text: To operate our business, we utilize third-party service providers to perform various functions, such as outsourced business-critical functions, professional services, SaaS platforms, cloud-based infrastructure, content delivery to third parties, and other functions. We engage reliable, reputable service providers that maintain cybersecurity programs and we conduct upfront cybersecurity reviews as part of our onboarding process for partners.

companyName: Interactive Strength, Inc.

ticker: TRNR


text: As of the date of this report, we are not aware of any cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect CTBI. However, future incidents could have a material impact on CTBI's business strategy, results of operations, or financial condition. For additional discussion of the risks posed by cybersecurity threats, see the Operational Risks/Cyber Risks section of Item 1A. Risk Factors included in this Form 10-K.

companyName: COMMUNITY TRUST BANCORP INC /KY/

ticker: CTBI

secItem: Item 1C


text: The Company utilizes a cross-functional approach to address the risk from cybersecurity threats and has formed an Information Security Leadership Group which includes management personnel from information technology, operations, legal, internal audit and other key business functions. The Information Security Leadership Group typically meets on a monthly basis, and more frequently as necessary.

companyName: VEECO INSTRUMENTS INC

ticker: VECO


text: Governance of Cybersecurity Risks From a governance perspective, our Audit Committee oversee our cybersecurity program, including the management of risks arising from cybersecurity threats. Our Audit Committee receives quarterly reports from both internal (e.g., management) and external sources (e.g., third-arty consultants), which cover topics that include, but are not limited to, recent cyber developments, evolving cyber standards, vulnerability assessments, third-party and independent reviews, the cyber threat environment, technological trends, and other cybersecurity considerations arising with respect to our company and third parties. Our GISO also keeps our executive team and our Audit Committee (if necessary) informed regarding any security incident that meets established reporting thresholds and ongoing updates regarding any such incident until it has been closed out.

companyName: Liberty Latin America Ltd.

ticker: LILA


text: We face a number of cybersecurity risks in connection with our business. Based on the information we have as of the date of this Annual Report on Form 10-K, we do not believe that any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company's business strategy, results of operations or financial position. See Item 1A, Risk Factors, of this Annual Report on Form 10-K for further discussion of cybersecurity risks.

companyName: BlueLinx Holdings Inc.

ticker: BXC


text: The Audit Committee of the Board of Directors receives quarterly reports from the Director of IT concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented (or plans to implement) to address them. The Audit Committee of the Board of Directors also may request various reports, summaries or presentations related to cybersecurity threats, risk, and mitigation.

companyName: CHIMERIX INC


text: As an externally managed BDC, our risk management function, including cybersecurity, is governed by the cybersecurity policies and procedures of the Adviser, an indirect subsidiary of Apollo. Apollo determines and implements appropriate risk management processes and strategies as it relates to cybersecurity for us and other affiliated entities managed by Apollo, and we rely on Apollo for assessing, identifying and managing material risks to our business from cybersecurity threats.

companyName: Apollo Debt Solutions BDC


text: The Audit Committee will receive updates from members of management on our cybersecurity risks at its quarterly meetings, and reviews metrics about cyber threat response preparedness, program maturity, risk mitigation status, and the current and emerging threat landscape. In addition, management will provide updates to the Audit Committee, as necessary, regarding any material cybersecurity threats or incidents, as well as any incidents with lesser impact potential.

companyName: Zeo Energy Corp.

ticker: ZEO


text: Our cybersecurity program includes technical safeguards, including automated tools managed and monitored by our cybersecurity team. Additionally, we regularly conduct penetration and vulnerability testing and tabletop exercises, along with regular employee training on cybersecurity matters. We also employ systems and processes designed to oversee, identify, and reduce the potential impact of a security incident at a third-party vendor, service provider or customer or otherwise implicating the third-party technology and systems we use.

companyName: Exodus Movement, Inc.

ticker: EXOD


text: As of December 31, 2023 and through the date of the filing of this report, we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," in this report.

companyName: Ernexa Therapeutics Inc.

ticker: ERNA


text: the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls;

companyName: Endeavor Group Holdings, Inc.


text: In the event of a cybersecurity incident, the Company has a well-defined incident response plan. This plan outlines the steps we take to detect, respond to and recover from such incidents. Throughout the reporting period, we have successfully implemented our incident response plan.

companyName: STERLING INFRASTRUCTURE, INC.

ticker: STRL


text: As part of our process to continuously improve, we utilize our internal audit, risk, and legal functions to evaluate security controls and risk management practices. We also engage third-party subject matter experts to independently assess our programs, processes and technical controls, as needed. For our regulated cyber assets associated with critical infrastructure, such as those within the scope of NERC and the NRC, regulatory auditors and inspectors monitor our adherence to mandatory cybersecurity requirements on a regular frequency using a variety of compliance monitoring and enforcement mechanisms.

companyName: CONSTELLATION ENERGY GENERATION LLC


text: We maintain policies and procedures to oversee and identify cybersecurity risks associated with our third-party service providers, especially those with access to customer and employee data. Our selection and oversight of these providers incorporate cybersecurity considerations, including contractual and other mechanisms to mitigate and continually monitor risks.

