the oversight of our cybersecurity risk management program. As described in more detail below, we have established policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats. We have devoted significant financial and personnel resources to implement and maintain security measures to meet regulatory requirements and customer expectations, and we intend to continue to make significant investments to maintain the security of our data and cybersecurity infrastructure. There can be no guarantee that our policies, standards, processes, and procedures, and cyber security safeguards will be sufficient to protect against all possible threats and properly followed in every instance, or that those policies and procedures will be effective. Although our Risk Factors include further detail about the material cybersecurity risks we face, we believe that risks from prior cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations, or financial condition.

companyName: CVB FINANCIAL CORP

ticker: CVBF


text: Prudential Financial's information security program is overseen by the Chief Information Security Officer ("CISO") and Information Security Office, as well as the Head of Global Technology and Operations ("HGTO"). The CISO and Information Security Office are responsible for monitoring for, and informing management of, cybersecurity incidents impacting Prudential's systems. We believe that Prudential Financial's employees responsible for managing cybersecurity risk have the skills and knowledge to assess and manage the Company's material risks from cybersecurity threats, and their qualifications include degrees and certifications typical for cybersecurity professionals. We expect these employees to, among other things, understand computer systems, networks, and security technologies and be proficient in a variety of security tools and techniques. The CISO has served in various roles in information technology and information security for over 25 years, including serving as the head of information technology risk at two large public companies. The CISO holds a graduate degree in technology management and has attained the professional certifications of Certified Information Systems Security Professional and Certified Information Privacy Professional.

companyName: PRUCO LIFE INSURANCE CO


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our CIO, who is a Certified Information Systems Security Professional ("CISSP") with more than 20 years of experience leading IT and cybersecurity projects in a variety of industries.

companyName: MALIBU BOATS, INC.

ticker: MBUU


text: We perform ongoing cybersecurity awareness training for our employees that reinforces our Global Information Security policies, standards and practices. In addition, employees receive periodic newsletters emphasizing awareness of new cybersecurity threats (e.g., phishing attempts, smishing, pretexting, and deep fakes). This training is mandatory for all employees globally and is supplemented with periodic phishing tests. Additionally, we perform an annual external evaluation of our cybersecurity program using the NIST Cybersecurity Framework.

companyName: CRAWFORD & CO

ticker: CRD-A


text: Our CISO, a Certified Information Systems Security Professional, leads the Company's information security team, which has over 50 years' combined experience in providing solutions to manage information security, compliance, privacy and technology management. The Board of Directors' Technology Committee and its Enterprise Risk Management Committee (the "ERM Committee") oversee our information security team, receiving regular updates related to the material features of the information security program, our success and failures in maintaining information security and emerging threats and management's proposed response thereto.

companyName: RENASANT CORP

ticker: RNST


text: Aptiv has a risk-based cybersecurity program, dedicated to protecting our data, products and information technology systems as well as data belonging to our customers, suppliers and employees. Our ability to keep our business operating effectively depends on the functional and efficient operation of information technology capabilities, both internally and externally. Our capabilities, as well as those of our customers, suppliers, partners and service providers, are crucial to our operations and may contain confidential personal information, sensitive business-related information or intellectual property. These capabilities are also susceptible to interruptions (including those caused by systems failures, cyber-attacks and other natural or man-made incidents or disasters), which may be prolonged or go undetected.

companyName: Aptiv PLC

ticker: APTV


text: The Brighthouse Financial cybersecurity team regularly assesses the threat landscape and takes an enterprise-wide view of cybersecurity risks. We monitor issues that are internally discovered or externally reported that may affect our business, and we employ a range of tools and third-party services to effectuate our cybersecurity risk identification and assessments, including regular network and endpoint monitoring, threat and vulnerability assessments, and external penetration testing. In addition, the Brighthouse Financial cybersecurity team conducts regular reviews, conducts tabletop exercises, performs internal testing, and leverages the audits performed by our internal audit team, as well as the services of third-party consultants, to assess and evaluate the effectiveness of our controls (in alignment with the NIST framework) and to improve our security measures and strategy. The cybersecurity team has also engaged a third party to measure the Brighthouse Financial cybersecurity program against the NIST cybersecurity framework. The results of this assessment confirmed the rigor of our cybersecurity risk management practices.

companyName: BRIGHTHOUSE LIFE INSURANCE Co


text: We have processes in place designed to control access to material systems and such processes are reviewed and updated as appropriate. We utilize certain controls such as two-factor authentication, intelligent anomaly detection and centralized identity and access management tools, designed to mitigate the risk of inappropriate access to internal user accounts.

companyName: Life360, Inc.

ticker: LIF


text: Our Security Incident Response Plan is updated periodically and reviewed at least annually. This plan includes guidelines for the escalation and communication of cybersecurity incidents, including a requirement to timely report to executive leadership and the Board of Directors based on an assessment of the risk and other specified criteria. We have established a cyber incident response team to prepare for, mitigate, and remediate cybersecurity incidents, which is integrated within our enterprise crisis management framework.

companyName: Waste Connections, Inc.

ticker: WCN


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example penetration testing firms, threat intelligence service providers, cybersecurity software providers, and professional services firms, including legal counsel.

companyName: WM TECHNOLOGY, INC.

ticker: MAPS


text: We provide security awareness training to our employees so they may better understand their information protection and cybersecurity responsibilities. We also provide additional training to certain employees based on their roles.

companyName: ETHAN ALLEN INTERIORS INC

ticker: ETD


text: Our cybersecurity program is rooted in industry best practices, drawing upon frameworks established by the National Institute of Standards and Technology ("NIST"), the International Organization for Standardization, and other relevant industry standards. This does not mean that we meet any particular technical standards, specifications, or requirements, but only that we use these standards as a guide to help us design and assess our program.

companyName: OppFi Inc.

ticker: OPFI


text: We plan to strategically incorporate cybersecurity risk management into all our comprehensive risk management framework, fostering a corporate culture that prioritizes cybersecurity at all levels. This integration shall be done in stages so as to guarantee that cybersecurity factors are ingrained in our decision-making processes throughout the organization. We plan to incorporate a risk management team to collaborate closely with the IT department, consistently assessing and mitigating cybersecurity risks in alignment with our business goals and operational requirements.

companyName: Vanguard Green Investment Ltd

ticker: VGES


text: The Fund's management is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Fund, including through the receipt of notifications from service providers and reliance on communications with information technology, legal and compliance personnel of the Adviser.

companyName: Stone Point Credit Income Fund


text: Ongoing internal and external cybersecurity assessments are conducted, which include the evaluation of certain tools, procedures, and policies to measure the program's overall maturity based on the National Institute of Standards and Technology Cybersecurity ("NIST") Framework and annual compliance with the Payment Card Industry Data Security Standard to protect customer credit card data.

companyName: Burlington Stores, Inc.

ticker: BURL


text: Our cybersecurity program utilizes the National Institute of Standards and Technology framework along with risk-based analysis and judgment, to choose the most effective security controls to address potential risks. We consider various factors such as likelihood and severity of risk, impact on our organization and others if a risk materializes, feasibility and cost of controls, and the effects of controls on our operations and others.

companyName: DOLLAR TREE, INC.

ticker: DLTR


text: Our incident response plan is designed to escalate certain cybersecurity incidents, including breaches, to members of management depending on the circumstances, including our CISO, general counsel, and other members of leadership when appropriate. The security incident and response team works with relevant subject matter experts across the organization when necessary to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response plan includes reporting to the board of directors for cybersecurity incidents the Company's disclosure committee determines are material. The disclosure committee, which includes members of management such as our Chief Financial Officer and general counsel, meets quarterly. The CISO acts in an advisory capacity to the Company's disclosure committee on an as-needed basis.

