text: Our systems periodically experience directed attacks intended to lead to interruptions and delays in our service and operations as well as loss, misuse or theft of personal information (of third parties, employees, and our members) and other data, confidential information or intellectual property. However, to date these incidents have not had a material impact on our service, systems or business. Any significant disruption to our service or access to our systems could result in a loss of insurance provider customers, third-party publishers, other service providers, or consumer referrals and adversely affect our business and results of operation. Further, a penetration of our systems or a third-party's systems or misappropriation or misuse of personal information could subject us to business, regulatory, litigation and reputation risk, which could have a negative effect on our business, financial condition and results of operations. See "Risk Factors —Our business could be materially and adversely affected by a cybersecurity breach or other attack involving our computer systems or our third-party service providers."

companyName: EverQuote, Inc.

ticker: EVER


text: As part of our integrated enterprise risk management program, management reports periodically to the Audit Committee on its assessment of our risks and risk management practices, including with respect to ongoing or new cyber and information security risks. Management also reports quarterly to the Audit Committee and annually to the full board of directors on the status of our cybersecurity program, which includes key cybersecurity controls, audits, and compliance, and on any significant projects or areas of focus for the cybersecurity team.

companyName: Concentrix Corp

ticker: CNXC

secItem: Item 1C


text: As part of our broader risk management framework, we have identified the potential cybersecurity risks to our business. We have designed our business applications and hosting services to minimize the impact that cybersecurity incidents could have on our business and have identified back-up systems where appropriate. We seek to further mitigate cybersecurity risks through a combination of monitoring and detection activities, use of anti-malware applications, employee training, quality audits and communication and reporting structures, among other processes. We have an incident response plan in place that outlines containment, eradication and recovery plans in the event of a cybersecurity threat or incident.

companyName: CVRx, Inc.

ticker: CVRX


text: Members of senior management have regular meetings with the CISO and other members of Farmer Mac's information technology team to discuss and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents. The participants in these meetings also discuss their management of, and participation in, the cybersecurity risk management and strategy processes described in this report, including the operation of Farmer Mac's incident response plan.

companyName: FEDERAL AGRICULTURAL MORTGAGE CORP

ticker: AGM


text: Trulieve's cybersecurity program is managed under the management purview of our Chief Technology Officer (" CTO ") and our Senior Director of Information Security, whose team (the "Cybersecurity Team") is responsible for facilitating the enterprise-wide cybersecurity program. Our CTO has over 20 years of experience with large information technology footprints, including cybersecurity. His in-depth knowledge and expertise are instrumental in supporting our cybersecurity program and policies and overseeing our governance and compliance programs. The Information Security Governance Committee ("the IT Committee") and the Audit Committee of our Board of Directors oversee management's process for identifying and mitigating risks, including cybersecurity risks. The Audit Committee comprises board members with diverse expertise equipping them to oversee cybersecurity risks effectively.

companyName: Trulieve Cannabis Corp.

ticker: TCNNF


text: Hub operates in the transportation and logistics sector, which is subject to various cybersecurity risks that could adversely affect our business, financial condition and results of operations. We have implemented a risk-based approach aligned with industry standards to identify and assess the cybersecurity threats that could affect our business and information systems. We conduct periodic risk assessments to identify the potential impact and likelihood of various cyber scenarios, including those involving third-party service providers, and to determine the appropriate mitigation strategies and controls. We use various tools and methodologies to manage cybersecurity risk, including implementation of a business continuity process that includes a comprehensive Incident Response Protocol that is tested on a regular cadence and an information security training and awareness program. We also monitor and evaluate our cybersecurity posture and performance on an ongoing basis through regular vulnerability scans, penetration tests and threat intelligence feeds. We require third-party service providers with access to personal, confidential or proprietary information to implement and maintain comprehensive cybersecurity practices consistent with applicable legal standards and industry best practices.

companyName: Hub Group, Inc.

ticker: HUBG


text: The number and sophistication of attempts to disrupt or penetrate our systems continues to grow, specifically including the rapid increase of attempts against healthcare companies that has been observed since early 2022. To combat the ever-increasing sophistication of cyberattacks, we continuously work to improve methods for detecting and preventing attacks. We have implemented policies and procedures and developed specific training for our employees, including regular updates and reminders, to help prevent and mitigate any issues that may be caused by any attacks. Further, we regularly engage independent third-party cyber experts to test for vulnerabilities in our environment. We also conduct our own internal simulations to help assess and strengthen our defenses.

companyName: CHEMED CORP

ticker: CHE


text: We recognize that our customers have a legitimate expectation of safety and privacy when they do business with us. We deploy considerable resources to protect customer data and privacy because our business depends on our customers' trust. We recognize that there is a cost and risk associated with every piece of data our customers entrust us with, so we take measures to minimize what is collected to only what we need to provide a great experience and meet our legal and regulatory requirements. In addition, we have integrated cybersecurity risk management into our broader risk management framework through our (i) regular enterprise risk management updates to the Audit Committee, (ii) information technology and security related internal controls and (iii) incident response and vulnerability management programs.

companyName: Bark, Inc.

ticker: BARK


text: We have implemented a cross-functional approach to assessing, identifying and managing material cybersecurity threats and incidents. Our Information Systems Representative and Chief Operating Officer identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment. We use various methods designed to accomplish this task including, for example: manual and automated tools, subscriptions to reports and services that identify cybersecurity threats, analyzing reports of threats and threat actors, and evaluating threats reported to us.

companyName: Quince Therapeutics, Inc.

ticker: QNCX


text: UHS maintains a cybersecurity insurance policy that provides coverage in connection with cybersecurity incidents. However, costs and damages associated with cybersecurity incidents may not be fully insured under our insurance policy, and (to the extent otherwise covered) are subject to applicable deductibles.

companyName: UNIVERSAL HEALTH REALTY INCOME TRUST

ticker: UHT


text: Integration into our Risk Management Framework Our processes to assess, identify, and manage cybersecurity risks are expressly incorporated into our enterprise risk management (ERM) framework, which includes technology as one of the five primary risk categories addressed by the ERM framework, with cybersecurity risks being one of the three subcategories within the technology risk category. As a result, our ERM leadership team works with the Chief Information Officer (CIO) and Chief Information Security Officer (CISO) to define the top areas of risk in both the technology and cybersecurity areas, with such risks incorporated into our ERM framework and mapped to the NIST CSF. Our internal ERM leadership also meets on a quarterly basis with our technology risk working group, comprised of leaders across the information technology, information security and law departments, to monitor developments in the threat landscape so that key cybersecurity threats impacting the Company continue to be identified and prioritized.

companyName: NORFOLK SOUTHERN CORP

ticker: NSC


text: The CISO's cybersecurity experience includes over thirty years of Information Technology experience, including twenty years within the Information Security field. The CISO's Information Security roles have included security engineering, security architecture, strategy development and execution, risk and compliance management and identity and access management and incident response. The Company's CIO has over twenty years of experience, including leading digital transformation and global information technology governance. The Company's CTO has over twenty years of experience, including deep expertise in developing cutting-edge automated systems, supply chain planning, optimization and simulation, artificial intelligence and predictive analytics. Additional experience held by the CTO is described further under Information about Our Executive Officers.

companyName: HERSHEY CO

ticker: HSY


text: Incident materiality is assessed through a collaborative process involving key personnel within our organization. Responsibility for conducting a materiality assessment lies with our management team, in consultation with advice from our third-party cybersecurity consultant, as appropriate. The materiality assessment considers various factors, including financial impact, reputational risk, regulatory implications, and potential harm to third parties. Upon completion of the materiality assessment, the disclosure of incidents, including those related to contractual, regulatory, or technology/security aspects, is handled by designated members of our senior management team. We consult with outside counsel or experts as appropriate, including on materiality analysis and disclosure matters.

companyName: INNODATA INC

ticker: INOD


text: The Board of Directors, as a whole and at the committee level, oversees our enterprise risk management program, the most significant risks facing us and our processes to identify, prioritize, assess, manage, and mitigate those risks. The Audit Committee, which is comprised solely of independent directors, has been designated by our Board to oversee cybersecurity risks. The Audit Committee receives quarterly or as needed updates on cybersecurity and information technology matters and related risk exposures from our CISO and Chief Information Officer. The Board also receives regular updates from our CISO and Chief Information Officer on cybersecurity risks. In addition, we have protocols by which certain cybersecurity incidents are escalated within the Company and, where appropriate, reported in a timely manner to the Audit Committee and the Board of Directors.

companyName: loanDepot, Inc.

