text: We acknowledge the increasing importance of cybersecurity in our operations and having processes in place to manage risks and threats associated with potential unauthorized occurrences on our information systems that could adversely affect the confidentiality, integrity, or availability of our information systems and data. We continuously invest in and enhance our cybersecurity infrastructure to mitigate risks and protect against unauthorized access, data breaches, and other cyber incidents that could disrupt our business or compromise sensitive information. We have implemented various cybersecurity measures to safeguard our information technology infrastructure and data assets: Governance and Oversight:

companyName: GSE SYSTEMS INC


text: The daily operational responsibility for our cybersecurity initiatives falls to our dedicated cybersecurity team, headed by the Chief Technology Officer (CTO). This team collaborates with external partners to forge and execute our data security and cybersecurity plans, including risk assessments, monitoring activities, and training for our employees. We are committed to continually investing in the enhancement of our capabilities to identify, protect against, and detect security threats.

companyName: BUILD-A-BEAR WORKSHOP INC

ticker: BBW

secItem: Item 1C


text: We have established cybersecurity and information security awareness training programs. Formal training on topics relating to our cybersecurity, data privacy and information security policies and procedures is mandatory at least annually for all employees, contractors and third parties with access to our network. Training is administered and tracked through online learning modules. Training topics include how to escalate suspicious activities including phishing, viruses, spams, insider threats, suspect human behaviors or safety issues. Based on role and location, some employees receive additional in-depth training to provide more comprehensive knowledge on potential risks related to their individual job responsibilities. Training is supplemented through regular company-wide communications with frequent updates to educate on the latest adversary trends and social engineering techniques.

companyName: DXP ENTERPRISES INC

ticker: DXPE


text: Currently, our Chief Executive Officer is expected to lead our cybersecurity risk assessment and management processes and oversees their implementation and maintenance. Our Chief Executive Officer will be tasked with staying informed about, and monitoring the prevention, mitigation, detection and remediation of cybersecurity incidents through his management of, and participation in, the cybersecurity risk management and strategy processes we plan to develop and as described above, including the operation of an incident response plan, and report to the Board of Directors on any appropriate items.

companyName: Bimergen Energy Corp

ticker: BESS


text: At the management level, our CISO, who reports to our Chief Information Officer, is responsible for overseeing the assessment and management of our material risks from cyber security threats. Our CISO has extensive experience and knowledge in cyber security as a result of 27 years of experience in leading security teams, developing security strategies, and managing risk across various industries. The CISO is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents through reports from a number of experienced information security officers responsible for various parts of the business and regularly reviewing risk management measures implemented by the Company to identify and mitigate cyber security risks.

companyName: SOLAREDGE TECHNOLOGIES, INC.

ticker: SEDG


text: We maintain a cyber risk management program designed to assess, identify, manage, mitigate and respond to cybersecurity threats and incidents. We seek to address material risks from cybersecurity threats through a cross-functional approach, and we utilize various processes to inform our identification, assessment and management of material risks from cybersecurity threats. Our cyber risk management program is integrated into our overall enterprise risk management (ERM) program. Cybersecurity risks are identified and assessed through our ERM program, which is designed to provide cross-functional executive insight across the business to identify and monitor risks, opportunities and emerging trends that can impact our strategic business objectives. The underlying controls of our cyber risk management program are based on recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology Cybersecurity Framework.

companyName: FREEPORT-MCMORAN INC

ticker: FCX


text: Our Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated governance of cybersecurity and other technology risks to the Audit Committee (the Committee). Our executive management is ultimately responsible for assessing and managing risks from cybersecurity threats we face, and in this regard works closely with the Chief Information Security Officer (CISO) who reports to our Chief Corporate Officer. The Committee oversees management's design and implementation of our cybersecurity risk management program and receives periodic reports, at least semi-annually, from the CISO on cybersecurity risks, the threat landscape, and our cybersecurity planning roadmap. In addition, the CISO updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as other relevant incidents and potential or mitigated threats. The Committee reports to the Board of Directors regarding its activities, including those related to cybersecurity, and may request the CISO brief the Board of Directors on the status of cybersecurity and risk management programs, as well as relevant incidents and threats. Board members also receive periodic presentations on key cybersecurity topics from the CISO.

companyName: VIASAT INC

ticker: VSAT


text: Through established governance structures, including our problem and incident management process and Cybersecurity Incident Response Plan, we have processes and procedures to help facilitate appropriate and effective oversight of cybersecurity risk. These processes and procedures help enable our three lines of defense and management to identify, protect, detect, respond, and recover from cybersecurity risks, monitor threats, and provide for further escalation to executive management, our management-level Disclosure Committee, our board-level Risk Committee, or to the full Board, as appropriate.

companyName: Atlantic Union Bankshares Corp

ticker: AUB


text: Our cybersecurity measures are designed to identify, protect, detect, and respond to and manage reasonably foreseeable cybersecurity risks and threats. To protect our information systems from cybersecurity threats, we use multiple monitoring and detection tools to safeguard network and endpoint devices. We have implemented measures that proactively and continuously assess and monitor our information systems for vulnerabilities and cybersecurity exposure.

companyName: MARTIN MIDSTREAM PARTNERS L.P.

ticker: MMLP


text: The program includes processes that identify how security measures and controls are developed, implemented, and maintained, as well as cybersecurity and information security training and awareness. The program includes a risk management process designed to identify internal and external cybersecurity threats and vulnerabilities to the Company's business and operations, assess the likelihood and potential impact of the threats and vulnerabilities to the Company, and assess and prioritize the risks from cybersecurity threats and vulnerabilities to inform action plans and strategies to mitigate and manage these risks. The program's risk assessment process, based on a method and guidance from a recognized national standards organization, is conducted annually. The risk assessment along with risk-based analysis and judgment are used to select security controls to address risks. During this process, the following factors, among others, are considered: recognized frameworks, likelihood and severity of risk, impact on the Company and others if a risk materializes, feasibility and cost of controls, and impact of controls on operations and others.

companyName: KELLANOVA


text: The Company's Chief Information Officer, who has many years of relevant experience, with support from the other members of the cybersecurity team, is the member of the Company's management that is principally responsible for overseeing the Company's cybersecurity risk management program. We believe our cybersecurity team has the appropriate expertise, background and depth of experience to manage risks arising from cybersecurity threats.

companyName: Burlington Stores, Inc.

ticker: BURL


text: Although we have not, as of the date of this Annual Report on Form 10-K, experienced a cybersecurity incident that materially affected our business, financial condition and results of operations, we can provide no assurance that we will not experience a material cybersecurity incident in the future. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. For additional information regarding the risks we face from cybersecurity threats, please see the risk factor titled "Our business and operations would suffer in the event of computer system failures, cyber-attacks or a deficiency in our cyber-security" included in Part I, Item 1A, Risk Factors of this Annual Report on Form 10-K.

companyName: vTv Therapeutics Inc.

ticker: VTVT


text: Cybersecurity Risks As of December 31, 2023, we are not aware of any material cybersecurity incidents that impacted the Company in the last three years. We and our Adviser routinely face risks of potential incidents, whether through cyber-attacks or cyber intrusions over the Internet, ransomware and other forms of malware, computer viruses, attachments to emails, phishing attempts, extortion or other scams; however, we have been able to prevent or sufficiently mitigate harm from such risks. Although the Adviser and Franklin Templeton, on our behalf, make efforts to maintain the security and integrity of the information technology systems the Adviser uses on our behalf, these systems and the proprietary, confidential and personal information that resides on or is transmitted through them are subject to the risk of a security incident or disruption, and there can be no assurances regarding our security efforts and measures or those of our third party providers. See "Item 1A–Risk Factors– Our business could suffer in the event our Adviser or any other party that provides us with services essential to our operations experiences system failures or cyber-incidents or a deficiency in cybersecurity."

companyName: Franklin BSP Capital Corp

ticker: FRBP


text: Our ISMS leverages comprehensive cybersecurity frameworks and standards such as the National Institute of Standards and Technology (NIST) Cybersecurity Framework, the Center for Internet Security (CIS) Critical Security Controls, the Trusted Information Security Assessment Exchange (TISAX) standard, and the International Organization for Standardization (ISO) 27001 standard for information security. Our ISMS is built upon a balance of people, processes and technologies comprised of, among other elements: 1) 24/7 security monitoring using internal and third-party resources; 2) security awareness and phishing testing; 3) periodic table-top and live-fire exercises; 4) high system availability and business continuity; and 5) comprehensive incident response and escalation plans.