companyName: Fastly, Inc.

ticker: FSLY


text: The CISO manages and is supported by a global team of risk managers, cyber defenders, architects, and engineers with the knowledge and experience to carry out day-to-day cybersecurity operations. They are also supported by third parties who provide threat intelligence, global infrastructure monitoring, and threat detection and response to cyber events. In addition, our Corporate Security team, a part of the Legal organization, has open lines of communication with various Federal, State and International law enforcement agencies to gain access to the latest cyber situational awareness.

companyName: Chemours Co

ticker: CC


text: Our overall cybersecurity risk management is overseen by the Risk Committee of our board of directors who assists our senior management and the board of directors with their overall risk management responsibilities. Our audit procedures include testing of IT and cybersecurity. Our financial reporting department ensures financial performance reliability under U.S. regulatory requirements and provides an independent objective assurance to evaluate the effectiveness of IT and cybersecurity controls and governance. The department is directly subordinate to the Audit Committee of our board of directors.

companyName: Freedom Holding Corp.

ticker: FRHC


text: Cybersecurity threats of all types, such as attacks from computer hackers, cyber criminals, nation-state actors, social engineering and other malicious internet-based activities, continue to increase generally in business and society. We believe that our current preventative actions and response planning provide adequate measures of protection against cybersecurity risks. While we have implemented measures to safeguard our information technology systems, the evolving nature of cybersecurity attacks and vulnerabilities means that these protections may not always be effective. In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents.

companyName: Salamander Innisbrook, LLC


text: Managing Material Risks & Integrated Overall Risk Management We have strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. Our procedures and security program are the guiding policies over our cybersecurity risk management. Additionally, our IT team uses the best currently available tools to help protect against cybercriminals. We leverage the latest encryption practices and cyber technologies on our systems, devices, and third-party connections and further review vendor encryption to ensure proper information security safeguards are maintained. Our employees are responsible for complying with our cybersecurity standards and complete training to understand the behaviors and technical requirements necessary to keep information secure.

companyName: OP Bancorp

ticker: OPBK


text: The Company considers management of cybersecurity and digital risk as essential for enabling success. The Audit Committee (the "Audit Committee") of the Board provides oversight of the Company's risk assessment and risk management policies and strategies with respect to significant business risks, including cybersecurity and digital risk. On a regular basis, the Audit Committee receives reports from the Company's Chief Information Security Officer ("CISO") or her representative(s) regarding the identification and management of cybersecurity risks, including when applicable, notable cybersecurity threats or incidents impacting the aviation sector or the Company, results of independent third-party assessments of the Company's cybersecurity program, key metrics, capabilities, resourcing and strategy regarding the Company's cybersecurity program and updates related to cybersecurity regulatory developments.

companyName: United Airlines Holdings, Inc.

ticker: UAL


text: Our management team, including our COO, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises our retained external cybersecurity consultants.

companyName: Galera Therapeutics, Inc.

ticker: GRTX


text: Cybersecurity Incident Monitoring The VP of Technology is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. The VP of Technology has implemented industry tools and oversees the processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the VP of Technology is equipped with a well-defined incident response plan (IRP) which is continuously enhanced. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.

companyName: Atlas Energy Solutions Inc.

ticker: AESI


text: Enterprise risk management is the responsibility of our executive management team consisting of our chief executive officer, chief financial officer, chief legal officer and our vice presidents of operations, business development and environmental, health and safety. Our executive management team meets on a weekly basis and discusses cybersecurity on an ad hoc basis when it is relevant. Our director of Information Technology, who reports directly to our chief executive officer, and our director of Internal Audit are primarily responsible for management of cybersecurity risk. Our director of Information Technology is an active ISC2 accredited member with 14 years of information technology experience, namely in developing solutions focused on private and hybrid cloud computing systems for small scale organizations. In accordance with our overall enterprise risk management process, our executive management team supervises our director of Information Technology and director of Internal Audit to assess, identify and manage material risks from cybersecurity threats. As part of this process, we rely significantly on third-party providers to assist us with our cybersecurity risk management and strategy. These providers supply ongoing services including consulting services, access to a virtual CISO, threat monitoring and detection, threat response and mitigation strategies, updates on emerging trends and developments and policy and procedure guidance. Other service providers offer targeted assistance such as security and forensic expertise on an as needed basis. We also maintain cybersecurity insurance.

companyName: Montauk Renewables, Inc.

ticker: MNTK


text: Given the varying size and complexity of the Markel Ventures businesses, a diverse array of individuals assume responsibility for managing cybersecurity risks within them. In some instances, primary responsibility may be with a member of the executive management team. In other instances, primary responsibility may land with information technology professionals. In all instances, however, ultimate responsibility rests with each business' Chief Executive Officer.

companyName: MARKEL GROUP INC.

ticker: MKL


text: Our cybersecurity risk management program includes a number of components, including information security program assessments and continuous monitoring of critical risks from cybersecurity threats using automated tools. We periodically engage third parties to conduct risk assessments on our systems, including penetration testing and other vulnerability analyses. In 2024, Plug continued to fortify its comprehensive cybersecurity and risk controls. We maintain an insider threat program designed to identify, assess, and address potential risks from within our Company and evaluate potential risks consistent with industry practices, customer requirements, and applicable law, including privacy and other considerations. We mandated an annual cybersecurity awareness training module, enhanced our Information Technology Infrastructure Library (ITIL) based discipline of change and incident management, and overhauled our monthly patching/vulnerability management rigor. Additionally, Plug continued leveraging top-tier third party support for external and perimeter examination: completing exhaustive Penetration Testing and Vulnerability Scans (performed by OrbitalFire), establishing a robust Network Operations Center (NOC), and leveraging industry-leading endpoint monitoring and detection services (CrowdStrike). Additionally, we have implemented an employee education program whereby employees are able to attend cybersecurity awareness training during the onboarding process.

companyName: PLUG POWER INC

ticker: PLUG


text: To prepare and respond to incidents, the Company has implemented a multi-layered cybersecurity program that is intended to comply with Gramm-Leach-Bliley Act 12 CFR 364, Appendix B, integrating people, technology, and processes. This includes employee training, the use of innovative technologies, and the implementation of policies and procedures in the areas of Information Security, Data Governance, Business Continuity and Disaster Recovery, Privacy, Third-Party Risk Management, and Incident Response. Juniata's objective for managing cybersecurity risk is to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse its systems or information. The cybersecurity program is built upon a foundation of advanced security technology, its internal employee team, and operations based on industry best practices recommendations from the Federal Financial Institutions Examination Council ("FFIEC") Guidelines and Cybersecurity Assessment Tool ("CAT"). This consists of controls designed to identify, protect, detect, respond and recover from information and cyber security incidents. Juniata's SVP/IT Manager and ISO, who report directly to the Board of Directors, along with key members of their teams, regularly collaborate with peer banks, industry groups, and policymakers to discuss cybersecurity trends and issues and identify best practices. The information security program is periodically reviewed by such personnel with the goal of addressing changing threats and conditions.

companyName: JUNIATA VALLEY FINANCIAL CORP

ticker: JUVF


text: To date, the Company has not identified any cybersecurity incidents which have materially affected, or are reasonably likely to materially affect, the Company's business strategy, results of operations or financial condition. The Company has not implemented any specific policies with respect to monitoring and managing cybersecurity threats. Moreover, the Company is aware of the evolution of cybersecurity risks and is taking proactive steps by keeping up to date our information systems and educating our personnel about these risks.