ticker: LDI


text: Our cybersecurity risk management and strategy processes are led by our CDO and our CISO. Such individuals have collectively over 25 years of prior work experience in various roles involving managing information security; developing cybersecurity strategy; and implementing effective information and cybersecurity programs, including governance, risk and compliance oversight for regulatory and contractual compliance. Such individuals are required by their job description to possess several relevant degrees and certifications, including the Information Systems Audit and Control Association ("ISACA") Certified Information Security Manager and the International Information System Security Certification Consortium ("ISC2") Certified Information Systems Security Professional certifications. These individuals are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan.

companyName: TrueBlue, Inc.

ticker: TBI


text: Identifying, assessing and managing cybersecurity risks is an important component of Conifer's overall enterprise risk management program. As with the management of risks generally, given our holding company structure, the management of cybersecurity risks involves coordination between the Company and its consolidated subsidiaries.

companyName: Presurance Holdings, Inc.

ticker: PRHI


text: with external cybersecurity experts to enhance our oversight and keep pace with evolving threats; and the cybersecurity capabilities of partners and third-party service providers, both prior to engaging them and on an ongoing basis.

companyName: Processa Pharmaceuticals, Inc.

ticker: PCSA


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company personnel. The Company also utilizes an external agency with long term expertise in cybersecurity. The external agency is responsible for helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, communicating key priorities to relevant personnel, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: OLD MARKET CAPITAL Corp

ticker: OMCC


text: Our Cybersecurity and Information Technology team is led by our CTO, who is responsible for cybersecurity risk management. Our CTO has held multiple leadership positions in the information technology ("IT") industry with responsibilities for and influence over cybersecurity implementation delivery.

companyName: Shapeways Holdings, Inc.


text: Our cybersecurity risk management processes are being integrated into our overall risk management processes. We are making efforts to incorporate cybersecurity considerations as a part of our business processes. We engage with external cybersecurity experts, including assessors, consultants, and auditors, to enhance our cybersecurity measures and ensure compliance with industry best practices. For example, a comprehensive cyber risk assessment, both physical and logical, was conducted by a third party, serving as an external penetration test to validate our security posture. We have established processes to oversee and manage cybersecurity risks associated with our use of third-party service providers, ensuring they adhere to our security standards. We review third-party service provider contracts to ensure they contain data privacy and security provisions, aligning with our standards and regulatory requirements. Additionally, we have established a Technology Review Committee ("TRC") tasked with the role of evaluating new software tools and technologies before their implementation. The TRC consists of experts from various domains within our organization, including information technology security, compliance, legal, and operations. This TRC conducts assessments to ensure that any new software tools meet our standards for security, compliance and operational efficiency.

companyName: Purple Innovation, Inc.

ticker: PRPL


text: Board of Directors has the ultimate oversight of the Company's risks—including cybersecurity risks—with our Audit Committee assisting the Board of Directors in its oversight of cyber and information security risks. Members of management that possess information security certifications and many years of experience work with our legal, finance and corporate governance functions to identify, define and report cybersecurity risks, policies and procedures and incident response plans. The Audit Committee receives updates on our cybersecurity program from management on a regular basis and more frequently as determined to be necessary or advisable. Updates to the Audit Committee include policies, processes, procedures and any significant developments related to the identification, mitigation and remediation of cybersecurity risks, as well as effectiveness and changes in our ability to monitor, protect, detect and respond to incidents, risk reviews and industry news briefings. The Audit Committee also ensures that management provides a cyber and information security update to the Board of Directors at least annually. Finally, in the event a material cybersecurity incident were to occur, the CEO and Director of Information Technology would brief the Audit Committee which would then be responsible for assessing the materiality of the incident and making the determination of materiality and any related disclosure.

companyName: HARROW, INC.

ticker: HROW


text: Firewalls. Our network and Computer Equipment is protected by one or more authorized firewalls, with any changes requiring approval from authorized personnel including the review and approval of an information technology ("IT") change control document. Administration of firewalls is restricted to a minimum number of authorized personnel as necessary. We also employ intrusion detection at critical points of our network. All external access to our network, or to any computing resource on our network connected to a non-Clene network (including, but not limited to the internet) must pass through a hardware firewall, appliance, or equivalent device, where all traffic between our network and external networks can be continuously controlled, monitored, and examined for any access violations.

companyName: Clene Inc.

ticker: CLNN


text: Our management team, including our Chief Legal Officer, Chief Information Officer, President, Chief Financial Officer and Vice President of Data Analytics and Information Security is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our external cybersecurity consultants. Our management team's cumulative experience includes decades of experience managing cybersecurity risks including serving in similar roles leading and overseeing cybersecurity programs at other companies. Our Chief Information Officer has served in various roles in information technology for almost 20 years and has been with us since 2013. He holds undergraduate and postgraduate degrees in computer science from Harvard University. Our Vice President of Data Analytics and Information Security has served in various roles in information technology and information security for more than 10 years. He holds an undergraduate degree in engineering science from Harvard University and postgraduate degrees in computer science from Massachusetts Institute of Technology. Our Chief Legal Officer has over 25 years of experience managing risks, including risks arising from cybersecurity threats, at several large publicly-traded technology companies. Team members who support our information security program have relevant educational and industry experience, including holding similar positions at large technology companies.

companyName: 10x Genomics, Inc.

ticker: TXG


text: Risk Assessment: Management conducts annual cybersecurity risk assessments to identify and evaluate potential threats and vulnerabilities. Management considers the likelihood and potential impact of various cybersecurity risks, considering the Company's assets, systems, and operations, to prioritize mitigation efforts. Compliance with Regulations: Management implements and maintains compliance with relevant cybersecurity regulations and standards applicable to the Company.

companyName: REGO PAYMENT ARCHITECTURES, INC.

ticker: RPMT


text: Oversight of cybersecurity and the ECSO organization is the responsibility of the Risk Committee. The Risk Committee oversees cybersecurity and other risks through reporting from management, including the Enterprise Risk Oversight Committee ("EROC"), as well as additional management-level subcommittees beneath the Risk Committee including the Technology & Security Risk Committee ("TSRC") and the Operational Risk Committee ("ORC" and, together with the EROC and TSRC, the "Management Committees"). Management Committees, which include as members the CISO and other cybersecurity leadership, have clear lines of communication with the Board and its committees. The Management Committees are designed with a purpose-driven scope and decision-making authority and are required to provide the Board with regular reporting of management's business activities and the potential risk associated with those activities. Management Committees are informed by EIM following the incident management process as per internal policies and standards.

companyName: FIRST CITIZENS BANCSHARES INC /DE/

ticker: FCNCA


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") oversight of cybersecurity, data privacy and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program and cybersecurity risk exposures, and the steps taken by management to monitor and mitigate cybersecurity risks. The Committee is composed of members of our board of directors with diverse expertise, including risk management, biotechnology, chief executive officer and chief financial officer roles, and multiple public company directorships, which has prepared them to oversee our cybersecurity risks.

companyName: AEON Biopharma, Inc.

ticker: AEON


text: Our Audit Committee is responsible for overseeing cybersecurity risks and updates our Board of Directors on cybersecurity matters as needed. The Audit Committee receives periodic updates from management regarding cybersecurity matters and is notified as promptly as practicable of significant new cybersecurity threats or incidents.

companyName: Arcadia Biosciences, Inc.

ticker: RKDA


text: We are a pre-clinical-stage biopharmaceutical company, focused on developing novel and proprietary drug delivery systems across various pain indications and treatments for CNS disorders. We have conducted a cyber security risk assessment performed by a third-party consultant and are in the process of developing a formal cybersecurity risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. The risk assessment was performed against the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF") standards.

companyName: Virpax Pharmaceuticals, Inc.

ticker: VRPX


text: We have not observed any significant impacts from known cybersecurity threats or previous incidents on our operational, strategic, or financial aspects. Nevertheless, given the unpredictable nature of cyber threats, we cannot assure complete immunity against potential future impacts.

companyName: Kaival Brands Innovations Group, Inc.

ticker: KAVL


text: We rely on third parties, including software-as-a-service and platform-as-a-services cloud vendors, for various business functions. Our third-party services providers have access to our information systems and data, and we rely on such third parties for the continuous operation of our business. We oversee these third-party service providers by conducting vendor diligence during contracting and onboarding and through ongoing monitoring. Vendors are assessed for risk based on the nature of their service, access to data and systems, and the level to which those systems and data impact our business. Based on that assessment, we conduct diligence that may include completing security questionnaires, onsite audits, and other technical and data security evaluations. Governance.