companyName: Dauch Corp

ticker: DCH


text: Our Vice President of Cybersecurity and Information Technology is responsible for assessing and managing our material risks from cybersecurity threats and has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Vice President of Cybersecurity and Information Technology has served in that position since 2022, and has extensive experience assessing and managing cybersecurity programs and technology risk. Prior to joining Evolv, our Vice President of Cybersecurity and Information Technology was the Leader of Global Information Security for New Balance.

companyName: Evolv Technologies Holdings, Inc.

ticker: EVLV


text: In 2024, we continued to mature our enterprise-wide communication initiative, focusing on cyber threats. This ongoing effort educates employees on recognizing and responding to potential cyber threats effectively, while continuously exploring new ways to engage and inform stakeholders about evolving threats. It serves as a reminder of the critical role each individual plays in safeguarding our organization's security.

companyName: Li-Cycle Holdings Corp.


text: We actively engage consultants, outside counsel and other technology experts to enhance our cybersecurity risk management processes, who perform regular assessments and evaluations of the effectiveness of our cybersecurity measures. In addition to third party engagements, we maintain rigorous oversight of cybersecurity risks associated with our use of third party service providers. Vendor management processes are employed to evaluate vendors' cybersecurity practices, assess risk position and implement measures to mitigate potential threats arising from these external relationships.

companyName: ARBOR REALTY TRUST INC

ticker: ABR


text: We are committed to our goal to protect sensitive business-related and personal information, as well as our information systems. Although the size and scope of our operations is limited compared to larger global operations, we are subject to numerous and evolving cybersecurity risks that could adversely and materially affect our business, financial condition and results of operations. In that regard, we have increased our investment in information systems by upgrading outsourced services and technology platforms previously utilized.

companyName: BARFRESH FOOD GROUP INC.

ticker: BRFH


text: The Board of Directors, with the assistance of the Audit Committee, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate those risks. As part of its oversight responsibilities, the Audit Committee receives periodic updates on cybersecurity and information technology matters and related risk exposures from our CFO.

companyName: Cellectar Biosciences, Inc.

ticker: CLRB


text: The Company conducts no business activities other than activities relating to capital management, stockholder relations, and acting as a source of financial strength for its subsidiary, the Bank. Cyber/information security is a significant and integrated component of the Company's risk management strategy. As an insured depository institution, threats to information security are present and growing, and the potential exists for a cybersecurity incident to occur, which could disrupt business operations or compromise sensitive data. To date, the Company has not, to its knowledge, experienced an incident materially affecting or reasonably likely to materially affect the Company.

companyName: BankFinancial CORP


text: Third-party risk assessment and management for vendors and third-party service providers; and Cyber incident exercises for our Board of Directors and management.

companyName: SOLIGENIX, INC.

ticker: SNGX


text: Management generally meets with, and provides reports to, the cybersecurity sub-committee on a quarterly basis. Our CIO and CISO also meet with and provide reports to the audit committee at least quarterly. The board of directors receives periodic reports regarding the activities of the cybersecurity sub-committee. These reports and meetings are designed to inform the board of directors and committees about the current state of our information security program including cybersecurity risks, the nature, timing, and extent of cybersecurity incidents, if any, and the resolution of such matters.

companyName: lululemon athletica inc.

ticker: LULU


text: The Audit Committee of our board of directors provides primary oversight and strategic guidance on Cybersecurity. The Audit Committee receives reports from management, typically on a quarterly basis, regarding our security risk management, including cybersecurity-related risks, vulnerabilities, policies, practices, and strategic initiatives. Annually, our board of directors receives a report from management on our cybersecurity posture, our readiness and our capability to reduce the risk of, detect and respond to a cyberattack. Our senior management and board of directors participate in periodic cyber tabletop exercises to further enhance our preparedness in the event of an actual incident.

companyName: ExlService Holdings, Inc.

ticker: EXLS


text: Upon verifying that a cybersecurity incident has occurred or is occurring, the Chief Executive Officer, President and Chief Financial Officer will promptly conduct a preliminary assessment of the severity level of the cybersecurity incident. Following this assessment, the Chief Executive Officer will determine whether to report the cybersecurity incident to the Audit Committee, who will then report such cybersecurity incident to the Board as the chair deems appropriate.

companyName: SANUWAVE Health, Inc.

ticker: SNWV


text: Given the ever-changing cybersecurity landscape, our IT Committee regularly meets to identify opportunities for incremental improvements, assess additional layers of security, and evaluate new technologies for implementation. In addition, we engage, as necessary, cybersecurity experts to analyze our IT policies, procedures, and infrastructure to assess their effectiveness and to identify opportunities for improvement.

companyName: RLJ Lodging Trust

ticker: RLJ


text: As a financial institution, cybersecurity is a high priority for us as we receive and maintain the business and personal information of our customers on a daily basis. In addition, our business operations rely extensively on the continuous operation of our information and data processing systems and related back-up systems. Accordingly, we have developed and maintain a cybersecurity program that is focused on the goals of preparing for, preventing, detecting, mitigating, responding to and recovering from cyber threats and incidents, maintaining the privacy and protection of our customers' data, and the continuity of our information and data processing systems.

companyName: HOPE BANCORP INC

ticker: HOPE


text: Board Oversight and Management's Role: The Board of Directors, both directly and through the delegation of responsibilities to the Audit Committee oversees the proper functioning of our cybersecurity risk management program to ensures strategic alignment and governance of our cybersecurity efforts at the highest level. In particular, the Audit Committee assists the Board in its oversight of management's responsibility to assess, manage and mitigate risks associated with our business and operational activities, to administer our various compliance programs, in each case including cybersecurity concerns, and to oversee our information technology systems, processes and data.

companyName: Inogen Inc

ticker: INGN


text: Collaboration with our industry partners and government customers contributes to the protection of Textron's computing environment as well as our military stakeholders. Textron is engaged with various industry groups such as Aerospace Industries Association, National Defense Information Sharing & Analysis Center and our Defense Industrial Base colleagues to ensure that we are aware of and are addressing the latest adversarial threats. Additionally, we share cyber best practices with industry peers to help to make the industry more secure.

companyName: TEXTRON INC

ticker: TXT


text: Also, the Registrants' workforce undertakes mandatory role-based annual training on identifying, reporting, and escalating cyber and physical security concerns to further assist in the identification of risks as well as the acceptable use of corporate electronic resources. Additionally, all employees and contractors are required to participate in the Registrants' ethical cyber phishing campaign program. In addition to these enterprise-wide initiatives, PPL's Kentucky, Pennsylvania and Rhode Island operations are subject to extensive and rigorous mandatory cybersecurity requirements that are developed and enforced by NERC and approved by the FERC to protect grid security and reliability. LG&E is also subject to certain security directives related to cybersecurity issued by the Department of Homeland Security's Transportation Security Administration in 2021. See Note 13 to the Financial Statements for additional information on these directives.

companyName: PPL ELECTRIC UTILITIES CORP


text: Management is responsible for the day-to-day management of risks we face, while our board of directors, as a whole and through committees, has responsibility for the oversight of risk management. Our Security Committee oversees the management of risks from cybersecurity threats. As required, the full board reviews our major risk exposures, their potential impact on us, and the steps we take to manage them. Our Chief Security Officer (CSO) is responsible for developing, implementing, and maintaining our cybersecurity risk management policies and procedures. The CSO provides regular cybersecurity updates to the Chairman of the Board. Our Cyber Risk Advisory Committee oversees matters regarding the Company's Information Technology strategy, priorities, and governance, including cybersecurity threats and risk assessments.

companyName: Momentus Inc.

ticker: MNTS


text: Our board of directors oversees our risk management process, including as it pertains to cybersecurity risks, which focuses on the most significant risks we face in the short-, intermediate-, and long-term timeframe. Management is responsible for the operational oversight of company-wide cybersecurity strategy, policy, and standards across relevant departments to assess and help prepare us to address cybersecurity risks.

companyName: Lipocine Inc.

ticker: LPCN


text: Garmin has a cybersecurity risk management program, generally aligned with the tenets and methodologies of industry standards and best practices such as the National Institute of Standards and Technology (NIST) Cybersecurity Framework, designed to protect the confidentiality, integrity, and availability of the Company's information systems through assessing, identifying, and managing material risks from cybersecurity threats. The management of our information system platforms and the related cybersecurity is tightly integrated with Garmin's product development and technology management teams. Cybersecurity risks are identified, reported, and managed by the Company's in-house cybersecurity experts as well as third-party providers of penetration test reporting, cyber-threat intelligence, and incident forensics services.