companyName: HAMMER TECHNOLOGY HOLDINGS CORP.

ticker: HMMR


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report, including "We, our CROs, our CMOs, our current and potential future partners and other third parties we rely on or partner with could experience a cybersecurity incident that could harm our business".

companyName: NGM BIOPHARMACEUTICALS INC


text: Cybersecurity risk management is part of the Bank's Enterprise Risk Management program, which includes specific controls for the mitigation, monitoring and reporting associated with those risks. The program is supported by a robust set of policies and procedures, skilled staff, layered technical defenses, employee training, and oversight of third parties.

companyName: Federal Home Loan Bank of New York


text: Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our executive officer is responsible for the day-to-day management of the material risks we face. Our Board administers its cybersecurity risk oversight function directly as a whole.

companyName: Vynleads, Inc.

ticker: VYND


text: The company's cybersecurity department is comprised of teams that engage in a range of cybersecurity activities such as threat intelligence, security architecture, and incident response. These teams conduct vulnerability management and penetration testing to identify, classify, prioritize, remediate, and mitigate vulnerabilities. Leaders from each team regularly meet with the Cybersecurity Leaders to provide visibility to major issues and seek alignment with strategy. As discussed above, the company's cybersecurity incident response plan includes standard processes for reporting and escalating cybersecurity incidents to senior management. Cybersecurity incidents that meet certain thresholds are escalated to the Cybersecurity Leaders and cross-functional teams on an as-needed basis for support and guidance. The company's incident response team also coordinates with external legal advisors, communication specialists, and other key stakeholders.

companyName: ImmunityBio, Inc.

ticker: IBRX


text: No risks from cybersecurity threats or previous cybersecurity incidents have materially affected our business strategy, results of operations, or financial condition. However, there can be no assurance that our controls and procedures in place to monitor and mitigate the risks of cyber threats will be sufficient and/or timely and that we will not suffer material losses or consequences in the future. Additionally, while we have in place insurance coverage designed to address certain aspects of cyber risks, such insurance coverage may be insufficient to cover all insured losses or all types of claims that may arise.

companyName: GENESCO INC

ticker: GCO


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, our information technology department works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.

companyName: LUMOS PHARMA, INC.


text: We regularly conduct comprehensive cybersecurity risk assessments to identify vulnerabilities, threats and potential impacts on our business operations and stakeholders. We actively monitor and gather threat intelligence to stay informed about emerging cyber threats and vulnerabilities relevant to our industry and operations. We engage independent third-party assessors for periodic cybersecurity program assessments against industry accepted frameworks and to perform technical penetration assessments. We assess ourselves against the Center for Internet Security Top 18 controls framework, the National Institute of Standards and Technology Cybersecurity Framework, the Payment Card Industry Data Security Standard and management defined technology controls to support our internal controls over financial reporting.

companyName: Victoria's Secret & Co.

ticker: VSCO


text: Additionally, we have procedures set forth in the DSCP for reporting and responding to potential cybersecurity incidents as well as determining applicable disclosure requirements, including timely incident reporting. For example, as disclosed in our Form 8-K filed on February 29, 2024, after being notified of the MOVEit Cybersecurity Incident, we, together with PBI, promptly launched an investigation to determine whether and to what extent personal information had been unlawfully accessed as a result of that incident. We determined that approximately 2.5 million to 2.7 million of our policyholders' or other customers' personal information, including social security numbers, was exposed to and obtained by the threat actor as a result of the MOVEit Cybersecurity Incident. We do not believe the MOVEit Cybersecurity Incident has had any impact on any of our information systems, including our financial systems, and there has not been any material interruption of our business operations. While we are continuing to measure the impact of remediation expenses and other potential liabilities, neither this incident, nor other known cybersecurity threats, has had or is reasonably likely to have a material adverse effect on our business strategy, results of operations or financial condition.

companyName: GENWORTH FINANCIAL INC

ticker: GNW


text: With respect to third-party service providers, we obligate our vendors to adhere to privacy and cybersecurity measures through various contractual provisions to the extent possible, and we perform risk assessments of vendors as appropriate from time to time, which includes a vendor's ability to protect data from unauthorized access. As described in Item 1A "Risk Factors," our operations rely on the secure processing, storage and transmission of confidential and other information in our computer systems and networks. Computer viruses, hackers, employee or vendor misconduct and other external hazards could expose our information systems and those of our vendors to security breaches, cybersecurity incidents or other disruptions, any of which could materially and adversely affect our business, including the loss of customer confidence, reputational harm, our operating results and our financial condition. While we have experienced cybersecurity incidents, to date, we do not believe that we have experienced a material cybersecurity incident during the fiscal year ended December 31, 2023.

companyName: Gogo Inc.

ticker: GOGO


text: Our information security team, comprised of employees with an expertise in cybersecurity and information technology, regularly assesses the threat landscape and takes a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, detection and response. Our information security team annually performs a cybersecurity enterprise risk assessment and presents the results to management and the Audit Committee. In addition, our internal audit team conducts periodic audits of the Company's systems and cybersecurity processes, with findings reported to the Audit Committee and senior management.

companyName: ALIGN TECHNOLOGY INC

ticker: ALGN


text: Management is responsible for implementing and maintaining the Company's cybersecurity policies, programs, and controls, and for reporting to the Board on material developments and significant incidents. Updates to the Board occur at least annually and more frequently as needed in the event of notable changes in the threat environment or incidents requiring attention.

companyName: DevvStream Corp.

ticker: DEVS


text: We maintain a cybersecurity risk management program to identify, assess and manage material risks from cybersecurity threats and to protect the confidentiality, integrity and availability of our critical systems and information.

companyName: JANUS HENDERSON GROUP PLC

ticker: JHG


text: The Company's cybersecurity program, including our information security policies, is designed to align with regulatory guidance and industry practices. To protect our information systems, network, and information assets from cybersecurity threats, we use various security tools, products and processes that help identify, prevent, investigate, and remediate cybersecurity threats and security incidents.

companyName: SEACOAST BANKING CORP OF FLORIDA

ticker: SBCF


text: Our Information Assurance Program addresses the security of information systems and data networks owned or used by us and the information stored, transmitted, or processed by those systems and networks. It defines responsibilities concerning information systems security as well as a uniform approach that promotes information systems security throughout the Company.

companyName: RESOURCES CONNECTION, INC.

ticker: RGP


text: The Bank is subject to ongoing cybersecurity incident and threat risk. A cybersecurity incident is an unauthorized occurrence, or a series of related unauthorized occurrences, through the Bank's information systems that jeopardizes the confidentiality, integrity, or availability of the Bank's information systems or any information residing therein. Cybersecurity threats are potential unauthorized occurrences on or conducted through the Bank's information systems that may result in adverse effects on the confidentiality, integrity, or availability of information systems or any information residing therein. Information systems are any electronic information resources, owned or used by the Bank, including physical or virtual infrastructure controlled by such information resources, or their components, organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of the Bank's information to maintain or support the Bank's operations. Please refer to "Risk Factors — Failure, breach, or cyberattack of the information systems of the FHLBNY could disrupt the FHLBNY's business or result in significant losses or reputational damage" in Part I, Section 1A of this Form 10-K for a description of cybersecurity incident and threat risk. The Bank has implemented processes for assessing, identifying, and managing material risks from cybersecurity threats or incidents that may directly or indirectly impact the Bank's business strategy, results of operations, or financial condition.