companyName: Verastem, Inc.

ticker: VSTM


text: As part of our business operations, we engage with a number of third parties, including but not limited to, online software service providers, vendors, consultants, and partners. Each of these third parties must be cleared through a formal cybersecurity risk assessment process before being allowed to integrate with our information systems, access confidential data, or provide electronic services to members of our workforce. Additionally, further scrutiny is applied during the post-assessment onboarding process in order to fine-tune access rights to limit privileges to those necessary to enable the related service, resulting in a least-privilege level of access.

companyName: WESTERN DIGITAL CORP

ticker: WDC


text: We assess our program based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). While we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business, this does not imply that we meet any particular technical standards, specifications, or requirements, and our maturity varies across our cybersecurity program.

companyName: Opendoor Technologies Inc.

ticker: OPEN


text: The Company's cybersecurity risk management strategy focuses on several areas: • Identification and Reporting: The Company has implemented a comprehensive, cross-functional approach to identifying, and managing material cybersecurity threats and incidents. The Company's program includes controls and procedures to properly alert, identify, scope, triage, escalate, contain, eradicate mitigate and recover from cybersecurity incidents by providing management visibility and to enable management to take action with respect to reporting of material incidents in a timely manner. • Technical Safeguards: Our program consists of layered defenses to enhance resiliency within the system to prevent, detect and respond to any incidents. Our perimeter security includes but is not limited to, proactive threat intelligence via our security partners, firewalls, end-point security agents, email security, vulnerability assessments and scans, proactive patching, and privileged access management. Our detection capabilities include event logging and monitoring such as unsuccessful login attempts, escalated privilege attempts, anomaly detection. Our response capabilities are supplemented by a 3rd party breach response process through our insurer's cyber panel, which includes access to a breach coach and forensic experts under a tripartite agreement to ensure coordinated response and maintain privilege; security playbooks setting forth a tactical guide to respond to cybersecurity events and threats as they occur; and recovery procedures. We have also implemented various technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including: firewalls, intrusion prevention and detection systems, anti-malware functionality, and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence, as well as outside audits and certifications. • Incident Response and Recovery Planning: The Company has established and maintains a comprehensive incident response, business continuity, and disaster recovery plans designed to address the Company's response to a cybersecurity incident. The Company conducts regular tabletop exercises to test these plans and ensure personnel are familiar with their roles in a response scenario. • Third-Party Risk Management: The Company maintains a comprehensive, risk-based approach to identifying and overseeing material cybersecurity threats presented by third parties, including vendors, service providers, and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a material cybersecurity incident affecting those third-party systems. • Education and Awareness: The Company provides regular, mandatory training for all levels of employees regarding cybersecurity threats as a means to equip the Company's employees with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes, and practices.

companyName: Canopy Growth Corp

ticker: CGC


text: The Virtual Information Security Officer (vISO), an outsourced consultant, has an over 19-year career in Information Technology, Cybersecurity and both Internal/External Audit experience. He presently holds a position of Partner of Herbein, COA Advisor & Audit, where he's held multiple positions within Information Technology and Cybersecurity.

companyName: UNITY BANCORP INC /NJ/

ticker: UNTY


text: Our Chief Financial Officer and the head of our IT department, both of whom are primarily responsible for managing our cybersecurity risks, mitigation strategies and responses to any such issues that may arise, collaborate with the Cybersecurity Committee and report to the entire Board on a quarterly basis, or more frequently as needed. Our Chief Financial Officer oversees the Company's IT department and has extensive experience in managing IT organizations and securing cybersecurity insurance coverages, which we currently maintain. The head of our IT department drives our strategic IT initiatives and cybersecurity risks assessments, drawing upon over two decades of enterprise technology management expertise.

companyName: D-Wave Quantum Inc.

ticker: QBTS


text: We have been, and continue to be, the subject of cybersecurity attacks, including unauthorized intrusion, malicious software infiltration, network disruption, and denial of service. Although we believe that we maintain a robust program of information security and controls and none of the cybersecurity incidents that we have identified to date have materially affected us, including our business strategy, results of operations, or financial condition, we cannot provide assurances that a cybersecurity incident will not materially affect us, or our business strategy, results of operations or financial condition in the future. For additional information on cybersecurity related risks, see "Item 1A. Risk Factors" of this Annual Report on Form 10-K.

companyName: AUTOMATIC DATA PROCESSING INC

ticker: ADP


text: The IS Program is managed by the CISO who reports to the Chief Operations Officer and is reviewed by regulators as well as internal auditors. An information security analyst reports to the CISO and performs security and assurance functions daily. The CIO and information technology staff support the CISO in cybersecurity operations as necessary to mitigate risks to the Company's technology infrastructure. The CISO holds two cybersecurity industry leading certifications (Certified Information Systems Security Professional and Certified Cloud Security Professional) and has more than 20 years of technology experience. The CIO has been in the information technology field for over 30 years and at various points held the following certifications: Cisco Certified Internetwork Expert, Cisco Certified Network Professional, Cisco Certified Voice Professional, Cisco Certified Design Professional, and Microsoft Certified Systems Engineer. The information security analyst has over five years of experience and holds ISC2's "Certified in Cybersecurity" certification. Information technology staff are generally subject to professional education, experience, and certification requirements, and receive education and mentoring from the CISO and CIO.

companyName: Investar Holding Corp

ticker: ISTR


text: We understand the importance of preventing, assessing, identifying and managing material risks associated with cybersecurity threats. Cybersecurity processes to assess, identify and manage risks from cybersecurity threats have been incorporated as a part of our overall risk assessment process. On a regular basis we implement into our operations these cybersecurity processes, technologies and controls to assess, identify and manage material risks. Specifically, we engage a third-party information technology and cybersecurity firm to assist with network and endpoint monitoring, cloud system monitoring and assessment of our incident response procedures. Further, we employ periodic penetration testing and tabletop exercises to inform our risk identification and assessment of material cybersecurity threats.

companyName: National Healthcare Properties, Inc.

ticker: NHPAP


text: As of the date of this Report, we are not aware of any previous cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company. While we have implemented cybersecurity measures, it is important to note that the threat landscape is constantly evolving, and new risks may emerge. A successful attack on our information or operational technology systems could have significant consequences to the business. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. No security measure is infallible. See "Risk Factors" for additional information about the risks to our business associated with a breach or compromise to our information or operational technology systems.

companyName: Select Water Solutions, Inc.

ticker: WTTR


text: The underlying processes and controls of the Company's cyber risk management program incorporate recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF"). Elite has an annual assessment performed by a third-party specialist of the Company's cyber risk management program against the NIST CSF. The annual risk assessment identifies, quantifies, and categorizes material cyber risks. In addition, the Company, in conjunction with the third-party cyber risk management specialists develop a risk mitigation plan to address such risks, and where necessary, remediate potential vulnerabilities identified through the annual assessment process.

companyName: ELITE PHARMACEUTICALS INC /NV/

ticker: ELTP


text: We have established policies and processes for assessing, identifying, and managing material risks from cybersecurity threats. We have designed and implemented an Incident Response Plan for cybersecurity and related processes that are overseen by our IT and management team. Our information security management system is ISO 27001 certified. In addition, our cybersecurity program leverages industry frameworks, including certain of those established by the National Institute of Standards and Technology (NIST).

companyName: AMBARELLA INC

ticker: AMBA


text: The Company's cybersecurity program is an integral element of the Company's overarching strategic plan. The robustness of the cybersecurity initiatives directly impact the realization of the Company's mission, vision, and goals. Aligned with the National Institute of Standards and Technology Cyber Security Framework, the Company employs a comprehensive "defense-in-depth" strategy, deploying multiple security measures to safeguard its operational environment and data integrity systems.

companyName: MIDDLESEX WATER CO

ticker: MSEX


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Executive Vice-President and Chief Financial Officer, our Vice-President of Finance and Corporate Controller and our Vice-President of Information Technology, who each have over 20 years of relevant experience.

companyName: Repare Therapeutics Inc.


text: Related to Cybersecurity Risks Our Information Security Coordinator is responsible for the maintenance of our cybersecurity risk management processes, including the day-to-day oversight of the assessment and management of cybersecurity risks. The individual who is currently in this role has approximately 20 years of experience in information security. Our Information Security Coordinator meets periodically with our Director of Operations, to discuss and review our information security and cybersecurity risk management processes.

companyName: Senti Biosciences, Inc.