companyName: GARMIN LTD

ticker: GRMN


text: Risk Management and Strategy the oversight of the Board of Directors and Audit Committee, we have implemented and maintain a risk management program that includes processes for the systematic identification, assessment, management, and treatment of cybersecurity risks. Our cybersecurity oversight and operational processes are integrated into our overall risk management processes, and cybersecurity is one of our designated risk categories. We use the National Institute of Standards and Technology Cybersecurity Framework to guide our approach, ensuring a structured and comprehensive strategy for managing cybersecurity risks. We implement a risk-based approach to the management of cyber threats, supported by cybersecurity technologies, including automated tools, designed to monitor, identify, and address cybersecurity risks. In support of this approach, our IT security team implements processes to assess, identify, and manage security risks to the company, including in the areas of security and compliance, application security, infrastructure security and data privacy. This process includes regular compliance and critical system access reviews. In addition, we conduct application security assessments, vulnerability management, penetration testing, security audits and ongoing risk assessments as part of our risk management process. We also maintain an incident response plan to guide our processes in the event of an incident. We also have a process to require corporate employees to undertake cybersecurity utilize third parties and consultants to assist in the identification and assessment of risks, including to support tabletop exercises and to conduct security testing.

companyName: GIFTIFY, INC.

ticker: GIFT


text: We depend on information systems and related technologies for internal purposes, including secure data storage, processing, and transmission, as well as in our interactions with our business associates, such as customers and suppliers. We also rely on third-party business associates, with whom we may share data and services, to defend their digital technologies and services against attack.

companyName: Cactus, Inc.

ticker: WHD


text: Our vCISO has served in various information technology, security, and privacy roles for over 25 years, including as the Chief Information Security Officer for several large public companies. Our vCISO holds undergraduate and graduate degrees in business administration and law, including specialties in information systems management and legal risk and compliance. Additionally, he has attained professional certifications in information security, auditing and assessment, and threat intelligence.

companyName: TRUPANION, INC.

ticker: TRUP


text: The Company has also established cybersecurity and information security awareness training programs. Employees with access to the Company's network receive annual training on topics such as phishing, malware, and other cybersecurity risks. Training is administered and tracked through online learning modules with ongoing follow-up testing. All employees and contractors enter into non-disclosure confidentiality agreements. We work to continually evolve our systems to meet the constantly changing digital environment and continue to invest in the cybersecurity and resiliency of our networks and to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain.

companyName: DATA I/O CORP

ticker: DAIO


text: Governance and Risk Management Information security is a significant operational risk for financial institutions such as Radian and includes the risk of loss resulting from cyberattacks.

companyName: RADIAN GROUP INC

ticker: RDN


text: Our information security management team is informed about and monitors efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public, or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in our information technology environment.

companyName: Walker & Dunlop, Inc.

ticker: WD


text: Board and Management Governance We have cybersecurity and information technology oversight at the Board and management levels. Direct Chubb Board-level oversight is generally within the purview of two of the Board's committees: Audit and Risk & Finance.

companyName: Chubb Ltd

ticker: CB


text: As discussed below, AFG's enterprise risk management ("ERM") process considers cybersecurity threat risks alongside other company risks as part of the overall risk assessment process.

companyName: AMERICAN FINANCIAL GROUP INC

ticker: AFG


text: Our Board as a whole has responsibility for the Company's risk oversight, with reviews of certain areas being conducted by the relevant Board committees that report on their deliberations to the full Board. The oversight responsibility of the Board and its committees is enabled by management reporting processes that are designed to provide visibility to the Board about the identification, assessment and management of critical risks and management's risk mitigation strategies. Areas of focus include competitive, economic, operational, financial (accounting, credit, liquidity and tax), legal, regulatory, compliance and other risks.

companyName: Main Street Capital CORP

ticker: MAIN


text: Our cybersecurity risk management processes include technical security controls, policy enforcement mechanisms, monitoring systems, contractual arrangements, tools and related services, and management oversight to assess, identify and manage risks from cybersecurity threats. We implement risk-based controls to protect our information, information systems, business operations, and products and related services. We have adopted security-control principles based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST"), other global standards, and contractual requirements, as applicable. We also leverage government partnerships, industry and government associations, third-party benchmarking, audits, threat intelligence feeds, and other similar resources to inform our cybersecurity efforts and allocate resources.

companyName: MARAVAI LIFESCIENCES HOLDINGS, INC.

ticker: MRVI


text: We have established comprehensive incident response and recovery plans and continue to regularly test and evaluate the effectiveness of those plans. Our incident response and recovery plans address – and guide our employees, management and the Board of Directors on – our response to a cybersecurity incident, including the requirements of notification, classification, analysis and communication of cybersecurity incidents based on the identified severity level. The Executive ERM Committee regularly reviews and evaluates the corporate incident response plan and business continuity plan.

companyName: UNITED FIRE GROUP INC

ticker: UFCS


text: As part of its oversight duties, the Audit Committee receives regular updates on our cybersecurity posture and information security risks from our Chief Information Security Officer. These regular updates include topics related to cybersecurity practices, cyber risks, and risk management processes, such as updates to our cybersecurity programs and mitigation strategies, and other cybersecurity developments. In addition to these regular updates, as part of our incident response processes, the Chief Technology Officer, in collaboration with the Chief Information Security Officer and General Counsel, provides updates on certain cybersecurity incidents to the Audit Committee and, in some cases, the Board. The Audit Committee reviews and provides input into, and oversight of our cybersecurity processes, and in the event the Company determines it has experienced a material cybersecurity incident, the Audit Committee is notified about the incident in advance of filing a Current Report on Form 8-K.

companyName: Fisker Inc./DE


text: Management's Role in Cybersecurity Our global cybersecurity services team is responsible for assessing our technology environment, identifying emerging cybersecurity threats and evolving cybersecurity threat capabilities, and implementing business processes and technical defenses to safeguard our technology environment and services. Our management has established a cybersecurity and technology risk committee focused on managing cybersecurity and technology risk and implementing cybersecurity and technology plans, strategies and objectives. The committee is chaired by the Deputy Chief Information Security Officer, who reports to the Chief Operating Officer through our Chief Information Security Officer, and is comprised of senior business, cybersecurity, and technology leaders responsible for delivering our products and services. Our cybersecurity program is designed to enable us to detect and respond to cybersecurity incidents, continually improve the effectiveness of our cybersecurity controls, and dynamically respond to the evolving threat landscape.

companyName: FISERV INC

ticker: FISV


text: While we have experienced cybersecurity incidents in the past, in the last fiscal year we have not identified risks from known cybersecurity threats, including as a result of prior cybersecurity incidents, that have materially affected the Company or our financial position, results of operations and/or cash flows. We continue to invest in cybersecurity and the resiliency of our networks and to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain. For more information regarding the risks we face from cybersecurity threats, please see "Risk Factors."

companyName: RED ROBIN GOURMET BURGERS INC

ticker: RRGB


text: The audit committee receives reports from members of the Company's management concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them, as applicable.

companyName: Larimar Therapeutics, Inc.

ticker: LRMR


text: The Company has assigned executive ownership of and accountability for the Information Security Program to the Chief Information Security Officer, who leads a dedicated team of trained staff to protect the confidentiality, integrity and availability of information assets. Our Chief Information Security Officer has over 20 years of diverse industry experience, including serving in similar roles overseeing cybersecurity programs, as well as serving in numerous board and advisory capacities. Several members of the Information Security team hold advanced degrees as well as industry-recognized certifications in cybersecurity and related disciplines. The Information Security Program also utilizes third-party managed security services where appropriate.


text: The Bank's CISO periodically updates the Board of Directors regarding the Bank's cybersecurity program, including current risks and metrics, the evolving external threat landscape and the results of the Bank's security awareness training. The Risk Management Committee of the Board of Directors, the Board committee that is primarily responsible for the oversight of risks from cybersecurity threats, is briefed quarterly on cybersecurity risks and receives information and metrics that are similar to the information and metrics provided to OROC. In addition, the Board's Strategic Planning, Operations and Technology Committee is briefed, as needed, on security matters relating to specific IT projects.

companyName: Federal Home Loan Bank of Dallas


text: We believe that cybersecurity is important to maintaining the trust of our customers and employees. We have implemented a cybersecurity risk management program that is designed to identify, assess, manage, mitigate, and respond to cybersecurity threats which could adversely affect the confidentiality of our data and the integrity of our business operations and financial systems. Our cybersecurity program is based on best practices and guidelines of the National Institute of Standards and Technology Cybersecurity Framework. We have company-wide policies and procedures in place that further enhance our ability to identify and manage cybersecurity risk.

companyName: ENNIS, INC.