companyName: UFP INDUSTRIES INC

ticker: UFPI


text: Management is responsible for cybersecurity risk management, which is part of our enterprise risk management and business continuity processes. We regularly evaluate our cybersecurity risk profile as well as the status and activities of our cybersecurity program, which aligns to the industry-recognized Center for Internet Security or CIS framework. We employ a defense-in-depth strategy which involves multiple layers of security controls to help prevent and detect possible risks and employ measures to protect our systems from business disruption. Our cybersecurity program includes tools and activities to prevent, detect, and analyze current and emerging cybersecurity threats, as well as plans and strategies to address threats and incidents. We also engage with third-party service providers, who possess expertise in information technology and cybersecurity, to aid in the design, implementation, and management of our cybersecurity infrastructure and protocols.

companyName: WD 40 CO

ticker: WDFC


text: Infinera has implemented a robust third-party risk management program to identify and manage risks to the confidentiality, availability, and integrity of our systems and data. This includes contractual requirements related to data privacy and confidentiality, contractual commitments of third parties to maintain comprehensive security programs, and code of conduct requirements designed to ensure such third parties act ethically, responsibly, and safely. Infinera has also implemented processes to assess the effectiveness of third-party security programs and adherence to Infinera's standards both prior to engaging with a new service provider and to monitor performance on an ongoing basis.

companyName: Infinera Corp


text: Our policies outline processes for identifying, reporting, investigating, and responding to a cyber incident. In the event of such an incident, the CIRT coordinator will work with the Cyber Steering Committee to conduct a risk analysis. The committee may also engage other members of management to assess the tangible, intangible and financial impact of the incident. Any breach or cyber incident that meets certain criteria will be communicated by the Cyber Steering Committee to the Corporate Governance and Nominating Committee in a timely manner.

companyName: Urban Edge Properties

ticker: UE


text: Among our cybersecurity and risk teams, we utilize established governance mechanisms to enable a transparent and holistic approach to cybersecurity risk management, and the evaluation and remediation of cybersecurity incidents. These processes enable cross-functional engagement from our enterprise information protection, enterprise risk management, enterprise compliance, information technology, legal, privacy, and data governance teams.

companyName: HUMANA INC

ticker: HUM


text: 3.Continuous Improvement: The insights and recommendations provided by external assessors and consultants inform our ongoing efforts to strengthen our cybersecurity defenses. We prioritize the implementation of their recommendations, ensuring that our cybersecurity measures remain robust and adaptive to evolving threats.

companyName: NewtekOne, Inc.

ticker: NEWT


text: Cybersecurity incidents are evaluated by a cross-functional team based on defined criteria and regularly communicated to leadership pursuant to criteria set forth in our incident response plan and related processes. We have engaged cybersecurity and information technology third-party consultants to assist in cybersecurity incident response including forensics and technical analysis.

companyName: TE Connectivity plc

ticker: TEL


text: During the year ended March 31, 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, we may not be aware of all vulnerabilities or might not accurately assess the risks of incidents, and such preventative measures cannot provide absolute security and may not be sufficient in all circumstances or mitigate all potential risks.

companyName: LSEB Creative Corp.

ticker: LSEB


text: The Company has processes in place to assess, identify, and manage material risks from cybersecurity threats. The Company's business is dependent on the communications and information systems of the Adviser and other third-party service providers. The Adviser manages the Company's day-to-day operations and has implemented a cybersecurity program that applies to the Company and its operations. The Adviser manages the Company's day-to-day operations and has implemented a cybersecurity program that applies to the Company and its operations.

companyName: PennantPark Floating Rate Capital Ltd.

ticker: PFLT


text: We rely on sophisticated information technology systems and network infrastructure to operate and manage our business. We also maintain personally identifiable information ("PII") about our employees, and given the nature of our business, we have access to protected health information ("PHI"). Our business therefore depends on the continuous, effective, reliable, and secure operation of our computer hardware, software, networks, Internet servers, and related infrastructure. To the extent that our hardware or software malfunctions or access to our data by internal personnel, suppliers or customers through the Internet is interrupted or compromised, our business could suffer.

companyName: Beyond Air, Inc.

ticker: XAIR


text: We rely on a series of processes to identify threats, hazards, and other risks to our assets. In addition to regular risk assessments, we rely on independent assessments, audits, and cybersecurity feeds from vendors, including directly into patch and vulnerability management tools. Our processes and practices are reviewed by audits, regulators, and independent reviews of information security and cybersecurity practices and processes carried out by professional services organizations retained by us against industry requirements, such as the Federal Financial Institutions Examination Council (FFIEC) Information Technology Examination Handbooks, and the FFIEC Cybersecurity Assessment Tool. These frameworks also provide guidance that we leverage for overseeing and identifying cybersecurity threats associated with the use of third-party service providers. The Bank also retains third-party experts to conduct intrusion and penetration testing on an annual basis.