ticker: SNTI


text: Our approach consists of, among other things, cybersecurity threat and vulnerability prevention, detection, mitigation and remediation of potential cybersecurity risks. We employ cybersecurity intrusion detection systems and continuous monitoring, in order to help defend against unauthorized access. We also employ identity-based access controls and identity authentication requirements. Access to the Company's data is monitored and controlled according to access control policies. Data protection and privacy practices, including data loss prevention, help to safeguard sensitive information. We have also outsourced significant elements of our information technology infrastructure; as a result, we manage independent vendor relationships with third parties who are responsible for maintaining significant elements of our information technology systems and infrastructure.

companyName: LQR House Inc.

ticker: YHC


text: Our information technology systems are protected through technological safeguards and management measures. We detect, identify, assess and mitigate cybersecurity risks by adopting standard risk management methodologies, which are developed based on the international cybersecurity management system standard ISO 27001 as well as the asset-oriented risk assessment framework. To minimize potential impact on business operations in the event of a cybersecurity incident, we have formulated, and regularly tested, our incident response plan. We also established a framework for data security and personal information protection, including measures to prevent data loss and detect and block abnormal accounts and activities, as well as systems and processes to prevent, detect and mitigate vulnerabilities. Our employees participate in regular cybersecurity training to enhance their awareness of cybersecurity risks. We engage in the periodic assessment of these processes and practices that are designed to address cybersecurity threats and incidents.

companyName: Yum China Holdings, Inc.

ticker: YUMC


text: Our cybersecurity risk management processes are supported by third-party service providers, including a managed services provider that assists the Company with, among other things, threat monitoring and cybersecurity incident response and escalation services. We rely on a third-party service provider to assist us with our cybersecurity practices, including for vulnerability assessments, penetration testing, and managing IT environments. Our process for onboarding new vendors with access to critical systems or data includes vendor questionnaires, contractual obligations, and if deemed appropriate, review of vendor audit reports.

companyName: Candel Therapeutics, Inc.

ticker: CADL


text: The Vice President, CIO provides comprehensive quarterly briefings to the Audit Committee. These briefings encompass a broad range of topics, including: • Current cybersecurity landscape and emerging threats; • Status of ongoing cybersecurity initiatives and strategies; • Incident reports and learnings from any cybersecurity events; and • Compliance with regulatory requirements and industry standards. In addition to our quarterly meetings, the Audit Committee, CIO and CEO maintain an ongoing dialogue regarding emerging or potential cybersecurity risks. The CIO and CEO provide updates on any significant developments in the cybersecurity domain, ensuring the Board's oversight is proactive and responsive. The Audit Committee actively participates in strategic decisions related to cybersecurity, as well as tabletop exercises for tactical response readiness. This involvement ensures that cybersecurity considerations are integrated into the broader strategic objectives of Tennant Company. The Audit Committee conducts an annual review of the Company's cybersecurity posture and the effectiveness of its risk management strategies. This review helps in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with the overall risk management framework.

companyName: TENNANT CO

ticker: TNC


text: We also have a cybersecurity specific risk assessment process, which helps identify our cybersecurity threat risks. As part of this process, and our processes to provide for the availability of critical data and systems, maintain regulatory compliance, identify and manage our risks from cybersecurity threats, and to protect against, detect, and respond to cybersecurity incidents, as such term is defined in Item 106(a) of Regulation S-K, we undertake the below listed activities, closely monitor emerging data protection laws and implement changes to our processes designed to comply; undertake regular reviews of our consumer facing policies and statements related to cybersecurity; proactively inform our customers of substantive changes related to customer data handling;

companyName: Serve Robotics Inc. /DE/

ticker: SERV


text: Board Governance and Management Our global cybersecurity processes are managed primarily by our CISO, whose experience includes approximately 25 years of service in roles relating to assessing, managing and providing oversight for cybersecurity risks at public and private entities; our CIO, whose experience includes managing the technology professionals and processes at public commercial real estate advisors, and our CFO, whose experience includes risk management and specialized financial knowledge. Pursuant to the Audit Committee charter, the Audit Committee oversees the management of the Company's risk management process, including the identification, prioritization, assessment and management of risks related to cybersecurity. While our Board and Audit Committee members have broad experience in risk management and in some cases technological expertise relating to cybersecurity, our CISO and CIO and management teams handle cybersecurity threat management. The CISO and CIO provide the Board and Audit Committee periodic reports regarding the Company's cybersecurity risks and threats, the status of projects to strengthen our information security systems, assessments of our information security program, and any issues associated with the emerging threat landscape. In addition, the CISO provides periodic reports to our executive officers, members of the boards of certain of our regulated entities internationally and other members of our senior management as appropriate. Material events and updates are reported to the full Board and Audit Committee annually and on an ad hoc basis where warranted based on the level of materiality of any such incidents as determined by the incident reporting and escalation process led by our CISO and CIO. Our processes are regularly evaluated by internal and external experts, with the results of those reviews reported to senior management and, where appropriate, the Board and Audit Committee.

companyName: NEWMARK GROUP, INC.

ticker: NMRK


text: Our business resiliency management program is overseen by our Board of Directors and its Operations and Technology Committee, which provides oversight of the Bank's implementation of the program and maintenance of the plans that reflect the Bank's current operating environment and risk tolerance. The implementation of our business resiliency management program is delegated to our Executive Team and their designees, and the Bank's OROC is responsible for the direct governance, oversight and monitoring of the program.

companyName: Federal Home Loan Bank of Chicago


text: For additional information on the risks we face related to cyber and information security threats, please see the related risk factor in Item 1A. Risk Factors.

companyName: FTI CONSULTING, INC

ticker: FCN


text: Annual testing from a business continuity perspective, including annual business impact analysis reviews, annual testing of all critical departments, systems and third-parties, and established back-up, replication, and restoration to help ensure continuity of operations.

companyName: National Bank Holdings Corp

ticker: NBHC


text: Senior management documents and reports to the Board (or a Board-appointed subcommittee) on the status of the information security program, which includes, but is not limited to, the following:

companyName: Prime Meridian Holding Co

ticker: PMHG


text: Risks from Cybersecurity Threats No previous cybersecurity incidents have materially affected us, including our business strategy, results of operations or financial condition. Future cybersecurity threats or incidents may materially affect our business strategy, results of operations or financial condition.

companyName: GoPro, Inc.

ticker: GPRO


text: From time to time, we have experienced immaterial cybersecurity threats and incidents. When these threats and incidents have occurred, we have taken appropriate remediation steps and, through investigation, determined that the threats or incidents did not have a material effect on our business, results of operations, or financial results.

companyName: LEGGETT & PLATT INC

ticker: LEG


text: The Audit Committee receives regular presentations and reports from our VP of Global Technology on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations. The Audit Committee then provides regular reports to the Board of Directors. The Audit Committee also receives timely updates on material and potentially material cybersecurity matters from management as part of the risk assessment process. The Audit Committee and the Board of Directors also receive timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been resolved.

companyName: Champion Homes, Inc.

ticker: SKY


text: Cybersecurity governance is a critical component of our organization's overall risk management framework and an area of focus for our Board and management. Our Board has delegated primary responsibility for overseeing risks from cybersecurity threats to the Audit Committee. The Audit Committee oversees information technology and cybersecurity, including strategies, risk identification and mitigation, and data privacy protection ("Information Security").

companyName: DYCOM INDUSTRIES INC

ticker: DY


text: In addition to utilizing the Microsoft cloud ecosystem, we have engaged a third-party service provider to enhance our cybersecurity posture further. This provider brings additional layers of security through services including: Software Security Management: Ensuring that applications such as Office 365 and Azure are configured, maintained and following best security practices.

companyName: IMPACT BIOMEDICAL INC.

ticker: IBO


text: The Company's Enterprise Risk Management Team (the "ERM Team"), led by Internal Audit, works in collaboration with the Company's Information Security Team to set the enterprise risk strategy and make risk-informed decisions, which include the assessment and response to cybersecurity risk. The Company maintains an information security, technology, and cybersecurity risk management program overseen by the Chief Information Security Officer (the "CISO") that uses a risk-based methodology to support the security, confidentiality, integrity, and availability of its information. Controls over security, confidentiality, integrity, and availability are tested by external audit agencies, resulting in the Company's HITRUST, ISO 27007/27701, SOC2, and HIPAA certifications. The Company's information security, technology, and cybersecurity risk management program provides the structure for managing the respective risks utilizing a combination of automated tools, documented processes, and third-party assessments to identify and assess potential cybersecurity risks.

companyName: ModivCare Inc

ticker: MODVQ


text: The Audit Committee receives annual reports from management on our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.