ticker: EBF


text: We regularly review our cybersecurity defenses to assess our vulnerability to cybersecurity attacks from viruses, malware and more sophisticated and targeted cyber-related attacks such as hackers looking to demand ransomware or access our systems to obtain information and data, as well as our vulnerability to cybersecurity failures resulting from human error and technological errors. We rely upon internal information technology ("IT") personnel working in conjunction with specialized outside security consultants on a day-to-day basis to conduct reviews and upgrade our systems when determined to be necessary.

companyName: AIR INDUSTRIES GROUP

ticker: AIRI


text: Our CDIO and our CISO lead our management team in assessing and managing our response to cybersecurity threats and incidents. Our CDIO and CISO together have over 50 years of combined experience in information technology, digital and systems transformation, cybersecurity and related risk management and governance. This team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants, and works with all divisional, manufacturing and functional teams within Corning on cybersecurity issues. The team's efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents are enhanced by briefings from internal security personnel, by receipt of threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, periodic assessments against the NIST CSF and through alerts and reports produced by security tools deployed in our IT environment.

companyName: CORNING INC /NY

ticker: GLW


text: The Company has also established a management-level Technology Risk Committee, which includes leaders from finance, legal, operations, quality & compliance, and information systems & informatics, who are responsible for overseeing the execution of high-risk incident response and mitigation plans. This committee actively reviews technology strategies, physical and cybersecurity threat assessment, and emerging issues and related initiatives. It is also responsible for evaluating the materiality of information for SEC filings and, as required or as otherwise appropriate, coordinates with the Company's Materiality Committee to support timely disclosure of relevant information.

companyName: ARROWHEAD PHARMACEUTICALS, INC.

ticker: ARWR


text: We assess our technology assets and their vulnerabilities, including risks from our suppliers and vendors, to prioritize and improve program efforts consistent with our risk management strategy. We engage in the periodic assessment and testing of our program. These include tabletop exercises, vulnerability testing and other methods focused on evaluating the effectiveness of our cybersecurity measures and planning. We actively engage third parties to assist with our assessments and testing processes. We adjust our cybersecurity policies, standards, processes and practices, where appropriate, based on internal and external assessments and testing results.

companyName: TYSON FOODS, INC.

ticker: TSN


text: As previously disclosed, beginning on August 18, 2023, some of the notified individuals filed lawsuits against Umpqua Bank in various federal and state courts seeking monetary recovery and other relief on behalf of themselves and one or more putative classes of other individuals similarly situated. The cases collectively allege claims for negligence, negligence per se, breach of contract, breach of implied contract, breach of third-party beneficiary contract, breach of fiduciary duty, invasion of privacy, breach of the covenant of good faith and fair dealing, unjust enrichment, and violation of certain statutes, namely the Washington Consumer Protection Act, the California Consumer Legal Remedies Act, the California Consumer Privacy Act, and the California Unfair Competition Law. Umpqua Bank has engaged defense counsel and intends to vigorously defend against these suits and any similar or related suits or claims. Umpqua Bank has notified relevant insurance carriers and business counterparties and continues to reserve all of its relevant rights to indemnity, defense, contribution, and other relief in connection with these matters. We cannot predict or determine the timing or outcome of these lawsuits or the impact they may have, if any, on our financial condition, results of operations, or cash flows. We believe that if one or more outcomes that are determined in favor of the plaintiffs in the litigation arising from the Vendor Incident it could have a material adverse effect on our business, operations, or financial results.

companyName: COLUMBIA BANKING SYSTEM, INC.

ticker: COLB


text: Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our IT environment.

companyName: 5E Advanced Materials, Inc.

ticker: FEAM


text: The Board oversees cybersecurity through the Bank's Information Technology Committee (" IT Committee "), the Company's Audit Committee, and the Company's Risk Committee, aligning cybersecurity practices with the Company's risk management framework and regulatory requirements. Updates on cybersecurity strategy, risk assessments, and regulatory developments are provided to the relevant committees.

companyName: CHAIN BRIDGE BANCORP INC

ticker: CBNA


text: APA's Chief Information Officer (the CIO) is primarily responsible for the day-to-day operation of the Company's cybersecurity program and for identifying, assessing, and managing the material risks associated with the cybersecurity threats and incidents identified from time to time thereunder. The CIO manages the Company's Information Security Team, which is comprised of cybersecurity professionals responsible for managing the Company's threat intelligence, vulnerability management, forensics, and security architecture systems and processes. The CIO has a Bachelor of Science in Computer Science and over 25 years of experience managing data and technology in the energy industry. He also receives regular updates from external cybersecurity specialists on emerging trends, threats, and technologies in the cybersecurity industry. The CIO reports directly to APA's Executive Vice President, Administration, who, along with the CIO, presents all relevant information to the Cybersecurity Committee.

companyName: APA Corp

ticker: APA


text: One of the key functions of our Board is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board is responsible for monitoring and assessing strategic risk exposure, and management is responsible for the day-to-day management of any material risks that may arise. Our Board receives periodic updates from management regarding cybersecurity matters and is notified between such updates regarding any significant new cybersecurity threats or incidents, if any. We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations of April 30, 2025, we have not identified an indication of a cybersecurity incident that would have a material impact on our business and consolidated financial statements. For further discussion of cybersecurity risks, please refer to Item 1A. Risk Factors.

companyName: U.S. GOLD CORP.

ticker: USAU


text: Our Security Operations team has implemented a continuous monitoring program that provides real time feedback to security events that are triaged and remediated. Critical incidents are escalated in accordance with Asure's Incident Response Policy. Critical incidents are reported to the board of directors as required by Asure's Incident Response Policy.

companyName: ASURE SOFTWARE INC

ticker: ASUR


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, incident reporting channels and governance processes, as those used in our enterprise risk management program. We designed and continue to assess our cybersecurity program based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"), which we use as a guide to help us identify, prioritize and manage the cybersecurity risks that could materially affect our business, financial condition or results of operations.

companyName: Utz Brands, Inc.

ticker: UTZ


text: Management is responsible for the day-to-day management of the risks we face, while our Board of Directors has responsibility for the oversight of risk management, including as to risks from cybersecurity threats. In its risk oversight role, our Board of Directors has the responsibility to satisfy itself that the risk management processes designed and implemented by management are appropriate and functioning as designed. The Board of Directors has delegated to the Audit Committee of the Board of Directors the responsibility for the oversight of information technology, including cybersecurity risks. Member(s)

companyName: Virpax Pharmaceuticals, Inc.

ticker: VRPX


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including those in our supply chain or who have access to our customer and employee data or our systems. Third-party risks are included within our ERM assessment program as well as our cybersecurity-specific risk identification program, as discussed above. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data, or facilities that house such systems or data, and monitor cybersecurity threat risks identified through such diligence.

companyName: GE HealthCare Technologies Inc.

ticker: GEHC


text: 24x7 Endpoint Monitoring by NOSC As part of our commitment to safeguarding our network, we operate a Network Operations and Security Center ("NOSC") that provides 24x7 monitoring of all endpoints across our network. This continuous surveillance allows us to detect and respond to potential threats in real time, helping our systems remain secure and operational. The NOSC is a critical component of our cybersecurity infrastructure, enabling proactive risk management and the ongoing protection of our digital assets.

companyName: RADIANT LOGISTICS, INC

ticker: RLGT


text: We are continuing to develop and refine processes to continuously monitor, analyze emerging threats, and to develop and implement risk mitigation strategies and our management team plays a pivotal role in assessing and managing material risks from cybersecurity threats. Our Chief Information Officer, who has served in various leadership roles in information technology for over 20 years, provides leadership for our cybersecurity team. He also leads our overall corporate technology team, which has over 20 years of combined information security experience.

companyName: Archer Aviation Inc.

ticker: ACHR


text: As part of our cybersecurity roadmap, we also assess third-party risks, and we perform third-party risk management to identify and mitigate risks from third parties such as vendors, suppliers and other business partners associated with our use of third-party service providers. Cybersecurity risks are evaluated when determining the selection and oversight of applicable third-party service providers. In addition, we perform risk management during third-party cybersecurity compromise incidents to identify and mitigate risks to us from third-party incidents.

companyName: Ribbon Communications Inc.

ticker: RBBN


text: The information security team is responsible for monitoring, managing and assessing cybersecurity risks and threats on a day-to-day basis. In particular, the information security team monitors, assesses and mitigates threats and is responsible for improving and strengthening the Company's cybersecurity environment. As discussed below, the information security team works with nationally recognized third parties and licenses various cybersecurity tools and products to assist with assessing and managing cybersecurity risks. The information security team regularly interacts and discusses cybersecurity matters with our Chief Executive Officer, Chief Financial Officer, Chief Operating Officer and General Counsel as part of our company-wide risk management system. The information security team has plans and processes in place to escalate certain cybersecurity issues to senior management and the Board or the Audit Committee, including for consideration of whether, when and how to publicly disclose any material cybersecurity event. In addition, we maintain insurance to help reduce our exposure from potential losses should a cybersecurity incident arise.