companyName: CATHAY GENERAL BANCORP

ticker: CATY


text: Our Board of Trustees is responsible for understanding the primary risks to our business, including any cybersecurity risks. The Board of Trustees/ is responsible for reviewing periodically our and the Adviser's information technology security controls and related compliance matters, with management. Sixth Street's Head of Technology Risk reports to the Board of Trustees at least annually on cybersecurity matters, including risks facing us and the Adviser and, as applicable, certain incidents. In addition to such periodic reports, the Board of Trustees may receive updates from management as to our and the Adviser's cybersecurity risks and Sixth Street cybersecurity program developments.

companyName: Sixth Street Lending Partners


text: Led by our CIO, we conduct regular assessments to identify potential cybersecurity risks and vulnerabilities, including the evaluation of systems and data assets. We have established internal procedures to stay vigilant against evolving threats by monitoring network traffic and conducting security audits. We also regularly engage independent assessors and external consultants who specialize in cybersecurity to conduct thorough, unbiased evaluations of our systems, policies, and procedures. These assessments help us ensure that our cybersecurity practices are aligned with applicable regulations and standards. To further evaluate our cybersecurity defenses, we periodically commission penetration exercises conducted by specialized firms. These tests simulate real-world attacks and assist in assessing our internal readiness and response capabilities.

companyName: DMC Global Inc.

ticker: BOOM


text: We employ a defense-in-depth approach with systems and processes designed to oversee, identify, and reduce the potential impact of a security incident against us or a third-party vendor or service provider. These include but are not limited to: multi-factor authentication, Endpoint, email, immutable backups, third party risk assessments, and other applicable controls.

companyName: Techpoint, Inc.


text: Our cybersecurity function, which comprises, in part, our IT department, legal team, human resources team and our audit committee, helps identify, assess and manage our cybersecurity threats and risks. Our cybersecurity function identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example, automated tools, subscribing to and analyzing reports and services that identify cybersecurity threats, conducting vulnerability assessments to identify vulnerabilities, and evaluating threats reported to us.

companyName: Aspira Women's Health Inc.

ticker: AWHL


text: The Committee receives quarterly reports from management on our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.

companyName: BIO-RAD LABORATORIES, INC.

ticker: BIO


text: The Audit Committee oversees the management of risks from cybersecurity threats, including the policies, processes and practices that the Company's management implements to address risks from cybersecurity threats. Management's quarterly presentations include reports on a wide range of topics including, for example, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and vendors. The Board also receives prompt and timely information regarding any cybersecurity incident that could pose a significant risk to the Company and receives ongoing updates regarding such incident until it has been addressed. At least once each year, and more frequently as required, the Board discusses the Company's approach to cybersecurity risk management with the Company's Chief Information Security Officer.

companyName: VEECO INSTRUMENTS INC

ticker: VECO


text: As part of our overall enterprise risk management processes and to better evaluate our cybersecurity risks, we are conducting a business impact analysis by leveraging what we anticipate being an annual company-wide enterprise risk management assessment to understand the relationship between our critical business operations and our information technology systems. We are partnering with third party service providers to assist us in achieving our cybersecurity goals. We also have a cyber risk insurance policy designed to help us mitigate risk exposure by offsetting costs involved with recovery and remediation after a cybersecurity breach or similar event.

companyName: 1stdibs.com, Inc.

ticker: DIBS


text: Our cybersecurity risk management strategy focuses on several areas: • Identification and Reporting: We have implemented a cross-functional approach to assessing, identifying, and managing material cybersecurity threats and incidents. Our program includes controls and procedures to identify, classify, and escalate certain cybersecurity incidents to provide management visibility and obtain direction from management as to the public disclosure and reporting of material incidents in a timely manner. • Technical Safeguards: We implement technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, and access controls, which are evaluated and improved through routine vulnerability assessments and cybersecurity threat intelligence, as well as outside audits and certifications. • Incident Response and Recovery Planning: We have established and maintain an incident response plan designed to address our response to a cybersecurity incident, and a business continuity and disaster recovery plan. We conduct annual tabletop exercises to test these plans. • Third-Party Risk Management: We maintain a risk-based approach to identifying and overseeing material cybersecurity threats presented by third parties, including vendors, service providers, as well as the systems of third parties that could adversely impact our business in the event of a material cybersecurity incident affecting those third-party systems, including any outside auditors or consultants who advise on our cybersecurity systems. • Education and Awareness: We provide regular, mandatory training for all employees regarding cybersecurity threats as a means to equip our employees with tools to make employees aware of and to address cybersecurity threats, as well as to communicate our evolving information security policies, standards, processes, and practices.

companyName: CareDx, Inc.

ticker: CDNA


text: Key elements of our cybersecurity risk management process include, but are not limited to, the following: • Risk assessments designed to help identify material risks from cybersecurity threats to our critical systems and information; • A cybersecurity team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • The use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • Cybersecurity awareness training of our workforce; • A cybersecurity incident response plan and processes for responding to cybersecurity incidents; and • Risk management processes based on our assessment of the respective risk profile of key third parties.