text: The Company's information security efforts are led by our Executive Vice President, Chief Technology Officer ("CTO") and our Director of Information Security ("IT Director"), supported by our executive management team. These efforts are designed to address information security governance and risk, product security, identification and protection of critical assets, third-party risk, security awareness, cyber defense operations, artificial intelligence and data protection governance, and related risk management matters. Our CTO and IT Director have an average of over 25 years of prior work experience in various roles involving information technology, including security, auditing compliance, systems and programming. These individuals have relevant educational and industry experience, including holding similar positions at other large companies.

companyName: Simpson Manufacturing Co., Inc.

ticker: SSD


text: We work with third parties from time to time that assist us to identify, assess, and manage cybersecurity risks, including professional services firms, threat intelligence service providers, cybersecurity consultants, cybersecurity software providers, managed cybersecurity service providers, penetration testing firms and other vendors that help to identify, assess, or manage cybersecurity risks.

companyName: BICYCLE THERAPEUTICS PLC

ticker: BCYC


text: Our Board recognizes the importance of maintaining the trust and confidence of our customers, consumers, employees and other stakeholders and oversees cybersecurity matters. Management plays a central role in our information security program, which is a critical component of our enterprise risk management and includes the implementation of controls generally aligned with industry best practices and applicable frameworks to identify threats, deter attacks and protect our Company assets. We also include cybersecurity training as part of our mandatory, periodic employee training program. In addition, we engage a range of cybersecurity experts, including cybersecurity auditors, assessors, and consultants, in evaluating and testing our risk management systems. These partnerships enable us to leverage specialized knowledge and insights to help ensure that our cybersecurity strategies and processes remain in line with industry best practices. Our collaboration with these third parties includes regular audits, threat assessments, and consultations on security enhancements.

companyName: Monster Beverage Corp

ticker: MNST


text: The processes described above have not indicated, as of the date of this Annual Report on Form 10-K, any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that we believe have materially affected us in the year ended December 31, 2023 or are reasonably likely to materially affect our company, including its business strategy, results of operations, or financial condition.. For more information on our cybersecurity risks, see the section of this Annual Report on Form 10-K entitled "Risk Factors—We rely on our IT systems to manage numerous aspects of our business. A cyber-based attack of these systems could disrupt our ability to deliver services to our customers and could lead to increased overhead costs, decreased sales, and harm to our reputation."

companyName: Bridger Aerospace Group Holdings, Inc.

ticker: BAER


text: Our information security controls operate at multiple levels and are designed to detect, prevent, and mitigate cybersecurity threats that could impact the privacy and security of our data and our customers' data. To operate at scale, we have automated several risk mitigation strategies. We have implemented comprehensive trust and safety processes to help prevent and detect suspicious and fraudulent behavior on our platform. Over the years of developing our work marketplace, we have developed and refined specific pattern-matching algorithms to detect unusual behavior on our work marketplace, and we continue to improve such algorithms in the evolving threat landscape. We also regularly update our information security policies, standards and processes as needed to better reflect and account for updates in our cybersecurity posture, cybersecurity risks, and our risk mitigation strategies. We provide regular, mandatory training for our personnel regarding cybersecurity threats as a means to equip our personnel with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices.

companyName: UPWORK, INC

ticker: UPWK


text: Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us from time to time to review and assess our cyber programs and policies; and alerts and reports produced by security tools deployed in our IT environment. In addition, our Chief Financial Officer, Chief Technology Officer and Chief Legal Officer are members of our internal Cybersecurity Governance Committee, chaired by the Senior Director of Cybersecurity, a management committee comprised of leadership from primary corporate functions including Finance, Human Resources, Information Technology, Engineering, Internal Audit and Legal, which meets quarterly to drive alignment on security decisions across the Company, including reviewing security performance metrics, identifying security risks, and assessing the status of approved security enhancements.

companyName: FuboTV Inc.

ticker: FUBO


text: Our CISO has primary responsibility for our cybersecurity program and the management and oversight of our information security department. Our CISO has nearly 25 years of experience in information technology, including 14 years of cybersecurity experience, all of which has been in the property and casualty insurance industry. We have a diverse information security team with varying backgrounds, years of experience and levels of information security certification. Our CISO reports directly to our CIIO, who reports directly to our Chief Executive Officer ("CEO"). The CISO and CIIO routinely inform and advise executive management of salient aspects of our cybersecurity program, and developments related to key risks, threats and data incidents, addressing in further detail the matters noted above that are reported to the Audit Committee. Members of the information security team participate in our Enterprise Risk Management Group consisting of senior leaders who meet regularly to assess new and emerging risks to the organization, including cybersecurity risks.

companyName: HANOVER INSURANCE GROUP, INC.

ticker: THG


text: We engage certain external parties to enhance our cybersecurity processes and strategies. Depending on the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, we evaluate the security and risk posture according to the perceived level of risk and in accordance with industry standard best practices.

companyName: CarGurus, Inc.

ticker: CARG


text: Our enterprise-wide cybersecurity program is managed by a dedicated information security team, led by our CIO. Our CIO has more than 25 years of technology experience across various disciplines, including nearly 15 years of experience as a CISO in the financial, manufacturing, and the consumer packaged goods industries. He has led our global information security organization for almost four years. In addition to his employment experience in the cybersecurity field, our CIO has a Master of Computer Systems and a Bachelor's Degree in Accounting, and he has served on corporate and industry advisory boards related to cybersecurity, all of which have provided him with skills and experience to manage our global information security function. Our CIO regularly meets with other members of our executive team and provides relevant updates on our cybersecurity program.

companyName: Spectrum Brands Holdings, Inc.

ticker: SPB


text: Evaluation, Categorization, and Escalation of Cybersecurity Incidents Our information security program includes an incident response plan, which establishes (1) a framework for classifying security incidents according to their severity level, taking into account the nature and scope of the incident; and (2) protocols for the escalation of incidents, including to the attention of the Technology Committee as appropriate. The incident response plan is approved annually by the board of directors. We maintain a Global Security Operations Center ("GSOC"), staffed 24/7, and a Global Critical Incident Management ("GCIM") team, and the roles and responsibilities of the GSOC and GCIM in the incident response context are established by the incident response plan, as well as in associated playbooks and other procedural documentation. On an annual basis, we retain an outside consultant to develop and administer a simulation of a cybersecurity incident designed to test our response capabilities and capacity for effective cross-functional coordination in the wake of an incident and to inform management and the Technology Committee of the results of the exercise. We maintain a business resiliency program, overseen by BRG, that is designed to facilitate our ability to respond, recover and resume services in the event of an incident that causes an operational disruption.

companyName: GLOBAL PAYMENTS INC

ticker: GPN


text: Cybersecurity is a top priority for us and we are dedicated to continuously improving our cybersecurity posture to protect our systems and data from evolving threats. By implementing robust governance, policies, technologies, and compliance measures, we strive to maintain the trust and confidence of our stakeholders in our ability to safeguard their information. Pursuant to the Company's cybersecurity policy, the Board will be promptly notified of any material cybersecurity incident required to be disclosed under Item 1.05 of Form 8 -K and shall oversee the Company's response to such matter.

companyName: HG Holdings, Inc.

ticker: STLY


text: Annually the Company conducts an Enterprise Risk Assessment during which management identifies and quantifies risks to the Company's operations, financial position and strategy, including cybersecurity risks. The conclusions of the annual Enterprise Risk Assessment are shared with the Audit Committee. Working with the CIO and the Vice President, Information Security, the Audit Committee periodically reviews the strategy, priorities, and goals of the cybersecurity program and the CIO and Vice President, Information Security, provide regular updates to the Audit Committee.