companyName: SANFILIPPO JOHN B & SON INC

ticker: JBSS


text: Although our Sponsor, Advisor, or we have not experienced any material cybersecurity events to date, cybersecurity threats could materially affect our business strategy, results of operations, or financial condition, as further discussed in our "Risk Related to Our General Business Operations and Our Corporate Structure" in Part I, Item 1A of this report. Our business is highly dependent on our ability to collect, use, store and manage organizational data. If any of our significant information and data management systems do not operate properly or are disabled, we could suffer a material disruption of our businesses, loss of investor or other sensitive data, regulatory intervention, breach of confidentiality or other contract provisions, or reputational damage. These systems may fail to operate properly or become disabled as a result of events wholly or partially beyond our control, including disruptions of electrical or communications services, natural disasters, political instability, terrorist attacks, sabotage, computer viruses, deliberate attempts to disrupt our computer systems through "hacking," "phishing," or other forms of both deliberate or unintentional cyber-attack. As our Sponsor and Advisor outsource significant portions of their information technology functions to third-party providers, such as cloud computing, we bear the risk of them having less direct control over the security and performance of those systems.

companyName: JLL Income Property Trust, Inc.


text: Notwithstanding our strong commitment to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. See Item 1A. "Risk Factors" for a discussion of our cybersecurity risks.

companyName: BLACKBAUD INC

ticker: BLKB


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our CIO and our Director of Information Security and Compliance, who has over 20 years of experience in the information technology industry and is a Certified Information Systems Security Professional (CISSP).

companyName: SPORTSMAN'S WAREHOUSE HOLDINGS, INC.

ticker: SPWH


text: Independent internal and external auditors are engaged to perform Security assessments to determine the appropriateness and effectiveness of the overall Program. Supplementary self-assessments are performed as needed or as required by regulatory guidelines. Assessment results are evaluated to determine the scope of risk on the security of the bank and are addressed in accordance with Program requirements.

companyName: Business First Bancshares, Inc.

ticker: BFST


text: A summary of the processes involved in our process of evaluating the effectiveness of information and cybersecurity controls is below.

companyName: FNB CORP/PA/

ticker: FNB


text: We believe in continuous improvement as part of the effort to optimize security, and we work to foster that culture through various initiatives: • Cybersecurity Awareness Trainings: We educate employees on best practices for online safety and for identifying potential cybersecurity threats, including by initiating quarterly training programs for our non-represented salaried workforce. • Simulated Cyberattacks: With assistance from qualified third-party experts, we periodically conduct penetration testing and tabletop exercises to test our technical controls and incident response plans. • Security Monitoring: We monitor our information technology environment with both our internal cybersecurity resources and third-party service providers. We also have processes in place to monitor the cybersecurity practices of various third-party service providers, including certain vendors that have access to our information systems or sensitive data. • Proactive Reporting and Investigation: As part of our training initiatives, we regularly educate employees on how to report any suspicious cyber activity or potential cybersecurity issues, and we investigate reported concerns.

companyName: CLEVELAND-CLIFFS INC.

ticker: CLF


text: The Sponsor does not have a board of directors, but rather, the board of directors (the "Board") of 21co Holdings Limited (formerly known as Amun Holdings Limited) ("Parent Company") provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board relies upon the Parent Company's Risk Committee for cybersecurity risk governance. The Parent Company's Risk Committee receives periodic updates regarding the overall state of the Sponsor's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Trust.

companyName: 21Shares Ethereum ETF

ticker: TETH


text: If a cybersecurity incident were to occur, we would utilize our incident response plan. This plan governs our process of assessing the incident and our internal and external communications strategy. Our response would be led by our Chief Information Officer ("CIO"), in coordination with other senior leaders. Depending on the nature and severity of an incident, we may escalate notification to our board of directors.

companyName: Excelerate Energy, Inc.

ticker: EE


text: Our CISO reports to the CIO and is generally responsible for management of cybersecurity risk and the protection and defense of our networks and systems. Our CIO, who reports to our Chief Financial Officer, has over 30 years of experience in various IT and cybersecurity leadership roles throughout the industry. Our CISO has over 24 years of experience in cybersecurity, encompassing leadership roles in cybersecurity architecture, risk and compliance, incident response, cybersecurity operations, and identity management. The CISO works with a team of cybersecurity professionals with broad experience and expertise, including in cybersecurity threat assessments and detection, mitigation technologies, cybersecurity training, incident response, cyber forensics, insider threats and regulatory compliance. This team manages and works to enhance the IT security structure with the goal of preventing significant cybersecurity incidents and increasing the resilience of our systems to minimize the business impact should an incident occur. Our CISO is informed about and monitors prevention, detection, mitigation and remediation efforts through regular communication and reporting from professionals on the information security team.

companyName: Qorvo, Inc.

ticker: QRVO


text: Following these risk assessments, we design, implement, and maintain reasonable safeguards to minimize the identified risks; reasonably address any identified gaps in existing safeguards; update existing safeguards as necessary; and monitor the effectiveness of our safeguards.

companyName: InMed Pharmaceuticals Inc.

ticker: INM


text: The Company's internal audit department routinely engages third-party cybersecurity consultants to conduct network security audits. The Company also engages other third-party consultants in a number of areas to support the assessment, identification and management of cybersecurity risks, including risk assessments, log monitoring, threat intelligence, system penetration testing, training and incident response, among others. The Company performs cybersecurity due diligence and monitoring of third-party vendors, which may include the review of System and Organization Control (SOC) reports or the results of a security questionnaire, to identify the cybersecurity controls and protections maintained by a third party.

companyName: RLI CORP

ticker: RLI


text: Company provides mandatory, quarterly (and sometimes monthly) information security training sessions to employees about current cybersecurity threats and best practices to address them, and provides regular updates to employees about emerging cybersecurity threats and preventive measures. The Company provides its employees, contractors and third parties with access to the Company's information systems and data with a written guide which contains discussions of the key concepts, potential threats, and practical solutions to ensure the confidentiality, integrity and availability of the Company's information assets. The Company also provides employees with an information guide containing essential information, best practices, and guidelines for utilizing Google Drive as a cloud backup solution for the Company's data.

companyName: Freight Technologies, Inc.

ticker: FRGT


text: Management and Cybersecurity Working Group Reporting to the Chief Operating Officer, our Chief Technology Officer, with extensive cybersecurity knowledge and skills from over 20 years of relevant work experience at Welltower and elsewhere, leads the team responsible for developing and implementing our information security program across our business. This team comprises individuals with relevant educational and technical experience, many having held similar positions with responsibility for various aspects of cybersecurity at large organizations. This team works closely with the Legal department to oversee compliance and regulatory and contractual security requirements. The Chief Technology Officer also leads our Cyber Security Working Group, which is comprised of a cross-functional team including Internal Audit, Legal, Information Technology, Risk Management and Accounting leaders. These individuals meet regularly and are informed about and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents. The Chief Technology Officer is responsible for reporting on cybersecurity and information technology to the Audit Committee.

companyName: WELLTOWER INC.

ticker: WELL


text: Our Board of Directors oversees our risk management process, including risks from cybersecurity threats. Our Board of Directors reviews strategic risk exposure, and members of our management are responsible for addressing the material risks we face on a day-to-day basis. Our Board of Directors administers its cybersecurity risk oversight function directly as a whole as well as through our Audit Committee. Our Board and our Audit Committee receive updates annually and more frequently as deemed necessary from our management on cybersecurity.

companyName: GENCO SHIPPING & TRADING LTD

ticker: GNK


text: Our management disclosure and compliance committees, which include representatives from our legal, financial and accounting and information technology ("IT") teams, meet at least quarterly to monitor potential risks and review procedures and controls relating to cybersecurity. Management periodically assesses such risks and assists in the implementation of policies and procedures related to cybersecurity risk oversight in conjunction with the Compliance and Regulatory Affairs Committee.

companyName: Evolent Health, Inc.

ticker: EVH


text: management and strategy have not formally developed and implemented a cybersecurity risk management program. However, we generally follow operating practices designed to help prevent cybersecurity risk to protect the confidentiality, integrity, and availability of the Company's data and systems and any personal health information ("PHI") that we maintain.

companyName: INVO Fertility, Inc.