companyName: Evoke Pharma Inc

ticker: EVOK


text: Our enterprise risk management ("ERM") framework is designed to systematically integrate the assessment, identification, and handling of cybersecurity-related risks into our broader risk management strategy. This process involves an annual evaluation of the spectrum of risks facing the enterprise, including those related to cybersecurity. When elevated cybersecurity risks are detected, designated risk owners are tasked with formulating and overseeing the execution of targeted mitigation strategies.

companyName: ADTRAN Holdings, Inc.

ticker: ADTN


text: The Chief Technology Officer ("CTO") oversees the Company's information security program and is responsible for the day-to-day information risk management activities through the internal information technology team, and outside resources. The CTO, who has 32 years of Information Technology ("IT") and IT security experience, employs a team of information technology experts, including a Director of IT who is further supported by other members of the IT and technology department.

companyName: Volato Group, Inc.

ticker: SOAR


text: We maintain a critical systems vendor management program with the assistance of a third-party provider of vendor risk intelligence data, including cybersecurity vulnerabilities, business health and credit risk.

companyName: LXP Industrial Trust

ticker: LXP


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers and cloud infrastructure providers. We have a vendor management program to manage cybersecurity risks associated with our use of these providers. The program includes security questionnaires, review of the vendor's written security program, review of security assessments, and security assessment calls with the vendor's security personnel. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider. For more information regarding the risks we face from cybersecurity threats, please see "Item 1A. Risk Factors" included elsewhere in this Annual Report on Form 10-K, including "Cyber-based attacks, security breaches, loss of data and other disruptions in relation to our information systems and computer networks could compromise sensitive information related to our business, prevent us from accessing it and expose us to substantial liability, which could adversely affect our business and reputation."

companyName: Tempus AI, Inc.

ticker: TEM


text: Risks from Cybersecurity Threats The semiconductor industry faces heightened cybersecurity risks, and we have experienced and expect to continue to experience cyber-attacks. To-date, we have been successful in defending and protecting against such attacks. However, there is no assurance that we will continue to be able to be successful in protecting and defending against such attacks in the future. As of the date of this report, we are not aware of a cybersecurity incident that resulted in a material effect on our business strategy, results of operations or financial condition, but we cannot provide assurance that we will not be materially affected in the future by such risks or any future material incidents. Despite our continuing efforts, we cannot guarantee that our cybersecurity safeguards will prevent breaches or breakdowns of our or our third-party service providers' information technology systems, particularly in the face of continually evolving cybersecurity threats and increasingly sophisticated threat actors. A cybersecurity incident may materially affect our business, results of operations or financial condition, including where such an incident results in reputational, competitive or business harm or damage to our brand, lost sales, reduced demand, loss of intellectual property rights, significant costs or the Company being subject to government investigations, litigation, fines or damages. For more information, see "Our business and operations could suffer in the event of a security breach, cybersecurity incident or disruption of our information technology systems" under Item 1A. Risk Factors. Governance.

companyName: MACOM Technology Solutions Holdings, Inc.

ticker: MTSI


text: The Company evaluates third-party vendors prior to onboarding to ensure they have industry standard best practices in place and, when applicable, verified by an external audit firm. The Company monitors third-party providers for breaches or other cybersecurity events and annually review each vendor's SOC 2 audit reports.

companyName: DAILY JOURNAL CORP

ticker: DJCO


text: The CIO and CSO receive regular reports from the company's cybersecurity department, both historical and real-time, about the company's global cybersecurity status. The company believes this approach enables the CIO and CSO to monitor the company's global security status and to identify and assess potential threats. The company has established written policies and procedures to ensure that cybersecurity incidents are immediately investigated, addressed through the coordination of various internal departments, and publicly reported (to the extent required by applicable law). The company's security organization assesses the severity and priority of incidents on a rolling basis, with escalations of cybersecurity incidents provided to the management team. If management determines a cybersecurity incident is material, the company's incident response plan and its disclosure controls and procedures set forth the process for any required disclosures and require management to promptly inform the Board.

companyName: ARROW ELECTRONICS, INC.

ticker: ARW


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.

companyName: CIRTRAN CORP

ticker: CIRX


text: Our Privacy and Security Officer, Director of Information Technology, and NeuroPace leadership are responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. Our Privacy and Security Officer in coordination with our Director of Information Technology is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: NeuroPace Inc

ticker: NPCE


text: We provide regular, mandatory training for personnel regarding cybersecurity threats to educate and empower our workforce to be vigilant against threat actors and actively participate in cybersecurity efforts.

companyName: FRESH DEL MONTE PRODUCE INC

ticker: FDP


text: The Company has established the IT Steering Committee, which focuses on technology and business impact, and the Audit Committee of the board of directors, which focuses on the identification, monitoring, assessment, and management of risk associated with its cyber and information security programs. These committees provide oversight and governance of the technology program and the information security program and include the ISO and SVP/ IT Manager, respectively, and other key departmental managers throughout the entire company. The IT Steering Committee meets at least quarterly, and the Audit Committee meets at least quarterly to provide oversight of the risk management strategy, standards, policies, practices, controls, and mitigation and prevention efforts employed to manage security risks. More frequent meetings occur from time to time in accordance with the Incident Response Plan (part of the Plan) to facilitate timely informing and monitoring efforts. The ISO reports summaries of key issues, including significant cybersecurity incidents, discussed at committee meetings and the actions taken to the IT Steering Committee on at least a quarterly basis, or more frequently as may be required by the Incident Response Plan, and the board of directors on at least an annual basis.

companyName: JUNIATA VALLEY FINANCIAL CORP

ticker: JUVF


text: Our business is substantially dependent upon our computer systems, devices and networks to collect, process and store the data necessary to conduct most aspects of our business. We have developed and maintain a cybersecurity program, which includes people, processes, and technology aimed at defending our computer systems, devices and networks against increasingly sophisticated threats.

companyName: Fat Brands, Inc

ticker: FATAQ


text: The Company uses various systems to manage threats, for example, firewall protections, anti-virus protections, vulnerability scans, among others. Such systems are regularly reviewed for adequacy and potential enhancements.

companyName: El Pollo Loco Holdings, Inc.

ticker: LOCO


text: Safeguarding our information systems as well as the information that we receive and store about our customers, employees, vendors and others is a priority for Gap Inc. We maintain a cybersecurity program with technical and organizational safeguards that is designed to identify, assess, manage, mitigate and respond to cybersecurity threats, including threats associated with the use of third-party systems. The program leverages our overall enterprise risk management ("ERM") processes. Cybersecurity risk management processes are also embedded within our operating procedures, internal controls and information systems.

companyName: GAP INC

ticker: GAP


text: The business continuity management program is designed to oversee and implement resilience, continuity, and response capabilities to safeguard employees, customers, and products and services and minimize the financial loss to the Bank, ensure employee safety, and continue uninterrupted service to shareholders during a disruption event, which may include a cybersecurity related event. The business continuity management program provides for the restoration of facilities, communications, information technology systems, temporary relocation of personnel, and other components necessary for the continuity of critical Bank processes. The business continuity management program is overseen by the Board.

companyName: Federal Home Loan Bank of San Francisco


text: We have implemented controls designed to identify and mitigate cybersecurity threats associated with our use of third-party service providers, in the manner and to the extent required by our bank regulators and applicable regulations. Such third-party providers are subject to security risk assessments at the time of onboarding, and contract renewal. We use a variety of inputs in such risk assessments, including information supplied by such third-party providers and other industry sources. In addition, we require our third-party providers to meet appropriate security requirements, controls and responsibilities and to investigate and report on security incidents that have impacted their operations, as appropriate.

companyName: CVB FINANCIAL CORP

ticker: CVBF


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework Special Publication 800-53, 800-61, rev 2 ("NIST CSF). This does not imply that we meet any particular technical standards, specifications, or requirements. We use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: AgEagle Aerial Systems Inc.

ticker: UAVS


text: We voluntarily obtain third-party security examinations relating to our internal controls over financial reporting in accordance with SOC 1. Our SOC 1 examination is conducted every six months by one of the four largest independent international auditing firms, and addresses, among other areas, our physical and environmental safeguards for production data centers, data availability and integrity procedures, change management procedures and logical security procedures. We also obtain third-party examinations relating to our internal controls over security and privacy in accordance with SOC 2. Our SOC 2 examination is conducted every year and addresses, among other areas, internal controls around security, availability, processing integrity, confidentiality and privacy. We publish SOC 1 reports semiannually and SOC 2 and SOC 3 reports annually.

companyName: Paycom Software, Inc.