companyName: GRAPHIC PACKAGING HOLDING CO

ticker: GPK


text: Technical Safeguards: Technical safeguards designed to protect the Fund's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.

companyName: RIDGEWOOD ENERGY A-1 FUND LLC


text: We also strategically partner with third-party cybersecurity consultants, assessors, and auditors in evaluating and testing our cybersecurity risk management processes and controls. These strategic partnerships are catalysts for the continuous improvement of our cybersecurity risk management posture. Through audits, threat assessments, and collaborative brainstorming sessions on cybersecurity enhancements, these collaborative partnerships help us bridge knowledge gaps, identify best practices and refine our cybersecurity strategies and processes. Further, we leverage these partnerships to identify cybersecurity vulnerabilities and weaknesses and improve our cybersecurity posture.

companyName: MeridianLink, Inc.


text: We also employ a variety of preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on suspected advanced persistent threats. We have established processes and systems designed to mitigate cyber risk, including regular and on-going education and training for employees, preparedness simulations and tabletop exercises, and recovery and resilience tests. We engage in regular assessments of our infrastructure, software systems, and network architecture, using internal cybersecurity experts and third-party specialists. We also actively monitor our email gateways for malicious phishing email campaigns and monitor remote connections as a significant portion of our workforce has the option to work remotely.

companyName: Northwest Bancshares, Inc.

ticker: NWBI


text: Our enterprise security team monitors and manages system infrastructure to protect the Firm against cyber threats. Our Cyber Risk Management program considers risks from many sources including, but not limited to, alerts, threat intelligence sources, risk assessments, and vulnerability management. Our Cyber Risk Management process includes risk assessment processes to identify risks, a risk evaluation process that includes risk acceptance or denial at all levels of the organization, and third-party vendor management where each vendor's security posture is assessed to understand how it strengthens Kforce's cyber supply chain. We have taken a comprehensive defense-in-depth approach to the implementation of our cybersecurity controls. These controls are set to block and/or provide alerts on suspicious activities. Our around-the-clock security operation center responds as appropriate to risks identified and performs the risk assessment and risk evaluation. Our risk register and risk remediation processes help us ensure we are tracking and addressing priority risks, as appropriate. Any potential risks or threats identified by the enterprise security team are communicated to the CISO, Information Security and Data Privacy Council and other senior leaders as appropriate.

companyName: KFORCE INC

ticker: KFRC


text: Rubicon's cybersecurity program is managed by a dedicated team lead by our Vice President of Cybersecurity, who is responsible for deploying and maintaining cybersecurity operations through the use of people, processes, and technology. Rubicon's cybersecurity team leverages industry standards and industry-recognized best practices. Any incident, either assumed or actual, is escalated for further review as soon as practicable, and then reported to designated members of the executive leadership team pursuant to Rubicon's established incident management procedures.

companyName: Rubicon Technologies, Inc.


text: The CDIO has served in various roles in information technology for over 25 years, holds undergraduate and graduate degrees in electrical and electronics engineering and computer science, and brings significant insights into cybersecurity strategies. The CISO has served in various roles in information security for over 30 years, including serving as a CISO of four public companies. The senior members of the information security group who report to the CISO have extensive experience in technology and security roles from serving with several large public companies and possess cybersecurity certifications, including Certified Information Systems Security Professional, Certified Information Security Manager, and Certified Information Systems Auditor, among others.

companyName: LOWES COMPANIES INC

ticker: LOW


text: Our CISO is responsible for assessing and managing our material risks from cybersecurity threats. Our CISO has primary responsibility for leading our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our external cybersecurity service providers. Our CISO has significant experience in managing and leading IT and cybersecurity teams. Prior to joining the Company, he served as the chief technology officer and cofounder of a company specializing in cybersecurity services and software. Our CISO reports directly to our CTO who has over twenty years of experience in technology and IT including roles at large global companies.

companyName: Playtika Holding Corp.

ticker: PLTK


text: Cybersecurity Governance, Risk Management and Strategy In the current digital environment, companies like ours may be the target of cyber-attacks or other malicious efforts to cause a cyber incident. These cyber incidents can include, but are not limited to, gaining unauthorized access to digital systems for purposes of misappropriating assets or sensitive information, corrupting data or causing operational disruption. The possible consequences of such an attack include but are not limited to loss of data, damage to the Company's reputation, interruptions to our operations, and/or the need to pay ransom. Historically, we have not experienced cybersecurity incidents that materially impacted our business strategy, operating results and financial condition but we cannot guarantee a future cybersecurity incident would not materially impact us.

companyName: NEXSTAR MEDIA GROUP, INC.

ticker: NXST


text: Any failure to protect our information technology infrastructure and our products against cyber-based attacks, network security breaches, service interruptions or data corruption could materially disrupt our operations and harm our business. Our cybersecurity risk management program includes: periodic risk assessments annual security assessment and penetration testing;

companyName: Anteris Technologies Global Corp.

ticker: AVR


text: Board members are regularly educated on cybersecurity issues through presentations from our Chief Information Security Officer (CISO) and internal security team. External experts may also be consulted to provide additional insights or reports when necessary.

companyName: KALTURA INC

ticker: KLTR


text: To date, there have been no material cybersecurity incidents that have significantly impacted the Fund's business strategy, results of operations, or financial condition. The Sponsor continue to monitor our systems and processes to mitigate potential cybersecurity risks actively.

companyName: Dynamic Shares Trust


text: Cybersecurity threats, a security strategy roadmap, and key risk indicators are shared with management and the board of directors through both committee reporting structures and periodic reports of the Chief Security Officer. In addition, management updates our Enterprise Risk Management Committee, as necessary, regarding significant cybersecurity incidents. Our Enterprise Risk Management Committee regularly reports to the full Board of Directors regarding its activities, including those related to cybersecurity. As part of the Enterprise Risk Management Framework, cybersecurity oversight also utilizes the concept of three lines of defense which allows for multiple challenge response processes to continually mature the cybersecurity program. Cybersecurity best practices from the National Institute of Standards and Technology ("NIST") and the Center for Internet Security ("CIS") are used to establish, operate, and validate security controls.

companyName: WESBANCO INC

ticker: WSBC


text: For additional information regarding whether any risks from cybersecurity threats are reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors—Intellectual Property and Cybersecurity Risks," in this Annual Report on Form 10-K.

companyName: Fabrinet

ticker: FN


text: We incorporate technical safeguards such as Multi-Factor Authentication ("MFA"), principles of Zero Trust and password complexity policies for all accounts to help prevent unauthorized access to our systems and data. Additionally, we utilize XDR (Extended Detection and Response) installed on endpoints, along with our Security Operations Center ("SOC") to manage real-time endpoint protection monitoring.

companyName: HELIOS TECHNOLOGIES, INC.

ticker: HLIO


text: Our cybersecurity program takes a risk-based approach and was developed to align with ISO 27001, the international standard for information security, and we also assess ourselves against the NIST Cybersecurity framework. In addition, our cybersecurity risk management program aligns with ISO 31000, the international standard for risk management. The foregoing does not imply that we meet any technical standards, specifications or requirements, or that we have been certified on these requirements in any respect, only that we have used these industry standards as guides when designing our cybersecurity and risk management programs.