ticker: IVF


text: ORIX USA maintains a Cybersecurity incident response capability that includes detailed policies, plans and modular run books and maps designed around different types of Cyber Incidents. The plan and run books are tested annually through Cybersecurity tabletop simulations where incident response technical, and executive team members go through real-world scenarios focused on current Cyber threats. ORIX USA's Cybersecurity incident response plan provides for escalation of identified Cybersecurity threats and incidents, including, as appropriate, to our management. These discussions provide a mechanism for the identification of Cybersecurity threats and incidents, assessment of Cybersecurity risk profile or certain newly identified risks relevant to our company, and evaluation of the adequacy of our Cybersecurity program, including risk mitigation, compliance and controls. ORIX USA has established a notification decision framework to determine when the notifications regarding certain cybersecurity incidents, with different severity thresholds triggering notification to different recipient groups, including our Manager and officers of LFT.

companyName: Lument Finance Trust, Inc.

ticker: LFT


text: To date, we believe that the risks from identified cybersecurity threats, including as a result of previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. Refer to the discussions under the headings "Significant disruptions in, or breaches in security of, our information technology systems have adversely affected, and in the future could adversely affect, our business" included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K, which disclosures are incorporated by reference herein.

companyName: Fortive Corp

ticker: FTV


text: Our Board of Directors is responsible for general oversight of our risk environment and associated management policies and practices. The Board of Directors has delegated to its AOC the responsibility for oversight of our major risk categories and exposures, including with respect to cybersecurity, and management's processes to monitor and control them. The AOC meets regularly throughout the year and receives and reviews various risk management reports about IT/OT cybersecurity, data security, and physical security risk management reports, and discusses these matters with appropriate management and other personnel. The CEO and CAO regularly report to the AOC and the Board of Directors about cybersecurity matters and risks as well as the adequacy and effectiveness of the cybersecurity risk management program.

companyName: WEC ENERGY GROUP, INC.

ticker: WEC


text: Monitoring and Incident Response - The Company's cybersecurity program protects against threats through use of the following measures: identifying critical assets and high-risk threats; implementing cybersecurity detection, controls and remediation practices; implementing a third-party risk management program to evaluate our critical partners' cyber posture; and evaluating our program effectiveness by performing internal and external assessments. The Company engages a third-party service provider to perform annual internal and external penetration testing under NIST special paper (SP) 800-171 requirements to identify potential gaps that require remediation. In addition, the Company utilizes several industry-standard software applications to monitor for cybersecurity threats and alert our Director of Corporate Security and IT administration of any incidents that require escalation to the SVP of IT & SCM and the Risk Management Committee. Threats and incidents identified are immediately investigated by the IT administration team and appropriate action is taken to mitigate the impact to the Company.

companyName: SkyWater Technology, Inc

ticker: SKYT


text: While we have not experienced any prior cybersecurity incidents that have materially affected us, including our operations, business strategy, results of operations, or financial condition, we experience cyber-attacks and other attempts to gain unauthorized access to our systems on a regular basis, and we anticipate continuing to be subject to such attempts. Despite our implementation of security measures, (i) our products and services, and (ii) the servers, data centers, and cloud-based solutions on which our and third-party data is stored, are vulnerable to cyber-attacks, data breaches, malware, and disruptions from unauthorized access, tampering or other theft or misuse, including by employees, malicious actors or inadvertent error. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors -Cyber-attacks, data breaches or malware may disrupt our operations, harm our operating results and financial condition, and damage our reputation or otherwise materially harm our business; and cyber-attacks or data breaches on our customers' networks, or in cloud-based services provided by or enabled by us, could result in claims of liability against us, damage our reputation or otherwise materially harm our business" and"-Vulnerabilities and critical security defects, prioritization decisions regarding remedying vulnerabilities or security defects, failure of third-party providers to remedy vulnerabilities or security defects, or customers not deploying security releases or deciding not to upgrade products, services or solutions could result in claims of liability against us, damage our reputation, or otherwise materially harm our business."

companyName: Cambium Networks Corp

ticker: CMBM


text: Our cybersecurity risk management program is managed by our current Chief Information Officer ("CIO") who reports to our Chief Financial Officer and provides regular updates to the Board. Our CIO establishes our overall Information Technology ("IT") security strategy, oversees our information, cyber, and technology security and manages our IT department, which includes our Cybersecurity team. His responsibilities include developing, implementing, and enforcing security policies to protect critical data. The head of our Cybersecurity team, our Director of Information Security, who reports to our CIO, runs the day-to-day management of our cybersecurity risks. Our IT department overall assists in implementing cybersecurity strategies and policies under the direction of the Cybersecurity team, as applicable.

companyName: PBF Energy Inc.

ticker: PBF


text: Our risk management policy includes continual monitoring by Network Center, as they manage our technical defenses. Risk assessments and penetration testing are performed on a quarterly basis to identify and mitigate potential threats. Procedures have been implemented for identifying, evaluating and addressing vulnerabilities. Additionally, vulnerability assessments are performed monthly by Network Center. An additional part of our risk management strategy is having a clear process for reporting cybersecurity incidents and the development and maintenance of an incident response plan to address and mitigate the impact of cybersecurity incidents.

companyName: Lodging Fund REIT III, Inc.


text: Our Chief Executive Officer, Assistant General Counsel and Chief Accounting Officer oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The cybersecurity risk management program includes tools and activities to prevent, detect, and analyze current and emerging cybersecurity threats, and plans and strategies to address threats and incidents.

companyName: Hall of Fame Resort & Entertainment Co

ticker: HOFV


text: The Company has not experienced a cybersecurity incident during the year ended December 31, 2024, or prior, that resulted in an interruption of our operations, known losses of critical data or otherwise had a material impact on our strategy, financial condition or results of operations. The Company's Turkish subsidiary, Anagold Madencilik Sanayi ve Ticaret Anonim irketi ("Anagold"), was the target of a minor ransomware attack in November 2022, which did not cause serious disruption to the Company's or Anagold's operations. The scope of any future incident cannot be predicted. See Item 1A. Risk Factors for more information.

companyName: SSR MINING INC.

ticker: SSRM


text: Our internal audit team performs audits of our information systems and network security. The audit scope, timing and frequency of our cybersecurity control framework is integrated into the Company's overall risk management process and the planning for, and results of, those audits are reviewed with the Audit and Finance Committee.

companyName: Endo International plc


text: cybersecurity risk management program includes the following: assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment;

companyName: AgEagle Aerial Systems Inc.

ticker: UAVS


text: The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third -party systems.

companyName: Canterbury Park Holding Corp

ticker: CPHC


text: Adherence to the ISP is of utmost importance, and any exceptions to policy must be recommended by the ISSC, approved by the Enterprise Risk Management Committee, and reported to the Board at least annually.

companyName: Sound Financial Bancorp, Inc.

ticker: SFBC


text: In addition, we incorporate reviews by our Internal Audit department and reviews by external third-party experts as part of our WISP program. Our company also undergoes periodic independent third-party maturity assessments of our cybersecurity measures and controls within our WISP program against the Cyber Risk Institute Profile standards for the financial sector. We also invest in threat intelligence, collaborate with our peers in areas of threat intelligence, vulnerability management, incident response, and drills, and are active participants in industry and government forums.

companyName: STIFEL FINANCIAL CORP

ticker: SF


text: our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; and a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.

companyName: Cuentas Inc.

ticker: CUEN


text: Everi recognizes the critical importance of developing, implementing, and maintaining the appropriate cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data and that of our customers or patrons. Everi has strategically integrated cybersecurity risk management into our broader risk management framework to establish a robust process for the monitoring and evaluation of cybersecurity risks in our business to promote a company-wide culture of cybersecurity risk management. This integration supports our efforts to assess and incorporate cybersecurity considerations into our decision-making processes.

companyName: Everi Holdings Inc.


text: Management is responsible for the operational oversight of company-wide cybersecurity strategy, policy, and standards across relevant departments to assess and help prepare us to address cybersecurity risks. As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards. Personnel at all levels and departments are made aware of our cybersecurity policies through trainings and necessary implementations.

companyName: U.S. GOLD CORP.

ticker: USAU


text: The parent company and each subsidiary are responsible for developing cybersecurity programs appropriate for their respective entities, including as may be required by applicable law or regulation. These programs have been developed based on the National Institute of Standards and Technology Cybersecurity Framework and seek to protect each entity against cybersecurity risks and foster each entity's ability to respond to cybersecurity events. Among other things, these programs generally involve maturity evaluations and assessments by third parties, vulnerability scanning, employee testing and training, technical and business team-focused tabletop exercises, incident response plans and data security assessments of third-party service providers as a part of vendor management.