companyName: KLA CORP

ticker: KLAC


text: of Risks from Cybersecurity Threats of the date hereof, the Company and our service providers have not experienced cybersecurity incidents, and we are not aware of any previous cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company. However, we acknowledge that cybersecurity threats are continually evolving, and the possibility of future cybersecurity incidents remains. our security measures cannot guarantee that a significant cyberattack will not occur. A successful attack on our information technology systems could have significant consequences to our business. These measures cannot provide absolute security. No security measure is infallible. See " Risk Factors - Unauthorized disclosure, destruction or modification of data, including personal information, through cybersecurity breaches, computer viruses or otherwise or disruption of our services could expose us to liability, protracted and costly litigation and damage our reputation." for additional information about the risks to our business associated with a breach or compromise to our systems.

companyName: STRATEGIC ACQUISITIONS INC /NV/

ticker: STQN


text: The Board of Directors and the Audit Committee oversee the cyber governance process. Leadership from E&TS, including the CISO, make regular presentations to the Audit Committee and the full Board on identification, management, and remediation of cybersecurity risks, both internal and external, as well as threat intelligence, emerging global policies and regulations, cybersecurity technologies, and best practices. In addition, senior management provides briefings as needed to the Audit Committee Chair, the Audit Committee, and, as appropriate, the full Board, on cybersecurity issues and incidents of potential interest.

companyName: INTERNATIONAL BUSINESS MACHINES CORP

ticker: IBM


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment including risks associated with ransomware; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.

companyName: GRAHAM CORP

ticker: GHM


text: Our Cybersecurity Approach and Strategy Our cybersecurity approach includes consideration of information security controls in aspects of the business where unauthorized occurrences could adversely affect the confidentiality, integrity, or availability of our information systems as part of our overall risk management strategy, looking to the National Institute of Standards and Technology's Cybersecurity Framework ("NIST CSF") as a guide in how we identify, assess, and mitigate material cybersecurity risks. Cyber risk management encompasses partnerships among teams that are responsible for cybersecurity governance, prevention, detection, and remediation activities within our Company's cybersecurity environment.

companyName: Leafly Holdings, Inc. /DE


text: We also maintain procedures designed to identify and mitigate cybersecurity threats related to our use of material third-party vendors. This includes reviewing the internal controls of certain third-party service providers to assess their procedures to mitigate material cybersecurity risks, among other risks.

companyName: Alpha Teknova, Inc.

ticker: TKNO


text: To date, we have not experienced any cybersecurity incidents that have materially affected our business strategy, results of operations, or financial condition. However, we face a variety of cybersecurity threats that are reasonably likely to materially affect our company in the future, which are further described in "Item 1A. Risk Factors."

companyName: CITRINE GLOBAL, CORP.

ticker: CTGL


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a written data security incident response policy and a security incident response plan, which were first developed in 2017 and are periodically reviewed and updated.

companyName: LANDS' END, INC.

ticker: LE


text: Our Vice President of Information Technology provides quarterly briefings to the IT Governance Committee regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, and activities of third parties. Our IT Governance Committee provides regular updates to the Board of Directors on such reports.

companyName: ATECH (PARENT) RESOLUTION CORP.


text: Although we are subject to cybersecurity risks, to date, none have materially affected our company, including our business strategy, results of operations, or financial condition. Notwithstanding our cybersecurity risk program, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on our company. See Item 1A. "Risk Factors" for a discussion of cybersecurity risks.

companyName: Lineage Cell Therapeutics, Inc.

ticker: LCTX


text: In the last three fiscal years, the Company has not experienced any material cybersecurity incidents, and expenses incurred from cybersecurity incidents were immaterial. For a discussion of whether and how any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition, refer to Item 1A.

companyName: First Internet Bancorp

ticker: INBK


text: We use the National Institute of Standards and Technology Cybersecurity Framework, or NIST CSF, and the ISO 27001 framework as published by the International Organization for Standardization as guides to help us identify, assess, and manage cybersecurity risks relevant to our business. We have designed and assessed our program based on the NIST CSF and ISO 27001. This does not imply that we meet any particular technical standards, specifications, or requirements.

companyName: OMNICOM GROUP INC.

ticker: OMC


text: In accordance with the aforementioned Policy, Honda has designated its cybersecurity supervisory divisions to conduct risk assessments and report the status of cybersecurity risk responses to the Risk Management Officer through Honda's Risk Management Committee. The designated cybersecurity supervisory divisions consisted of 64 members as of the filing date of this Annual Report with practical experience in various roles related to information technology, including security, auditing, and systems are established in both the Quality Innovation Operations and Corporate Administration Operations divisions. Honda's Risk Management Officer, who has knowledge and experience in overall risk management, receives technical support from the cybersecurity risk supervisory divisions, and monitors and supervises the responses to risks from cybersecurity threats.

companyName: AMERICAN HONDA FINANCE CORP


text: The oversight of our cybersecurity is assigned to the Audit Committee of our Board of Directors. The Audit Committee receives regular reports and briefings from management on our cybersecurity threat risk management and strategy processes, including on topics such as our data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, incident response plans, and cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to these risks. In addition, management updates the Audit Committee as necessary regarding any material cybersecurity incidents as well as any incidents with lesser impact potential. The Audit Committee received one report from our Senior Director of Cybersecurity and Compliance in 2023.

companyName: Purple Innovation, Inc.