companyName: JANUS HENDERSON GROUP PLC

ticker: JHG


text: We rely extensively on information technology, much of which is managed by third-party service providers (such as cloud data service providers), to support a variety of business processes and activities, including: complying with regulatory, legal, financial reporting and tax requirements; engaging in marketing and e-commerce activities; managing and improving the effectiveness of our operations; researching, developing, manufacturing and distributing our products; collecting and storing sensitive data and confidential information; and communicating with employees, investors, suppliers, trade customers, adult tobacco consumers and others. Recognizing the critical importance of cybersecurity in today's digital landscape, we are committed to safeguarding our information assets, protecting consumer data and maintaining the integrity and availability of our systems. Accordingly, we have implemented an extensive cybersecurity risk management framework designed to identify, assess, mitigate and prevent potential cybersecurity risks and to align with industry best practices and all applicable regulatory requirements. We leverage the National Institute of Standards and Technology ("NIST") Cybersecurity Framework and industry best practices to identify and prioritize cybersecurity risks based on their potential impacts. We also use the NIST framework and industry best practices to drive enhancements to our program that are designed to protect our assets and third-party partners. The NIST framework also helps us maintain ongoing compliance with regulatory requirements. We align our security standards for infrastructure configuration with the Center for Internet Security's Benchmarks, which are prescriptive recommendations based upon the consensus of global cybersecurity experts.

companyName: ALTRIA GROUP, INC.

ticker: MO


text: As of December 31, 2023, the Company was not aware of (i) any cybersecurity incidents, or (ii) any specific cybersecurity threats, that, in either case, materially affected or are reasonably likely to materially affect the business, strategy, results of operations, or financial condition of the Company. However, we can provide no assurance that there will not be cybersecurity threats or incidents in the future or that they will not materially affect PSE, including our business, strategy, results of operations, or financial condition. For more information regarding risk from cybersecurity threats, see Item 1A. "Risk Factors" included in this report.

companyName: PUGET ENERGY INC /WA


text: Our comprehensive incident response and recovery plans are designed to manage the aftermath of cybersecurity incidents. Regular testing and evaluation of these plans ensure preparedness and resilience.

companyName: WIDEPOINT CORP

ticker: WYY


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Fund are assessed on an ongoing basis, and how such risks could materially affect the Fund's business strategy, operational results, and financial condition are regularly evaluated as part of the Adviser's program. During the reporting period, the Fund has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Fund believes have materially affected, or are reasonably likely to materially affect, the Fund, including its business strategy, operational results, and financial condition.

companyName: Stone Point Credit Income Fund


text: In designing and evaluating our cybersecurity program, we have adopted the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF 2.0") as a guiding principle. It is important to clarify that our use of the NIST CSF 2.0 is for guidance purposes to frame our risk identification, assessment, and management processes and does not equate to compliance with any specific technical standards or requirements.

companyName: Onconetix, Inc.

ticker: ONCO


text: The Audit Committee is responsible for evaluating the Company's major financial risk exposures and the steps management has taken to monitor and control such exposures. The Audit Committee's charter also requires it to discuss guidelines, policies and steps to govern the process by which risk assessment and management is undertaken (including risks related to information security, cybersecurity and data protection) and the establishment and management of appropriate systems to manage such risks. The Audit Committee reviews cybersecurity risks through quarterly reports from the CISO, and monitors the status of existing information security controls and practices to mitigate the potential risk from evolving cybersecurity threats. Regular reports on cybersecurity threats, assessments, and findings are also provided by the CISO to senior management and relevant teams.

companyName: Skillsoft Corp.

ticker: SKIL


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including those in our supply chain or who have access to our customer and employee data or our systems. Third-party risks are included within our enterprise risk management assessment program as well as our cybersecurity risk identification program, both of which are discussed above and provided for in our Third-Party Cyber Risk Policy. The Third-Party Cyber Risk Policy sets guidelines for identifying, measuring, monitoring, and reporting the risk associated with third parties relationships, which includes planning, due diligence and third party selection, contracting, ongoing monitoring, and termination. Cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third-parties that have access to our systems, data or facilities that house such systems or data, and monitor cybersecurity threats identified through such diligence.

companyName: Warner Music Group Corp.

ticker: WMG


text: APS's cybersecurity group (the "Cybersecurity Group") is comprised of cybersecurity analysts, engineers, architects, and others, led by the Director of Cybersecurity, who reports to APS's Vice President, Operations Support. The Director of Cybersecurity has more than twenty years of experience in information technology and cybersecurity roles, with more than ten of those years at the Company. The Director of Cybersecurity also holds cybersecurity certifications from multiple certifying bodies and is active in utility cybersecurity professional organizations. The Cybersecurity Group has day-to-day responsibility for safeguarding the Company's critical assets and assessing, identifying, and managing material risks from cybersecurity threats.

companyName: ARIZONA PUBLIC SERVICE CO


text: To manage cybersecurity risks related to third-party service providers, we plan to conduct security assessments of certain third-party providers before engagement and will establish monitoring procedures related to data breaches or other security incidents originating from third parties. To assist in this effort, we may from time to time engage third-party consultants, legal advisors, and audit firms to evaluate and test our risk management systems and assess and remediate certain potential cybersecurity incidents as appropriate.

companyName: Revelyst, Inc.


text: Our cybersecurity incident response and vulnerability management processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our CISO and our Nominating and Governance Committee Chair and members. These officials work with the Company's incident response team to help the Company mitigate and remediate any cybersecurity incidents of which they are notified. In addition, the Company's incident response and vulnerability management processes include reporting to the Nominating and Governance Committee of the board of directors for certain cybersecurity incidents.

companyName: Enovix Corp

ticker: ENVX


text: Risk Assessment and Management Our Information Security Program is led by our CISO and overseen by our TIRC and Management Risk Committee. The program is designed to safeguard the confidentiality, integrity and availability of information assets of the Company, customers and users from harm, and against unauthorized access to, or use of, computer resources that process, store or transmit these assets. This is accomplished by monitoring the cyber threat landscape, internal threats and technological changes and through the implementation of controls to mitigate risk to the organization and our customers.

companyName: Discover Financial Services


text: We engage external parties, including consultants, network security firms and other experts, to help us assess and enhance our cybersecurity oversight. For example, we have hired an external security vendor to conduct penetration and vulnerability testing on our networks and receive regular updates about industry cyber risks.

companyName: KADANT INC

ticker: KAI


text: Our global reach and the ever-evolving threat landscape makes data security and privacy a critical priority for us. Our Director of Cybersecurity and Technology Risk Management and their global cybersecurity team reports to our Chief Technology Officer and together, they are responsible for our network security, cybersecurity risk management processes, and business continuity. This team partners with leaders from all of our global regions to align our cybersecurity risk management processes and strategic goals with our business priorities and to ultimately mitigate cybersecurity risk at C.H. Robinson.

companyName: C. H. ROBINSON WORLDWIDE, INC.

ticker: CHRW


text: To further cybersecurity awareness among our employees and contractors, we leverage formal mandatory training and incorporate other training and educational opportunities. We also maintain a cybersecurity incident response plan to guide our detection, response to, and recovery from cybersecurity incidents, which includes processes for assessing the severity of, escalating, containing, investigating and remediating incidents, as well as complying with legal and regulatory obligations and mitigating reputational impacts. We test our cybersecurity incident response and disaster recovery plans through an annual, scenario-based tabletop exercise. We also have processes and technologies to provide redundant computing and backup operations should a cyber incident occur that requires a full or partial data center recovery.