ticker: PAYC


text: Management has implemented a comprehensive cybersecurity program that is designed to protect our information, and that of our customers and suppliers, against cybersecurity threats that may materially and adversely affect the confidentiality, integrity, and availability of our information systems. Our cybersecurity program includes processes and standards that leverage recognized cybersecurity frameworks, industry best practices and guidance from U.S. Government security directives that focus on cybersecurity and critical infrastructure.

companyName: Phillips 66

ticker: PSX


text: The Audit Committee regularly reviews the measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. As part of such reviews, the Audit Committee receives reports and presentations from members of the Company's management team responsible for overseeing the Company's cybersecurity risk program, including the head of our global cybersecurity team. These reports and updates may address a wide range of topics, including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. The Audit Committee periodically reports to the Board on data protection and cybersecurity matters. We also have protocols by which certain cybersecurity incidents are escalated within the Company and, in certain circumstances, reported to the Board and/or Audit Committee in a timely manner.

companyName: ESAB Corp

ticker: ESAB


text: We have a global information security program responsible for creating cybersecurity policies, including an overarching Global Information Security Policy, that takes in account the National Institute of Standards & Technology Cybersecurity Framework ("NIST CSF") and regulatory requirements. Our CISO is responsible for oversight of the cybersecurity program, supervision of the members of the team, and implementation of our layered cybersecurity measures, which include a documented security architecture program, endpoint detection, security incident response and event management and recovery, and privileged access management, among others.

companyName: Aramark

ticker: ARMK


text: We have implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. We work with third-party firms to monitor our cybersecurity environment and report findings to executive leadership, internal audit and the Audit Committee regularly.

companyName: AMTECH SYSTEMS INC

ticker: ASYS


text: The program deploys multiple layers of controls designed to identify, protect against, detect, respond to and recover from information security and cybersecurity incidents and our Cyber Security Incident Response Team, which is part of our Enterprise Information Protection ("EIP") organization, plays a core role in detecting, mitigating and remediating cybersecurity incidents. Based on the nature and severity of the incident, our response is to be guided by documented incident response plans. These plans outline steps to be followed, functional areas to be engaged, internal escalations to be pursued (which may include, as appropriate, senior management, executive management and the Board) and stakeholders to be notified.

companyName: BEST BUY CO INC

ticker: BBY


text: As a regular part of our ordinary business operations, we collect and store data, including information necessary for our operations, information from our customers, employees, and our business partners. We recognize these networks and systems may be subject to increasing and continually evolving cybersecurity risks. Our Audit Committee is responsible for overseeing risk management and cybersecurity is an integral part of the Company's overall risk management program. Our risk management process is designed to identify, prioritize, and monitor risks that could affect our ability to execute our corporate strategy and fulfill our business objectives and to appropriately mitigate such risks.

companyName: Ayala Pharmaceuticals, Inc.

ticker: ADXS


text: In addition, we engage independent third-party cybersecurity providers for vulnerability assessments and penetration testing. We regularly engage these providers to aid in the identification and remediation of potential threats. We also endeavor to apprise employees of emerging risks and require them to undergo annual security awareness training, and supplemental training as needed. Additionally, we conduct periodic internal exercises to gauge the effectiveness of the training and assess the need for additional controls and/or training.

companyName: CENTURY CASINOS INC /CO/

ticker: CNTY


text: Our Cybersecurity and Privacy Committee, at the direction of and on behalf of the Board of Directors, addresses our cybersecurity risk management as part of its general oversight function. Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of management, including our Chief Technology Officer, who has 30 years of Engineering/Technology/Security experience and our Vice President of Cybersecurity, who has 24 years of Technology/Infrastructure/Security experience and maintains the Certified Information Security Manager and Certified Information Systems Security Professional certifications.

companyName: Arlo Technologies, Inc.

ticker: ARLO


text: These processes include steps for assessing the severity of a cybersecurity threat, identifying the root cause of a cybersecurity threat, including whether the cybersecurity threat is associated with a third-party service provider, implementing cybersecurity countermeasures and mitigation strategies, and informing management and our Board of material cybersecurity threats and incidents. Our information technology team is responsible for assessing our cybersecurity risk management program, and we currently do not engage third parties for such assessment.

companyName: Accel Entertainment, Inc.

ticker: ACEL


text: The cybersecurity team includes dedicated internal resources that currently have Certified Information Systems Security Professional ("CISSP") credentials, Certificate of Cloud Security Knowledge ("CCSK"), and other security and network certifications. In addition to our internal security staff, we partner with various third-party security service providers to augment our staffing, expertise, and hours of operation.

companyName: Hillman Solutions Corp.

ticker: HLMN


text: As part of our cybersecurity risk management program, we take a risk-based approach to the evaluation of third-party vendors, and apply mitigations and processes based on our evaluation of the sensitivity of the data accessed by the vendor and the maturity of the vendor’s programs. Our current vendor evaluation procedures include, as appropriate, a review of certain vendors’ security standards.

companyName: Metagenomi Therapeutics, Inc.

ticker: MGX


text: Oversee Third-party Risk Because we are aware of the risks associated with third-party service providers, we implement stringent processes to oversee and manage these risks. We conduct thorough security assessments of all third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. The monitoring includes quarterly assessments by our CTO. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third-parties. Risks from Cybersecurity Threats We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing.

companyName: Versus Systems Inc.

ticker: VS


text: To help raise employee awareness of current cybersecurity threats and tactics, in particular social engineering, we provide training to our employees so that they can help identify risks and protect our organization. Through annual training, monthly phishing simulation tests, newsletters and other information postings, we educate our employees and reinforce our processes to report any suspicious activity.

companyName: Post Holdings, Inc.

ticker: POST


text: We have developed an incident response plan outlining immediate response actions, including internal and external communication protocols. The incident response plan is reviewed regularly by our third-party consultants in collaboration with our Information Technology manager evaluating our capabilities and our readiness. Under the plan, we have identified a management group comprised of our Chief Executive Officer, Chief Financial Officer, Corporate Controller and Information Technology manager. The plan provides that any cybersecurity incident will be reviewed by this group to determine whether any such incident is material for securities laws purposes and whether public disclosure is required, following consultation with outside counsel, the Audit Committee and/or Board of Directors.

companyName: NATHANS FAMOUS, INC.

ticker: NATH


text: Cybersecurity risk may adversely impact our business. The impact could include weakened financial condition, litigation risk, degrading mining operations, loss of competitiveness, fraud, extortion, harm to employees, violation of applicable privacy or other regulations that could result in regulatory action and fines.

companyName: CLEANSPARK, INC.

ticker: CLSK


text: Our Board oversees our risk management strategy with respect to cybersecurity threats. The Board, through its audit committee, holds regular meetings, at least quarterly, to discuss issues including our cybersecurity threats. The meetings involve presentations and reports from our executive leadership and security provider, concerning our cybersecurity risk management activities, including any critical cybersecurity risks, ongoing cybersecurity initiatives and strategies, and applicable regulatory requirements and industry standards. Management also notifies the audit committee of any cybersecurity incidents (suspected or actual) and provides updates on the incidents as appropriate.

companyName: Edesa Biotech, Inc.

ticker: EDSA


text: The Adviser's cybersecurity program includes physical, administrative, and technical safeguards, as well as plans and procedures designed to help us prevent and respond to cybersecurity threats and incidents, including threats or incidents that may impact us. The Adviser's cybersecurity risk management processes seek to monitor cybersecurity vulnerabilities and potential attack vectors, evaluate the potential operational and financial effects of any threat, and mitigate such threats. We rely on the Adviser to engage with third-party consultants and key vendors to assist it in assessing, enhancing, implementing, and monitoring its cybersecurity program and risk management processes and responding to incidents.

companyName: HPS Corporate Lending Fund


text: At the management level, the CISO, who has extensive cybersecurity knowledge and skills gained from over 16 years of work experience at the Company and elsewhere, heads the cross-functional team responsible for implementing, monitoring, and maintaining cybersecurity and data protection practices across the business and reports directly to the CIO, who reports directly to the Chief Executive Officer. The CISO receives reports on cybersecurity threats from a number of experienced information security team members, each of whom is responsible for various parts of the business on an ongoing basis and, in conjunction with management, regularly reviews risk management measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. The CISO works closely with the legal team to oversee compliance with legal, regulatory and contractual security requirements.