ticker: PRPL


text: To our knowledge, we have not experienced any risks from cybersecurity threats or incidents through the date of this annual report that have materially affected or are reasonably likely to materially affect the Company, its business strategy, results of operation or financial condition. This does not guarantee that future incidents or threats will not have a material impact or that we are not currently the subject of an undetected incident or threat that may have such an impact. In particular, sophisticated nation state actors have targeted critical infrastructure, and may continue to do so in the future.

companyName: GRAN TIERRA ENERGY INC.

ticker: GTE


text: The Company requires all devices used by employees to be protected with the security measures listed above. It is also Company policy that all devices be used by the employee only and any use by non-employees is prohibited.

companyName: RESERVE PETROLEUM CO

ticker: RSRV


text: Cybersecurity Governance; Management Cybersecurity is an important part of our risk management processes and an area of focus for our board of directors and management. In general, our board of directors oversees risk management activities designed and implemented by our management, and considers specific risks, including, for example, risks associated with our strategic plan, business operations, and capital structure. Our board of directors executes its oversight responsibility for risk management both directly and through delegating oversight of certain of these risks to its committees.

companyName: NexImmune, Inc.

ticker: NEXI


text: As a foundation of our approach to cybersecurity risk, we have implemented processes at several levels across our enterprise to help assess, identify and manage cybersecurity risks and incidents. Our privacy and information security policies and standards cover topics such as information sharing, privacy, data handling and data management as well as more detailed information technology ("IT") processes encompassing incident response, access control, disaster recovery and testing, among other areas. These policies and standards are regularly reviewed and updated at least annually based on the risk and regulatory environment in which we operate. We monitor closely privacy and cybersecurity, AI and operational resilience laws, regulations and guidance applicable to us. See Item 1, " Business—Regulation—Cybersecurity and Privacy " for additional details.

companyName: ARCH CAPITAL GROUP LTD.

ticker: ACGL


text: Technology and cybersecurity risks at BlackRock are also overseen by the TRCC, a dedicated management risk governance committee and sub committee of the firmwide ERC. The chair of the TRCC is appointed by the head of Enterprise Risk Management at BlackRock and its members include the CISO as well as a broad range of senior business stakeholders across BlackRock. The TRCC is responsible for oversight of BlackRock's technology and cybersecurity risk management practices and helps ensure that technology and cybersecurity risks remain within firmwide risk tolerances and technology and cybersecurity risk issues are escalated as appropriate to the ERC and other committees. The TRCC also reviews any relevant technology and cybersecurity risk related issues and helps ensure that they are appropriately escalated, reported, and remediated.

companyName: ISHARES GOLD TRUST

ticker: IAU


text: The Corporation's cybersecurity risk management program is integrated into our enterprise risk management program and is designed to expeditiously identify, analyze and protect against security threats to its computer systems, software, networks, storage devices and other technology assets. Our management team, with input from our Board of Directors, proactively manages the Corporation's cybersecurity risks to avoid or minimize the impacts of attacks by unauthorized parties attempting to obtain access to confidential information, destroy data, disrupt service, sabotage systems or cause other damage. Specifically, the Corporation has appointed a CISO to maintain a comprehensive information security program. Our strategy includes a continuous improvement mindset along with a defense in depth approach to cybersecurity. We utilize industry standards that include the NIST Cybersecurity Framework and the Financial Services Sector Cybersecurity Profile. Our layered security architecture consists of innovative technology to detect, prevent, and mitigate cybersecurity threats. Ongoing proactive analysis of cyber threat intelligence ensures that we are taking the appropriate counter measures to defend against the latest threats. We use monitoring and preventive controls to detect and respond swiftly to data breaches and cyber threats involving our systems. We regularly evaluate our systems and controls and implement upgrades as necessary. We also attempt to reduce our exposure to our vendors' data privacy and cyber incidents by performing initial vendor due diligence that is updated periodically for critical vendors, negotiating service level standards with vendors, negotiating for indemnification from vendors for confidentiality and data breaches, and limiting third-party access to the least privileged level necessary to perform outsourced functions. The additional cost to us of data and cybersecurity monitoring and protection systems and controls includes the cost of hardware and software, third-party technology providers, consulting and forensic testing firms, insurance premium costs, legal fees and the cost of personnel who focus a substantial portion of their responsibilities on data security and cybersecurity.

companyName: FULTON FINANCIAL CORP

ticker: FULT


text: The Board of Directors, as a whole and at the committee level, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate those risks. The Audit Committee, which is comprised solely of independent directors, has been designated by our Board to oversee cybersecurity risks. The Audit Committee receives regular updates on cybersecurity and information technology matters and related risk exposures from our management team. The Board also receives updates from management and the Audit Committee on cybersecurity risks on at least an annual basis.

companyName: GYRE THERAPEUTICS, INC.

ticker: GYRE


text: The potential impact of risks from cybersecurity threats are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, the Company has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes has materially affected, or are reasonably likely to materially affect, the Company, including the Company's business strategy, operational results, and financial condition.

companyName: SARATOGA INVESTMENT CORP.