companyName: MARATHON OIL CORP


text: Sculptor's cybersecurity risk management and awareness programs include periodic identification and testing of vulnerabilities, regular phishing simulations and annual general cybersecurity awareness training, including for all of the employees of Sculptor. Sculptor undertakes periodic internal security reviews of its information systems and related controls, including systems affecting personal data and the cybersecurity risks of Sculptor's and our critical third-party vendors and other partners. Sculptor also completes periodic external reviews of its cybersecurity program and practices, which include assessments of relevant data protection practices and targeted attack simulations.

companyName: Sculptor Diversified Real Estate Income Trust, Inc.


text: Our Information Security team oversees our cybersecurity program, which is described in more detail above. In conjunction with the Company's in-house legal team, this team is principally responsible for managing our cybersecurity risk management program, our security controls, and our response to cybersecurity threats, and incidents.

companyName: Compass, Inc.

ticker: COMP


text: The Board of Directors oversees the Company's ERM program, including the management of risks arising from cybersecurity threats. On an annual basis, the Board of Directors discusses the Company's approach to cybersecurity risk management with the CIO. The Board of Directors also receives regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties.

companyName: Callon Petroleum Co


text: Our cybersecurity program is designed to assess, identify, and manage cybersecurity risks and threats. Key components of our cybersecurity program include: • managing cybersecurity threats by deploying technical safeguards that are designed to protect our information systems from cybersecurity threats, which we evaluate and seek to improve, including through vulnerability assessments and cybersecurity threat intelligence; • maintaining cybersecurity incident management procedures to address incident reporting, classification, escalation, response, and recovery, and facilitate efficient and consistent management of cybersecurity incidents involving our information systems; • assessing and testing our cybersecurity policies and practices via internal efforts (such as assessments, vulnerability testing, threat modeling, tabletop exercises, and other exercises focused on evaluating the effectiveness of our cybersecurity measures) and by engaging third parties (including cybersecurity consulting firms) to perform assessments of our cybersecurity measures; • a third-party cybersecurity risk management process, including, among other things, a security assessment and contracting process for vendor applications and implementing contractual security measures with third-party vendors; and • cybersecurity awareness training for all employees and enhanced training for certain employees.

companyName: ROKU, INC

ticker: ROKU


text: The Board of Directors has overall oversight of key risks, with strategic oversight of cybersecurity risk management delegated to the Audit Committee. Annually, the Audit Committee reviews the Company's enterprise risk management, which includes cybersecurity. In fiscal year 2024, the Audit Committee established an IT Audit Subcommittee to enhance focus on IT-related internal controls and cybersecurity. The Board and Audit Committee have appointed one of the members of the Audit Committee to sit on the IT Subcommittee. This subcommittee meets quarterly with key company leaders to review cybersecurity risks and audit findings and reports regularly to the Audit Committee.

companyName: STAR GROUP, L.P.

ticker: SGU


text: Cybersecurity is an important part of our risk management processes and is an area of focus for our Board, Chief Information Officer ("CIO") whom reports to the Chief Executive Officer, and management team. Our CIO plays a pivotal role in assessing and managing material risks stemming from cybersecurity threats and is primarily responsible for the oversight of our overall cybersecurity risk management program, and coordinates with our external cybersecurity consultants. Additionally, given that cybersecurity risks can impact various areas of responsibility of the Committees of the Board, our Board of Directors oversees cybersecurity risk management and regularly reviews our cybersecurity strategy and initiatives. The Board receives quarterly and as needed updates on cybersecurity matters from the CIO and management.

companyName: Tilray Brands, Inc.

ticker: TLRY


text: Cybersecurity oversight and related risk-management activities are currently led by the CIO, who has more than 20 years of experience in information technology, cybersecurity governance, and enterprise-risk management. The CIO has implemented defense-in-depth cybersecurity frameworks and controls aligned with industry standards such as COBIT and ITIL and has regularly reported on cybersecurity risks and mitigation activities to boards of directors and audit committees throughout his career. Management is informed about cybersecurity risks through ongoing monitoring and reporting processes, including real-time incident dashboards, periodic risk assessments, and collaboration with internal and external cybersecurity experts. The CIO provides updates on cybersecurity risks, incident response readiness, and mitigation efforts to executive leadership and Fluence's board of directors through the Audit Committee as part of the Company's enterprise-risk-management program.

companyName: Fluence Energy, Inc.

ticker: FLNC


text: The Company's Board of Directors oversees risks from cybersecurity threats. Oversight includes quarterly or as needed reporting from the CISO on the overall cybersecurity risk reduction program maturity, emerging and current cybersecurity risks, and the cybersecurity threat landscape.

companyName: HAWAIIAN ELECTRIC INDUSTRIES INC

ticker: HE


text: The audit committee assists the Board in fulfilling its oversight responsibility with respect to, among other things, enterprise risk management, including information technology and cybersecurity risks. In performing these functions, the audit committee meets regularly with our management to review any significant risks or exposures. Pursuant to the Incident Response Plan, our Incident Response Team is responsible for our incident handling capability, which includes preparation, detection, analysis, containment, eradication, recovery, and follow-up capabilities in response to cybersecurity incidents. The Incident Response Team is led by the CISO and includes management from the Administration, Legal, Information Security and Technology, Physical Security and Facilities Management, Communications and Public Relations and Human Resources fields. When required, or if otherwise appropriate, management informs the Board and/or Board committee of any cybersecurity incidents. The CISO conducts semi-annual meetings of the Incident Response Team to review and document compliance with the Incident Response Plan. In collaboration with the Incident Response Team, the CISO reviews and updates the Incident Response Plan as necessary annually. In addition, the Chair of the Audit Committee conducts an annual review of the Incident Response Plan.

companyName: DOC DR Holdco, LLC


text: Our cybersecurity risk management program leverages trusted technology partners and solutions in an effort to identify and track key cybersecurity risks. This program includes period security assessments conducted in collaboration with our key stakeholders, penetration testing and vulnerability assessments, and a mandatory cybersecurity training program for employees. To manage cybersecurity incidents, our global security operations team maintains a cybersecurity incident response plan, conducts readiness exercises, and takes steps to improve the program, as appropriate, to manage the changing threats faced in our industry.

companyName: Anika Therapeutics, Inc.

ticker: ANIK


text: The Company's Chief Information Officer is responsible for developing and implementing our information security program. Our Information Security team monitors our exposure to external cybersecurity threats, leveraging automated tools and manual processes to ensure cybersecurity risk is effectively mitigated on a continuous basis. When a specific incident has been identified, the Information Security team leverages our Cyber Incident Response Plan in conjunction with established Information Security policies to begin assessment of the incident. Depending on the type and/or severity of the incident, our Information Security team will determine (in compliance with our Cyber Incident Response Plan) whether third party expertise or consultation is necessary. If such expertise or consultation is determined to be necessary, our Information Security and Corporate Legal teams will engage with third-party experts. As part of its review of incidents, our Information Security team considers the risk exposure, potential impact, severity and implications with respect to our information technology systems. Our Information Security team is responsible for escalating incidents which are determined to be higher risk to our Cyber Event Disclosure Committee. The Cyber Event Disclosure Committee will work with our General Counsel to determine the materiality of the incident and any required disclosure. When an incident is determined to be material and is required to be disclosed, the Cyber Event Disclosure Committee will notify our senior leadership and our Board of Directors through the Audit Committee of our Board of Directors. The Cyber Event Disclosure Committee will collaborate with our Corporate Legal and Financial Reporting teams to develop any required Form 8-K Item 1.05 disclosure.

companyName: REVVITY, INC.