companyName: WOLVERINE WORLD WIDE INC /DE/

ticker: WWW


text: Our Vice President of IT leads our IT department, which is responsible for assessing, identifying, and managing risks from cybersecurity threats. Our Vice President of IT reports to the Company's Chief Financial Officer, including with respect to emerging cybersecurity incidents. To facilitate effective oversight, our Vice President of IT holds discussions on cybersecurity risks, incident trends, and the effectiveness of cybersecurity measures as necessitated by emerging material cyber risks. Our VP of IT has over thirty years of IT background in a variety of industries, with experience developing security frameworks, training on cyber security best practices, and emergency response and remediation.

companyName: KLX Energy Services Holdings, Inc.

ticker: KLXE


text: Annually, we offer cybersecurity training programs to our Board. The cybersecurity trainings are designed to provide Board-level insight into cybersecurity strategy, leadership, and management in addition to organizational best practices to prepare, protect and respond against new and emerging cybersecurity risks and breaches.

companyName: Playa Hotels & Resorts N.V.


text: 2. Governance and Oversight Cybersecurity oversight is a shared responsibility between the Company's Board of Directors, senior management, and IT security leadership. The Board receives regular updates on cybersecurity risk exposure, incident response capabilities, and compliance efforts from management.

companyName: FARADAY FUTURE INTELLIGENT ELECTRIC INC.

ticker: FFAI


text: As part of our company-wide culture of security, we maintain a formal cybersecurity and information security program that is aligned with the standards set forth by the International Organization for Standardization ("ISO"), the American Institute of Certified Public Accountants in Systems and Organization Controls 2, the Criminal Justice Information Services, the Federal Risk and Authorization Management Program and the National Institute of Standards and Technology. Our Information Security Team maintains the program, which is designed to ensure proper monitoring, prevention, detection, mitigation and remediation of cybersecurity vulnerabilities, including the prompt investigation and management of all reported or discovered security events, including cybersecurity threats and incidents, in our ordinary course of business.

companyName: AXON ENTERPRISE, INC.

ticker: AXON


text: Board considers cybersecurity risk as part of its risk oversight function and has delegated the oversight of cybersecurity and other information technology risks to the Board's Audit Committee. As part of this oversight, we created the Information Security Advisory Team (the "Task Force"). The Task Force is comprised of senior managers and executives from multiple departments within the Company, including the IT, finance, legal and operations departments. The Task Force oversees our information security program and our strategy, including management's implementation of cybersecurity risk management. The Task Force meets at least quarterly to discuss matters involving cybersecurity risks.

companyName: American Bitcoin Corp.

ticker: ABTC


text: The Company's information security program is overseen by the Chief Information Security Officer ("CISO") and Information Security Office, as well as the Head of Global Technology and Operations ("HGTO"). The CISO and Information Security Office are responsible for monitoring for, and informing management of, cybersecurity incidents impacting Prudential's systems. We believe that our employees responsible for managing cybersecurity risk have the skills and knowledge to assess and manage the Company's material risks from cybersecurity threats, and their qualifications include degrees and certifications typical for cybersecurity professionals. We expect these employees to, among other things, understand computer systems, networks, and security technologies and be proficient in a variety of security tools and techniques. The CISO has served in various roles in information technology and information security for over 25 years, including serving as the head of information technology risk at two large public companies. The CISO holds a graduate degree in technology management and has attained the professional certifications of Certified Information Systems Security Professional and Certified Information Privacy Professional. For a description of the relevant expertise of the HGTO, see "Item 1. Business—Information About our Executive Officers."

companyName: PRUDENTIAL FINANCIAL INC

ticker: PRU


text: FORWARD-LOOKING STATEMENTS AND PROJECTIONS This Annual Report on Form 10-K and the information we are incorporating by reference contain statements that constitute "forward-looking statements" within the meaning of the Private Securities Litigation Reform Act of 1995. Words such as "will," "expect," "anticipate," "intend," "may," "could," "should," "plan," "project," "forecast," "believe," "estimate," "guidance," "outlook," "trends," "goals" and similar expressions generally identify these forward-looking statements. Forward-looking statements include, among other things, statements relating to our future financial condition, results of operations and/or cash flows. Forward-looking statements are based upon assumptions, expectations, plans and projections that we believe to be reasonable when made, but which may change over time. These statements are not guarantees of future performance and inherently involve a wide range of risks and uncertainties that are difficult to predict. Specific risks that could cause actual results to differ materially from those expressed or implied in these forward-looking statements include, but are not limited to, those identified under "Risk Factors" and other important factors disclosed in this report and from time to time in our other filings with the SEC. They include:

companyName: NORTHROP GRUMMAN CORP /DE/

ticker: NOC


text: The Audit Committee receives periodic reports from management, including our CTO and VP, IT. These reports encompass a broad range of topics, such as our cybersecurity risks, the current cybersecurity landscape and the status of ongoing cybersecurity initiatives. Furthermore, management informs the Audit Committee as deemed necessary, about any notable cybersecurity incidents.

companyName: Childrens Place, Inc.

ticker: PLCE


text: The Cyber Risk Disclosure Committee brings together senior management, including the CEO, CFO, General Counsel and other relevant functions to review the materiality of cyber incidents for disclosure purposes. The Cyber Risk Disclosure Committee members are also part of the Crisis Incident Management team.

companyName: ORMAT TECHNOLOGIES, INC.

ticker: ORA


text: Cybersecurity Governance; Management Cybersecurity is part of our overall risk management processes. In general, our Board oversees risk management activities designed and implemented by our management, and considers specific risks, including, for example, risks associated with our strategic plan, business operations, and capital structure. Any cybersecurity incident that occurs would be brought to the immediate attention of the Board.

companyName: TAO Synergies Inc.

ticker: TAOX


text: In late 2023, the Board of Directors delegated oversight of cybersecurity risks to the Audit Committee. The Audit Committee receives regular presentations and reports on cybersecurity risks, and prior to the Board's delegation, the Board periodically received such presentations and reports. Those presentations and reports have covered or will cover topics such as recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, and technological and peer company trends. The Audit Committee also receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, the Audit Committee discusses the Company's approach to cybersecurity risk management with the members of the management team, including the CTO and the Vice President, Engineering and Security.

companyName: Nerdy Inc.

ticker: NRDY


text: The CSO, in coordination with other members of TTEC executive leadership team, works collaboratively across the Company to implement a cybersecurity program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and respond to cybersecurity incidents.

companyName: TTEC Holdings, Inc.

ticker: TTEC


text: Our Cybersecurity consultant has extensive information technology and program management experience. We have implemented a governance structure and processes to assess, identify, manage, and report cybersecurity risks.

companyName: Silo Pharma, Inc.

ticker: SILO


text: We assess the cyber risk of potential third-party service vendors, partners, and other service providers. We evaluate third parties before onboarding and periodically afterwards or if we detect a significant change in their cyber risk rating. We also perform security assessments on third-party code libraries before internal use.

companyName: Dynatrace, Inc.

ticker: DT


text: Morgan Stanley's threat intelligence function within the Cybersecurity Program actively engages in private and public information sharing communities and leverages both commercial and proprietary products to collect a wide variety of industry and governmental information regarding the latest cybersecurity threats, which informs Morgan Stanley's cybersecurity risk assessments and strategy, including as applicable to the Company. This information is also provided to an internal Morgan Stanley forensics team, which develops and implements technologies designed to help detect these cybersecurity threats across Morgan Stanley's environment, including systems and applications that may be relied upon by the Company. Where a potential threat is identified in Morgan Stanley's environment or which impacts the Company, Morgan Stanley's incident response team evaluates the potential impact to the Firm and, as relevant, the Company, and coordinates remediation where required. These groups, as well as Morgan Stanley's Operational Risk Department, review external cybersecurity incidents that may be relevant to the Firm and the Company, and the outcomes of these incidents further inform the design of the Cybersecurity Program. In addition, Morgan Stanley maintains a robust global training program on cybersecurity risks and requirements and conducts regular training exercises for its employees and consultants, including those personnel relied upon by the Company.

companyName: Morgan Stanley Direct Lending Fund

ticker: MSDL


text: The Company leverages cybersecurity technologies designed to provide for the security of client, employee and business confidential data. The Company's cybersecurity portfolio is inclusive of, but not limited to, data encryption, data masking, leading secure software development methodologies, application and network penetration testing, incident response, digital forensics, least-privileged access controls, anti-malware, end-point detection and response, virtual private networks and cyber threat intelligence. In addition, the Company manages a 24x7 Security Operations capability that monitors and responds to cyber threats in real-time.

companyName: Donnelley Financial Solutions, Inc.