ticker: SAR


text: Sixth Street conducts periodic cybersecurity risk assessments, including assessments or audits of third-party vendors, and assists with the management and mitigation of identified cybersecurity risks. The Head of Technology Risk reviews the cybersecurity framework annually as well as on an event-driven basis as necessary. The Head of Technology Risk also reviews the scope of the cybersecurity measures periodically, including in the event of a change in business practices that may implicate the security or integrity of Sixth Street's information and systems.

companyName: Sixth Street Specialty Lending, Inc.

ticker: TSLX


text: Related to Cybersecurity Risks Our board has final oversight responsibility over cybersecurity-related matters. Our Chief Information Officer (CIO) leads the full board in interactive sessions dedicated to cybersecurity risks at least once a year. These sessions address a range of cybersecurity-related topics, such as recent developments in the threat environment, the status of ongoing information security program initiatives, and cybersecurity strategy. In addition, the audit committee assists the board in fulfilling its oversight responsibilities with respect to policies relating to risk assessment and management, including the management of risks arising from cybersecurity threats. The audit committee is responsible for reporting findings related to its review of these matters to the board.

companyName: FORRESTER RESEARCH, INC.

ticker: FORR


text: The Chief Information Security Officer (CISO) whose responsibilities constitute the second line of defense provides the vision, leadership, and strategies necessary to protect the information security of the Company. The CISO manages policy, procedure, and process to ensure the execution of the Company's Information Security and Business Continuity/ Disaster Recovery (BC/DR) Programs. The CISO reports directly to the Chief Risk Officer to provide segregation between the first and second line of defense. The Information Security Department, among other duties, supervises internal employee training relating to cybersecurity risks, conducts access reviews relating to the Company's information systems, and monitors implemented security measures.

companyName: AMERISERV FINANCIAL INC /PA/

ticker: ASRV


text: We also maintain an Executive Cyber Incident Escalation Team ("ECIET"), which consists of our Chief Executive Officer ("CEO"), Chief Financial Officer ("CFO"), Chief Information Officer ("CIO") and the Chief Information Security Officer ("CISO"). The ECIET meets annually to practice and refine our processes through tabletop exercises simulating cyberattacks for incident response, management and escalation at both technical and executive levels in order to maintain readiness to respond and to identify any areas where improvements or updates to our cybersecurity infrastructure or procedures are required.

companyName: MOOG INC.

ticker: MOG-A


text: The Board of Directors, through its Risk Assessment ("RAC") and Technology ("TEC") Committees, (together the "Committees") provides direction and oversight of both the Risk Governance Framework and information/cybersecurity risk management programs. The Committees meet quarterly to review and discuss overall state, current developments, management and performance metrics, risk identification and mitigation status, and new initiatives associated with both the Risk Governance Framework and information/cybersecurity risk management programs. The Committees rely upon various management level committees (e.g. Enterprise Risk Management, Operational Risk Management, and Technology Management) for oversight and direct management of the overarching Risk Governance Framework, which includes the information/cybersecurity risk management program and direct reporting by the Chief Information Security Officer ("CISO").

companyName: FLAGSTAR BANK, NATIONAL ASSOCIATION

ticker: FLG


text: Our interim CISO brings over 20 years of experience in information technology, which enables him to ensure alignment of our cybersecurity program with our critical infrastructure strategies. He has experience in implementing and operating a governance framework and core controls in information technology. Further, he oversaw the building of our application disaster recovery infrastructure for all production applications at Equinix, and since that time has been responsible for operating this infrastructure and ongoing disaster recovery testing. All of this experience is applicable and relevant to our cybersecurity program at Equinix. Additionally, team members supporting our program have relevant education and information security experience.

companyName: EQUINIX INC

ticker: EQIX


text: Risk-based controls for information systems and information on our networks: We seek to maintain an information technology infrastructure that implements physical, administrative and technical controls that are calibrated based on risk and designed to protect the confidentiality, integrity and availability of our information systems and information stored on our networks, including customer and employee information.

companyName: ETHAN ALLEN INTERIORS INC

ticker: ETD


text: We also identify our cybersecurity threat risks by comparing our processes to standards set by NIST. To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and protect against and respond to cybersecurity incidents, we undertake the following activities: • monitor emerging data protection best practices and laws and implement changes to our processes that are designed to comply with such; • annual HIPAA security and privacy risk assessments performed with third party provider, as well as annual HIPAA compliance audits; • through our policies, practices and contracts (as applicable), require employees, as well as third parties that provide services on our behalf, to treat confidential information and data with care, and to maintain applicable compliance standards; • employ technical safeguards that are designed to protect our information systems from cybersecurity threats, including next generation firewall systems, endpoint detection and response, data loss prevention, regular air-gapped backups, and security information and event management, which are evaluated and improved through third-party real-time risk assessments and mitigation of security risks; • provide regular, mandatory training for our employees and contractors regarding cybersecurity threats as a means to equip them with effective tools, information and education to recognize and address cybersecurity threats; • conduct regular phishing email simulations for all employees and contractors with access to our email systems to enhance awareness and responsiveness to possible threats; • leverage the NIST incident handling framework to help us identify, protect, detect, respond and recover when there is an actual or potential cybersecurity incident; • carry and maintain information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident; and • document internal policies and procedures for cybersecurity incident response and recovery.