companyName: LOEWS CORP

ticker: L


text: Cyber Risk Management and Strategy Under the oversight of the Board of Directors, since we do not currently have an Audit Committee, we have implemented and maintain a risk management program that includes processes for the systematic identification, assessment, management, and treatment of cybersecurity risks. Our cybersecurity oversight and operational processes are integrated into our overall risk management processes, and cybersecurity is one of our designated risk categories. We implement a risk-based approach to the management of cyber threats, supported by cybersecurity technologies, including automated tools designed to monitor, identify, and address cybersecurity risks. In support of this approach, we implement processes to assess, identify, and manage security risks to the company, including in the pillar areas of security and compliance, application security, infrastructure security, and data privacy. This process includes regular compliance and critical system access reviews. In addition, we c onduct application security assessments, vulnerability management, penetration testing, security audits, and ongoing risk assessments as part of our risk management process. We also maintain an incident response plan to guide our processes in the event of an incident.

companyName: NORTHERN MINERALS & EXPLORATION LTD.

ticker: NMEX


text: The IT Security team reports the detection, mitigation and remediation of cybersecurity incidents to executive management and the Audit Committee of the Board of Directors. If we were to experience a cybersecurity incident, our Director of IT Security will inform the rest of the IT Security Team, which will then evaluate and assess the materiality of the incident to the Company, its information technology infrastructure and data integrity, and in accordance with our incident response plan, notify executive management and the necessary finance, operations and legal team functions. The CIO would determine whether the cybersecurity incident should be reported to the Audit Committee of the Board in advance of the next scheduled cybersecurity update. Once a cybersecurity incident is reported to the Audit Committee of the Board and potentially the overall Board of Directors, the Audit Committee, with the input of the IT Security Team and executive management, will determine how to address it and whether or not the incident would require external reporting.

companyName: H&E Equipment Services, Inc.


text: Due to the type and volume of information that we collect and store to provide insurance coverage to prospective and current policyholders, we are an attractive target for cyber threat actors seeking financial gain. Our failure to maintain the safety of our policyholder's information could have a material adverse effect on our reputation, financial condition and results of operations. To date, we have not experienced a cybersecurity incident that resulted in a material adverse effect on our business strategy, results of operations, or financial condition; however, there can be no guarantee that we will not experience such an incident in the future. Although we maintain cybersecurity insurance, the costs and expenses related to cybersecurity incidents may not be fully insured. We describe whether and how risks from identified cybersecurity threats, including as a result of previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition under Item 1A. Risk Factors, General Risk Factors, "The failure to maintain effective and efficient information systems at the Company could adversely affect our financial condition and results of operations."

companyName: GLOBE LIFE INC.

ticker: GL


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") oversight of cybersecurity risks, including oversight of management's implementation of our cybersecurity risk management program.

companyName: Q32 Bio Inc.

ticker: QTTB


text: As of the date of this Report, we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition and that are required to be reported in this Report.

companyName: Astra Energy, Inc.

ticker: ASRE


text: In support of such oversight process of our Board of Directors, our management maintains robust cybersecurity management processes. Our cybersecurity function is led by our Executive Vice President, Corporate Development and Administration and our Vice President of our Business Technology Group. Our Vice President of our Business Technology Group has been with us for over 35 years in various roles related to information technology, cybersecurity and support of our business and enterprise systems. He has over 38 years of direct experience in multiple roles related to information technology and cybersecurity and a deep understanding of how information technology data and specialized software and hardware relates to our business operations. Our Vice President of our Business Technology Group also has significant experience in identifying third party cybersecurity risks and integrating acquired companies into our cybersecurity environment.

companyName: SILGAN HOLDINGS INC

ticker: SLGN


text: The Company maintains an Information Security Policy and Standards that details how material risks from cybersecurity threats are assessed, identified, and managed: • Risk assessment – a periodic risk assessment is performed by the Chief Information Security Officer using the National Institute of Standards and Technology cybersecurity framework and rates risks by criticality. • Risk identification – vulnerabilities and risks are identified through functions performed by the Chief Information Security Officer which includes assessments using automated tools, monitoring activities, reviewing threat intelligence, and responding to incidents. Risks are also identified through independent assessments performed by third-party consultants and the internal audit function. • Risk management – the Chief Technology Officer oversees a process designed to protect against and remediate risks according to their criticality and presents to the Risk Oversight and Audit Committees of the Board and management at least semi-annually. The Chief Information Security Officer also presents to the Board and Risk Oversight Committee on information technology, cybersecurity and data privacy matters at least annually.

companyName: ASSURED GUARANTY LTD

ticker: AGO


text: We also have processes to oversee and identify material risks from cybersecurity threats associated with our use of third-party service providers. Our managed security service provider performs security reviews of select third party service providers that include such provider's system and organization controls or third party security assessments. We monitor and assess the information gathered by our security tools and services to identify gaps, exposures, or weaknesses in our overall security posture, and engage reputable external specialists to provide independent assessments of our cybersecurity program and response preparedness. Further, the Company's enterprise level IT general controls are audited annually.

companyName: TreeHouse Foods, Inc.

ticker: THS


text: Management Strategy are a clinical-stage pharmaceutical company developing treatments for cannabis-induced toxicity, such as acute cannabis-induced toxicity in children, acute cannabinoid intoxication ("ACI") in adults, and the broader landscape of acute cannabis-induced conditions.

companyName: Anebulo Pharmaceuticals, Inc.

ticker: ANEB


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including under the heading "If our information technology systems or data, or those of third parties upon which we rely, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; loss of customers or sales; and other adverse consequences"

companyName: Y-mAbs Therapeutics, Inc.


text: Protecting our customers' data is a top priority for our board of directors and management team. Our risk management team, integrated into our CIS function, is led by our CISO. This team brings together extensive experience in information security, governance, and compliance, covering areas such as engineering, architecture, cybersecurity, and privacy. They are responsible for defining the program, overseeing cybersecurity governance, and gathering insights to assess, identify, and manage cybersecurity threats, their severity, and mitigations.

companyName: EGAIN Corp

ticker: EGAN


text: In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents.

companyName: STARTENGINE CROWDFUNDING, INC.


text: Management's Role Managing Risk The Vice President of IT Security and the Chief Information Officer ("CIO") play a pivotal role in informing the Audit Committee on cybersecurity risks. These individuals have over two decades of professional experience in various roles across multiple industries involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs and managing multiple industry and regulatory compliance environments. Both individuals previously held positions similar to their current roles at other large publicly traded organizations, including global retail e-commerce and mobile-commerce brands. They provide comprehensive briefings to the Audit Committee on a regular basis, with a minimum frequency of once per year. These briefings encompass a broad range of topics, including: Current cybersecurity landscape and emerging threats; Status of ongoing cybersecurity initiatives and strategies;

companyName: Planet Fitness, Inc.

ticker: PLNT


text: Material Risks & Integrated Overall Risk Management have strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. Our management team continuously evaluates and addresses cybersecurity risks in alignment with our business objectives and operational needs. In the past year we have implemented more stringent email monitoring and contracted with managed services companies in the US and Hungary.

companyName: Sharps Technology Inc.

ticker: STSS


text: Our Chief Operations Officer is primarily responsible for assessing and managing our material risks from cybersecurity threats and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. He/She stays informed about and monitors the prevention, detection, mitigation and remediation of key cybersecurity risks and incidents through various means, which may include briefings with internal and external security team members, threat intelligence and other information obtained from public or private sources and alerts and reports produced by security tools deployed in the IT environment.

companyName: DZS INC.


text: We have also established a committee of our executive leadership team to consider cybersecurity risk, mitigation strategies, and to consider trends and developments in managing the risk. Our CIO and ISD participate on this committee, which meets regularly. We have an established incident response plan led by our CIO and ISD to assess, respond, and report in the event of a cybersecurity incident. Depending on the nature and severity of the incident, the plan requires escalating notifications up to our CEO and our Board.

companyName: SMITH A O CORP

ticker: AOS


text: Griffon has a third-party risk management program regarding the cybersecurity practices of its vendors and partners that is designed to oversee, identify, and minimize material risks from cybersecurity threats associated with the use of such third parties. This program involves vetting of third parties before engagement. Regular monitoring and reviews are conducted to ensure third party vendors and partners comply with Griffon's security standards.

companyName: GRIFFON CORP

ticker: GFF


text: Scripps has implemented certain physical, administrative and technical controls to help secure its enterprise environment and products. Cybersecurity controls include, but are not limited to, the following measures: • Enforce controls that limit access based on job responsibilities and enforcing authentication measures, including strong password policies and multifactor authentication where appropriate. • Conduct exercises to ensure the company is prepared to respond to cyber incidents. • Align the cybersecurity program with the National Institute of Standards and Technology cybersecurity framework. • Scan our systems for vulnerabilities that may potentially impact our enterprise or products, categorize them based on severity and where possible, proactively address them to prevent exploitation by threat actors. • Employ a trained incident response team and a managed security service provider to identify and mitigate incidents that bypass our cybersecurity controls to minimize impact to operations.