ticker: RVTY


text: Security Training and Awareness. We provide ongoing education and training to employees regarding cybersecurity threats and the role they play in helping prevent and detect these threats. This includes regular phishing simulations, with training provided for any failures, as well as periodic communications via the internal company portal concerning threats, best practices, and technology changes to improve security. We also work with the Company marketing department to periodically publish articles on our website to raise security awareness with our customers.

companyName: Tectonic Financial, Inc.

ticker: TECTP


text: We use a multi-layered defensive cybersecurity strategy based on the cyber security framework drafted by the U.S. Department of Commerce's National Institute of Standards and Technology (NIST). The NIST Cybersecurity Framework (NIST CSF) is a voluntary framework of best practices to identify, protect, detect, respond to, and recover from cybersecurity matters. Based on the NIST CSF, our processes to identify, assess, and manage material risks from cybersecurity threats includes the following: Identify

companyName: NORFOLK SOUTHERN CORP

ticker: NSC


text: Management has not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. See Item 1A. Risk Factors, " We are highly dependent on information systems and therefore systems failures, cybersecurity incidents or other technology disruptions could negatively impact our business" and "Security breaches and other disruptions could compromise our information and expose us to liability, which would cause our business and reputation to suffer." above for more information. While we continually work to safeguard the information systems we use, and the proprietary, confidential and personal information residing therein, and mitigate potential risks, there can be no assurance that such actions will be sufficient to prevent cybersecurity incidents or mitigate all potential risks to such systems, networks and data or those of our third-party providers.

companyName: Bluerock Homes Trust, Inc.

ticker: BHM


text: To date, we have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. Like other companies in our industry, we and our third-party information technology service providers and vendors have from time to time experienced threats that could affect our information or systems. For more information, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K.

companyName: Monte Rosa Therapeutics, Inc.

ticker: GLUE


text: Our global cybersecurity processes form the comprehensive framework we utilize for planning, performing, managing, assessing, and improving our security controls as they relate to cybersecurity, and form part of our overall risk management system. We aim to conduct our cybersecurity program in accordance with current recognized global policies and standards for cybersecurity and information technology. These processes are managed by our cybersecurity team headed by our CISO and CIO and supported by our business continuity teams.

companyName: BGC Group, Inc.

ticker: BGC


text: Oversight and Governance Our Board of Trustees oversees our enterprise risk management strategy, including our strategy on cybersecurity risks, directly and through its committees. In this respect, the Audit Committee of the Board of Trustees (the "Audit Committee")

companyName: Carlyle Secured Lending III


text: Entergy's CISO is responsible for enterprise strategic and operational cybersecurity, physical security systems, and regulatory compliance. The CISO oversees investments in tools, resources, and processes that allow for the continuous improvement and maturity of Entergy's cybersecurity posture. The CISO has expertise spanning more than 25 years in the realm of information technology, information security, and cyber/physical security management. The CISO's background includes serving as the Vice President and Chief Information Security Officer for an electric utility with responsibility for enterprise cybersecurity covering corporate, electric, nuclear, and gas operations. Additionally, the CISO served as the Chief Security Officer for the Electric Reliability Council of Texas with overall responsibility for its cybersecurity, physical security, and emergency management programs. Her previous experience includes multiple technical, managerial, and strategic roles within industries ranging from energy, telecommunication, software development, and cybersecurity consulting. The CISO is a Certified Information Systems Security Professional, Certified Information Security Manager, and Certified in Risk and Information Systems Control.

companyName: ENTERGY LOUISIANA, LLC

ticker: ELC


text: Cybersecurity incidents are identified and mitigated by cybersecurity incident response plans that detail any actions to be taken when a cybersecurity incident occurs. The cybersecurity incident response plans define the organization, roles and responsibilities of the teams tasked with mitigating the impact of the cybersecurity incident. They define repeatable processes for responding to cybersecurity incidents; ensure communication to the CTO and CNO, as appropriate; minimize the impact to customer and business operations; coordinate response activities with external organizations; decrease the likelihood of reoccurrence and ensure regulatory reporting occurs, among other objectives. If warranted, the incident response plan may trigger the activation of the Crisis Management Team, a subset of officers who lead corporate functions and would collectively perform impact assessment and provide decision-making guidance as a component of the Crisis Management Plan within the Evergy Companies' business continuity and disaster recovery plans. Both the incident response plan and crisis management plan are practiced on an annual basis. In addition, the Evergy Companies share network traffic with federal and state agencies to assist with the identification and mitigation of cybersecurity incidents. The Evergy Companies participate in federal and industry information sharing programs, such as the Cybersecurity and Infrastructure Security Agency to assist in the exchange of cybersecurity-related information, analysis and incident mitigation techniques. On at least an annual basis, cross-functional teams and executive management participate in a simulated cybersecurity incident exercise and the Evergy Companies regularly simulate cybersecurity incidents, including phishing attacks, to assess organizational readiness. In addition to a bi-annual internal assessment, the NRC inspects Wolf Creek's processes to validate the effectiveness of the program to protect Wolf Creek from cybersecurity threats.

companyName: Evergy, Inc.

ticker: EVRG


text: We conducted a NIST risk assessment and performed as needed updates to our risks to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. We engage a managed service provider ("MSP") and other third parties in connection with our cybersecurity and information technology risk assessment processes and our MSP also assists us with managing and monitoring our network and local computer systems. These service providers assist us in designing and implementing our cybersecurity policies and procedures, as well as monitoring and testing our safeguards. Personnel at all levels and departments are made aware of our cybersecurity policies through communications.

companyName: Empery Digital Inc.

ticker: EMPD


text: Cybersecurity risks are reported to the RMC at least quarterly and those reports include key performance indicators, test results, recent threats and how the Company is managing those threats, along with the effectiveness of the Information Security and cyber risk program. The RMC is responsible for monitoring our Information Security Program ("ISP") and is led by a member of our Board of Directors. The RMC reports quarterly to the Board regarding its activities, including those related to cybersecurity risk oversight. The Board receives briefings from executive management on the overall Information Security program at least annually.

companyName: NBT BANCORP INC

ticker: NBTB


text: Our management periodically evaluates information provided by consultants on evolving cybersecurity risks and, based on management's assessment of the processes the Company has put in place, does not believe there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations, or financial condition.

companyName: CytoDyn Inc.

ticker: CYDY


text: Our management team, including our Chief Legal Officer, President, Chief Financial Officer and Vice President of Data Analytics and Information Security is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our external cybersecurity consultants. Our management team's cumulative experience includes decades of experience managing cybersecurity risks including serving in similar roles leading and overseeing cybersecurity programs at other companies. Our Vice President of Data Analytics and Information Security has served in various roles in information technology and information security for more than 10 years. He holds an undergraduate degree in engineering science from Harvard University and postgraduate degrees in computer science from Massachusetts Institute of Technology. Our Chief Legal Officer has over 25 years of experience managing risks, including risks arising from cybersecurity threats, at several large publicly-traded technology companies. Team members who support our information security program have relevant educational and industry experience, including holding similar positions at large technology companies.

companyName: 10x Genomics, Inc.

ticker: TXG


text: The MSP escalates incidents with significant impact and pervasiveness to Aemetis' Chief Financial Officer, who evaluates each incident in terms of its impact on Aemetis and operations, ability to conduct business with customers and suppliers, brand reputation and health, safety or the environment, and the speed and degree to which the incident has been contained. Our Chief Financial Officer, working with the executive management team, also manages the communication with our Board and outside parties. After initial identification, evaluation and escalation for material events, the MSP monitors all cybersecurity incidents for changes in degree of impact or pervasiveness.

companyName: AEMETIS, INC

ticker: AMTX