companyName: SERA PROGNOSTICS, INC.

ticker: SERA


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, contract research organizations, contract manufacturing organizations, distributors and supply chain resources. With respect to our use and oversight of third-party service providers, we use a risk-based approach to apply our cybersecurity processes according to the nature and sensitivity of the data accessed, processed, or stored by such third-party service provider and perform additional risk screenings and procedures, as appropriate. We use a number of means to assess cyber risks related to our third-party service providers, including risk assessments for each vendor, vendor security questionnaires and due diligence in connection with onboarding new vendors and ongoing reviews and due diligence with key or high-risk third-party vendors. We also seek to collect and assess cybersecurity audit reports and other supporting documentation when available and include appropriate security terms in our contracts where applicable as part of our oversight of third-party providers.

companyName: Immunovant, Inc.

ticker: IMVT


text: We take a risk-based approach to cybersecurity and have implemented cybersecurity policies throughout our operations that are designed to address cybersecurity threats and incidents. The Company's Head of Information Technology, and the Cyber Security Committee, is responsible for the establishment and maintenance of our cybersecurity program, as well as the assessment and management of cybersecurity risks. The current Head of Information Technology has over 20 years of experience in information security and possesses the education, skills, experience, and industry certifications expected by our company of an individual assigned to these duties. The Head of Information Technology provides periodic updates on our information technology environment risk, which is inclusive of our cybersecurity risk profile, to the Board of Directors, which includes the Audit Committee members.

companyName: Biomea Fusion, Inc.

ticker: BMEA


text: Technical Safeguards: The Company deploys technical safeguards that are designed to protect information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, redundant data storage and retention methods, anti-malware functionality and access controls, which are evaluated and improved through vulnerability and exposure assessments and cybersecurity threat intelligence. With the help of our third -party security firm, the Company has implemented several layers of physical security, digital security and data backup.

companyName: BIMINI CAPITAL MANAGEMENT, INC.

ticker: BMNM


text: Mandatory Cyber Training – All Six Flags team members complete a mandatory Cybersecurity Training during the onboarding process on how to identify, assess, and manage risks from cybersecurity threats. Mandatory ongoing cybersecurity training is also conducted throughout the year for all team members.

companyName: Six Flags Entertainment Corp/OLD


text: Cyber Risk Governance GS Group Inc.'s board of directors (the "GS Board") provides strategic oversight on cybersecurity matters generally, including oversight of material risks associated with cybersecurity threats. The GS Board, both directly and through its committees, including its Risk and Audit Committees, receives periodic reports and updates from an officer of Goldman Sachs regarding the overall state of the cybersecurity program, the current cybersecurity threat landscape, material risks from cybersecurity threats, cybersecurity incidents, risk management policies and/or risk assessment initiatives.

companyName: Goldman Sachs Physical Gold ETF

ticker: AAAU


text: Further discussion of the potential impacts on our business from cyber intrusions is provided in "Risk Factors" in Part I, Item 1A of this Annual Report on Form 10-K.

companyName: Terra Income Fund 6, LLC

ticker: TFSA


text: The ISO has served various roles in audit, information risk, information technology, and information security in multiple industries for over 12 years. The ISO holds an undergraduate degree in Management Information Systems and has attained the ISACA Certification in Certified Information Systems Auditor (CISA). The ISO reports to the Chief Financial Officer (CFO) as well as the Chairperson of the ERC.

companyName: LAKE SHORE BANCORP, INC.


text: Cybersecurity threats, including previous cybersecurity incidents, have not materially affected our business strategy, results of operations, or financial condition. However, cybersecurity threats have the potential to interrupt our operations or cause significant financial hardship. Our risks associated with cybersecurity threats are set forth under "Risk Factors" in Part I, Item 1A in this report.

companyName: RadNet, Inc.

ticker: RDNT


text: We regularly collect data on cybersecurity threats and risk areas and conduct periodic external penetration and other tests to assess the effectiveness of our processes and procedures. We assess risks associated with third-party providers as part of our overall cybersecurity risk management framework by reviewing system and organization controls reports, when available, and other independent reports. We also generally require third parties to, among other things, maintain security controls to protect our confidential information and to promptly notify us of material breaches that may impact our data.

companyName: MASTEC INC

ticker: MTZ


text: Our cybersecurity risk management is part of our broader enterprise risk management process, which is managed by our internal audit team with oversight from our executive leadership, and ultimately, the Audit Committee and the Board. Supported by a global team of information security professionals, we have in place a variety of tools, processes and services designed to identify the impacts of changing cybersecurity threats within our IT networks and systems and those networks and systems managed by key vendors or third parties. Cybersecurity risks are identified, quantified and mitigated by leveraging detection and preventive technologies, including security monitoring, intrusion detection and prevention systems, routine risk assessments, a vulnerability management infrastructure and a global incident response program. In addition, we also periodically consult with outside advisors and experts to anticipate future trends, such as threats and issues within the healthcare industry as well as updates on key regulatory changes, including evolving cybersecurity policies and mandates from the FDA and the Cybersecurity and Infrastructure Security Agency.