ticker: DFIN


text: Audit Committee is primarily responsible for assisting our board of directors in fulfilling its ultimate oversight responsibilities relating to risk assessment and management, including relating to cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program, including processes and policies for determining risk tolerance, and reviews management's strategies for adequately mitigating and managing identified risks, including risks relating to cybersecurity threats.

companyName: Birdie Win Corp

ticker: BRWC


text: While processes are in place to minimize the chance of a successful cyberattack, the Bank has established incident response procedures to address a cyberattack that may occur despite these safeguards. The response procedures are designed to identify, analyze, contain and remediate any such cyber incident that occurs.

companyName: Capitol Federal Financial, Inc.

ticker: CFFN


text: Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee ("Committee") oversight of overall risk assessment and management, which includes cybersecurity and other information technology risks.

companyName: Funko, Inc.

ticker: FNKO


text: Our management is responsible for day-to-day risk management, while the audit committee of our Board of Directors has responsibility for the oversight of risk management, including overseeing the management of our risks from cybersecurity threats.

companyName: Mural Oncology plc


text: Such incidents could also result in the loss of proprietary information or the exposure of sensitive customer data, leading to further financial and reputational harm.

companyName: AppTech Payments Corp.

ticker: APCX


text: Our cybersecurity risk management program includes: • physical, technological and administrative controls intended to support our cybersecurity and data governance framework, including protections designed to protect the confidentiality, integrity and availability of our key information systems; • risk assessments designed to help identify material cybersecurity risks to our critical systems and information; • designated team members are responsible for managing our cybersecurity risk assessment processes, our security controls, and our response to cybersecurity incidents; and • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls.

companyName: Galaxy Gaming, Inc.

ticker: GLXZ


text: The Board of Directors, as a whole and at the committee level, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate those risks. The Board oversees the ERM program and oversees an enterprise-wide approach to risk management, including risks related to cybersecurity.

companyName: Assertio Holdings, Inc.

ticker: ASRT


text: We complete an enterprise information risk assessment as part of our overall enterprise information security risk management assessment, which is overseen by our Director of Information Technology and Chief Operating Officer. This risk assessment is a review of internal and external threats that evaluates changes to the information risk landscape to inform the investments and program enhancements to be made in the future to rapidly respond and recover from potential attacks, including rebuild and recovery protocols for key systems. We evaluate our enterprise information security risk to ensure we address any unexpected or unforeseen changes in the risk environment or our systems and the resulting impacts are communicated to the Company's overall enterprise risk management program.

companyName: Nutex Health Inc.

ticker: NUTX


text: Matthews maintains a cybersecurity Incident Response Plan. In the event of a cybersecurity incident, designated personnel including members of Information Technology ("IT"), finance, legal, communications, human resources and any affected unit or department are responsible for assessing the severity of an incident and associated threat, containing the threat, remediating the threat, including recovery of data and access to systems, analyzing any reporting obligations associated with the incident, and performing post-incident analysis and program enhancements.

companyName: MATTHEWS INTERNATIONAL CORP

ticker: MATW


text: Cybersecurity risk management is integrated into our broader risk management framework. We have a security points of contact program, which embeds security experts into product development teams. In addition, a security council, chaired by our CISO, meets monthly to discuss the security program, security incidents, and ongoing program objectives. The council is comprised of senior leaders in product development, operations, security, quality, and services, and helps ensure that security remains a top priority across the enterprise.

companyName: VEEVA SYSTEMS INC

ticker: VEEV


text: Although the Company endeavors to mitigate cybersecurity risks, the nature of our business exposes us to cybersecurity threats and attacks that can lead to the unauthorized acquisition or access, compromise, loss, misuse or theft of our data, including personal information, confidential information or intellectual property. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the heading "Legal, Tax and Regulatory Risks."

companyName: Lovesac Co

ticker: LOVE


text: Efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents are supervised by our management team. These efforts include briefings from internal security personnel, leveraging threat intelligence and information from governmental, public, and private sources, engagement with external consultants, and utilizing alerts and reports generated by our security tools within the IT environment.

companyName: GETTY REALTY CORP /MD/

ticker: GTY


text: Our VP of IT/IS is a Certified Information Security Manager (CISM) and has more than 10 years of experience implementing cybersecurity at technology companies. Our VP of IT/IS, together with our internal IT security committee, is primarily responsible for assessing and managing our material risks from cybersecurity threats.

companyName: Fabrinet

ticker: FN


text: The program encompasses: • Risk Assessments: Regular evaluations to identify and address potential vulnerabilities and threats to the Company's systems and data. • Security Measures: Implementation of cybersecurity controls, technologies, and protocols to protect against unauthorized access and mitigate risk. • Monitoring: Surveillance of systems, networks, and potential threats to timely detect and respond to evolving cyber risks. • Incident Response: Monitors systems for unauthorized access or data breaches. Follows an incident response plan to contain, investigate, and resolve incidents as well as reports significant incidents to senior management and regulatory authorities as needed.

companyName: 5C Lending Partners Corp.


text: Our Adviser provides regular, mandatory training for its employees regarding cybersecurity threats as a means to equip its employees with effective tools to address cybersecurity threats, and to communicate our Adviser's evolving information security policies, standards, processes and practices.

companyName: NexPoint Residential Trust, Inc.

ticker: NXRT


text: The Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the Committee where it deems appropriate, regarding any cybersecurity incidents, as well as any incidents it considers to be significant or potentially significant.

companyName: NEVRO CORP


text: Our cybersecurity incident response processes are designed to escalate cybersecurity incidents to members of management depending on the circumstances, including senior management. The Company has identified and designated a group of Company employees as members of a cybersecurity incident response team, which includes the Chief Financial Officer. This team is intended to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response process also requires reporting to the audit committee about certain cybersecurity incidents.

companyName: FrontView REIT, Inc.

ticker: FVR


text: Review and provide oversight on the effectiveness of the Company's information security and privacy policies and procedures with respect to its products and services and internal-use information technology systems;

companyName: Cohen & Co Inc.

ticker: COHN


text: Our worldwide team of cyber and information security professionals undertakes a range of activities to protect its employees, assets, and reputation globally, leveraging internal and external resources to monitor cybersecurity threats to its systems and networks and to understand the broader threat environment. In support of these efforts, Our security experts use automated threat intelligence feeds and tools to increase vulnerability awareness, taking action to mitigate the highest risks.

companyName: Bunge Global SA

ticker: BG


text: The Company uses a cross-functional approach to identify, prevent, and mitigate cybersecurity threats and incidents. We have adopted controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. We have developed a formal cybersecurity incident response plan that summarizes the steps the Company will take to respond to a cybersecurity incident. The plan includes an Incident Response Team (IRT), which is responsible for addressing and coordinating all aspects of the Company's response to cybersecurity events. The IRT is supported by operating procedures and guidelines designed to outline the expectations and processes to be followed when responding to incidents of unauthorized access to confidential information maintained by the Company or its service providers. The IRT may consult legal counsel and other external experts in connection with their respective activities. An escalation process has been established for engaging other resources and appropriate reporting protocols at both the management and Board of Directors levels.

companyName: First Financial Northwest, Inc.


text: The Board of Directors receives cybersecurity status updates, training and is encouraged to engage with questions. Frequency of these cybersecurity updates are driven by the events in the world, cyber threats, and alerts received by the Bank's ISO, Management, or Technology Administrator.

companyName: River Financial Corp

ticker: RVRF


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of our management, including our Senior Director of Information Technology who has served in various roles managing information technology and information security for over twenty-five years and reports directly to the Chief Financial Officer.

companyName: ACHIEVE LIFE SCIENCES, INC.

ticker: ACHV


text: Risk from cybersecurity threats are among those that we address in the Company's general risk management program. For example, cybersecurity risk is addressed as a component of the Company's enterprise risk management program, and the security department works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.

companyName: Grindr Inc.

ticker: GRND


text: Detection and Analysis Cybersecurity incidents may be detected through a variety of means, which may include, but are not limited to, automated event-detection notifications or similar technologies which are monitored by the Franklin Templeton cyber defense team, notifications from employees, borrowers or service providers, and notifications from third party information technology system providers. Franklin Templeton also has a comprehensive threat intelligence program that performs proactive analyses leveraging internal, government and third party provided intelligence to identify and mitigate risks to the firm. Once a potential cybersecurity incident is identified, including a third party cybersecurity event, the incident response team designated pursuant to the Franklin Templeton incident response plan follows the procedures set forth in the plan to investigate the potential incident, including determining the nature of the event (e.g., ransomware or personal data breach) and assessing the severity of the event and sensitivity of any compromised data.

companyName: Franklin BSP Capital Corp

ticker: FRBP