companyName: E.W. SCRIPPS Co

ticker: SSP


text: The Company's Board of Directors devotes significant time and attention to its oversight of cybersecurity risk. Select members of the Board serve on the Information Systems Steering Committee ("ISSC"), which is responsible for approving IT strategic plans and all IT-related policies and for oversight of the information security program, among other matters. To fulfill its responsibilities, the ISSC receives periodic reports on the cybersecurity risk management program, including information security risks and incidents, emerging threats, and both internal and independent audit reports on the effectiveness of the control environment.

companyName: FIRST COMMUNITY BANKSHARES INC /VA/

ticker: FCBC


text: We rely on information systems and the data stored on them to conduct its operations. We have adopted and maintain a cybersecurity risk management program in accordance with our risk profile and business that is informed by and incorporates elements of industry standards.

companyName: HealthLynked Corp

ticker: HLYK


text: PTC conducts an annual cybersecurity maturity assessment. Periodically, we engage a third-party security consulting firm to conduct an Enterprise Security Maturity Assessment. This independent assessment provides a mechanism to benchmark our current risk profile and enables us to measure progress as we make program improvements. Identified cybersecurity risks are reviewed by the Cybersecurity Strategy Council, which ensures that risk tolerances are established and used to appropriately manage risks.

companyName: PTC INC.

ticker: PTC


text: We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations or financial condition. We also describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "We are increasingly dependent on information technology systems, infrastructure and data, and our internal computer systems, or those of our collaborators, third-party clinical research organizations or other contractors or consultants, may fail or suffer security breaches, which could result in a material disruption of our product development programs." included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K.

companyName: Entera Bio Ltd.

ticker: ENTXW


text: The Company does not have its own cybersecurity policy but relies on the policies and procedures of its Contract Research Organizations (CROs) and Software as a Service (SaaS) contractors that handle its data and software. We are committed to protecting the confidentiality, integrity, and availability of our information assets and complying with applicable laws and regulations regarding cybersecurity.

companyName: TELIX QSAM INC.


text: Blackstone maintains a comprehensive cybersecurity program, including policies and procedures designed to protect its systems, operations, and the data utilized and entrusted to it, including by us, from anticipated threats or hazards. Blackstone utilizes a variety of protective measures as a part of its cybersecurity program. These measures include, where appropriate, physical and digital access controls, patch management, identity verification and mobile device management software, new hire and annual employee cybersecurity awareness and best practices training programs, security baselines and tools to report anomalous activity, and monitoring of data usage, hardware and software.

companyName: BLACKSTONE MORTGAGE TRUST, INC.

ticker: BXMT


text: We conduct regular assessments and testing to ensure the effectiveness of these controls, especially those related to the protection of financial information. The implementation and management of these processes are integrated with the Company's overall operational risk management processes that seeks to limit our exposure to unnecessary risks across our operations.

companyName: BLUE BIOFUELS, INC.

ticker: BIOF


text: Lumen maintains an Incident Response Playbook that provides a set of guidelines for our stakeholders to follow when handling any data incident. This playbook describes how we assess incidents and how our security team shares information about such incidents with others at Lumen, including senior leadership and, if warranted, with some or all members of its Board of Directors. These escalation provisions, together with Lumen's disclosure controls and procedures, are designed to ensure that appropriate representatives throughout the Company are available to assess how to respond to such incidents and make any necessary public notifications.

companyName: QWEST CORP

ticker: CTBB


text: The Company's Board of Directors and its Risk and Compliance Committee are responsible for overseeing the Company's cybersecurity program and polices. The Company's management, led by the Chief Risk Officer and Information Security Officer in conjunction with Chief Information Officer, is responsible for designing and implementing the program. The Chief Risk Officer and Information Security Officer regularly report to the Risk and Compliance Committee regarding management's implementation of the cybersecurity program, cybersecurity risks and threat, assessments of the Company's cybersecurity systems and the planning and status of projects to strength the Company's information security. The Company's cybersecurity incident response plan requires that management promptly advise of the Risk and Compliance Committee of any material cybersecurity incident. The Chair of the Risk and Compliance Committee regularly reports to the Board on cybersecurity risks and other matters reviewed by the Committee. Board members may attend Risk and Compliance Committee meetings where cybersecurity issues are discussed and have access to the materials for each Risk and Compliance Committee meeting.

companyName: PCB BANCORP

ticker: PCB


text: Our management team's experience includes a diverse background in telecom and other industries, with decades of experience in various aspects of cybersecurity. Liberty Media's Head of Cybersecurity has more than 25 years of cybersecurity and information technology experience and holds Certified Information Security Manager and Certified in Risk and Information System Control certifications and has worked at a variety of companies, including large publicly-traded companies, implementing and managing IT and cybersecurity programs and teams, developing tools and processes to protect internal networks, customer payment systems and telecommunications networks used by customers to transmit data. Tripadvisor maintains rigorous standards for its information security leadership positions, including requiring extensive experience in building and leading cybersecurity teams and implementing enterprise-wide cybersecurity programs.

companyName: Liberty TripAdvisor Holdings, Inc.


text: Cybersecurity represents an important component of our overall approach to enterprise risk management ("ERM") and is one of the key risks identified for oversight by the Board through our annual ERM assessment. Our ERM approach generally, and our cybersecurity practices in particular, are based upon industry standards and implemented using managed security applications. We generally approach cybersecurity threats through a cross-functional approach which endeavors to: (i) prevent and mitigate cybersecurity threats to the Company; (ii) maintain the confidence of our customers, clients and business partners; (iii) preserve the confidentiality of our employee's information; and (iv) protect our IP. Vigilance: We maintain 24/7 cybersecurity threat operations designed to rapidly detect, contain and respond to cybersecurity threats and incidents.

companyName: CEVA INC

ticker: CEVA


text: • Our VP of Information Security is responsible for leading the organization's information security program, strategy and ensuring the protection of digital assets. He has over 20 years of information technology experience, including leadership experience managing global information security, IT infrastructure and networking, experience designing comprehensive cybersecurity programs and managing and mitigating high profile cybersecurity incidents to ensure best information security practices and business continuity. Additionally, he has previously served as the CISO for the City of Plano, Texas at municipal government level and as the Information Security Principal performing various strategic and technological tasks with DynCorp International. He holds a Bachelor in Economics from University of San Buenaventura, Cali, Colombia and a Master of Science in Computer Information Systems with a concentration in Security from Boston University. • Our Senior VP of Information Technology is also responsible for oversight of our information security strategy, program, and operations. He has over 20 years of information technology experience, including leadership experience managing global information security, IT infrastructure and engineering. In the past, he has served in roles as Lead Technologist for Hewlett-Packard and as Global Product Manager for the Procter and Gamble Company. He holds a Bachelor of Science degree in Computer Engineering from Universidad Sim n Bol var, Venezuela, an MBA in International Business from Xavier University and a Master of Science degree in Computer Science from University of Southern California.

companyName: StandardAero, Inc.

ticker: SARO


text: Cybersecurity risk management is overseen by Ginkgo's Chief Information Security Officer ("CISO"), who is supported by full-time information security staff. The CISO advises the executive team on the development and implementation of the information security program.

companyName: Ginkgo Bioworks Holdings, Inc.

ticker: DNA


text: The Company monitors potential cybersecurity risks through an enterprise risk "heatmap" that tracks key cybersecurity risks at divisional and enterprise levels. These key risks are characterized by various factors such as the likelihood of the Company experiencing a particular type of cybersecurity incident, the speed at which each type of cybersecurity incident could impact the Company, and management's assessment of the Company's ability to respond quickly and efficiently.

companyName: ENVIRI Corp

ticker: NVRI


text: We are ISO/IEC 27001:2013 certified and the ISO Information Security Risk Management Standard is used as a reference guide for our risk management approach. We have a designated Chief Information Security Officer (CISO) who has primary responsibility for managing our cybersecurity risks. Our CISO has more than 28 years of experience in Information Security and holds a master's degree in Information Technology. His in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies. Our CISO is assisted by a team of Information Security Officers (ISOs) and a third-party consultant who has expertise in cybersecurity, information security risk management, and information systems audit and holds various certifications including, CISA, CISM, HITRUST Certified Common Security Framework Practitioner, QSA, and CSP.

companyName: INNODATA INC

ticker: INOD