companyName: QuidelOrtho Corp

ticker: QDEL


text: The Company conducts periodic assessment and testing of the Company's policies, standards, processes, and practices in a manner intended to address cybersecurity threats and events. The results of such assessments, audits, and reviews are published in monthly cybersecurity dashboards that are shared with our CFO. On the basis of the monthly report, the CFO with the support of the VP, Information Technology evaluate and report to the Audit Committee. We review and train our employees on our cybersecurity policies, standards, processes, and practices annually or more frequently depending on needs identified within the monthly cybersecurity dashboards.

companyName: Canopy Growth Corp

ticker: CGC


text: Cybersecurity is a significant and integrated component of the Company's risk management strategy. As a financial services company, cyber threats are present and growing, and the potential exists for a cybersecurity incident to occur, which could disrupt business operations or compromise sensitive data. To date, the Company has not, to its knowledge, experienced an incident materially affecting or reasonably likely to materially affect the Company.

companyName: ECB Bancorp, Inc. /MD/

ticker: ECBK


text: The Company has established an Information and Cybersecurity program integrated into its risk management process. The program is directed by the Company's Information Security Strategy Board ("ISSB"). The purpose of the ISSB is to (i) provide management direction and support for information security risk oversight for the Company's information security program and (ii) to engage Company leaders to promote information security risk awareness and sound information security risk management practices across the organization. The ISSB has been delegated authority from the Company's Enterprise Risk Management Committee ("ERM Committee") to advance and monitor the overall effectiveness of the Company's information security program and risk management activities. The ISSB also has the authority to direct effective and timely implementation of actions to address emerging information security risks and information security risk management deficiencies. The ISSB meets at least quarterly.

companyName: COMMERCE BANCSHARES INC /MO/

ticker: CBSH


text: Our Board understands the critical importance of managing evolving risks associated with cybersecurity threats. The Board has responsibility for overseeing risks related to the cybersecurity threat landscape, including data protection and security breach readiness. Our CISO reports directly to the Chief Information Officer and is responsible for the operation of our Cybersecurity Program. Our CISO brings over 26 years of experience in information security, including the last 12 years as a Chief Information Security Officer in the retail industry. With a diverse background in both industry and consulting, our CISO has led major security programs, implementing practical strategies to protect critical data and systems.

companyName: Sally Beauty Holdings, Inc.

ticker: SBH


text: Conducting our businesses involves the collection, storage, use, disclosure, processing, transfer, and other handling of a wide variety of information, including personally identifiable information, for various purposes in our businesses. Like other comparable-sized companies that process a wide variety of information, our information technology systems, networks and infrastructure and technology have been, and may in the future be, vulnerable to cybersecurity attacks and other data security threats. As of the date of this Form 10-K, we do not believe any risks from previous cybersecurity threats have materially affected or are reasonably likely to materially affect us, including our results of operations or financial condition. However, cybersecurity attacks are constantly evolving, may be difficult to detect quickly, and often are not recognized until after they have been launched against a target. Despite our security measures, there can be no assurance that we, or the third parties with which we interact, will not experience a cybersecurity incident in the future that will materially affect us. For more information about these and other cybersecurity risks faced by us, see "Risk Factors – Risks Related to Our Business and Industry – We rely on IT systems to conduct our business, and disruption, failure or security breaches of these systems could adversely affect our business and results of operations" and "– Cybersecurity attacks on or breaches of our information technology environment could result in business interruptions, remediation costs and/or legal claims".

companyName: Shimmick Corp

ticker: SHIM


text: Our Information Technology department, led by our Senior Vice President, Information Technology, helps to detect, respond to, and manage cybersecurity threats and risks by monitoring and evaluating our threat environment using various manual and automated tools in certain environments and systems and other methods including, for example: analyzing reports of certain threats and actors; conducting scans of the threat environment; evaluating our and our industry's risk profile; evaluating certain threats reported to us; conducting internal and external audits; conducting threat assessments for certain internal and external threats; and conducting vulnerability assessments to identify vulnerabilities.

companyName: IONIS PHARMACEUTICALS INC

ticker: IONS


text: Cybersecurity is an important area of focus for our board of directors. Our audit committee is responsible for carrying out, on behalf of our board of directors, oversight of information security, including cybersecurity, risks. Our audit committee is composed of directors with diverse expertise relevant to such committee's responsibilities, and includes two directors who have expertise or certifications in cybersecurity. Our management team provides updates on cybersecurity matters to our audit committee on a quarterly basis, with more frequent or interim communications as warranted. In addition to the oversight by our audit committee, our board of directors receives an annual report on cybersecurity matters from our Chief Technology Officer, or CTO. Our Chief Compliance & Privacy Officer, or CCPO, and CTO also attend regular meetings of our board of directors, and engage in discussions on an ad hoc basis relating to cybersecurity and information security matters.

companyName: Natera, Inc.

ticker: NTRA


text: The key components of our future cybersecurity program are expected to include: conducting risk assessments to pinpoint material cybersecurity threats to our critical systems, data, products, services, and overall IT infrastructure;

companyName: NexMetals Mining Corp.

ticker: NEXM


text: Our CISO has many years of experience in creating and implementing cybersecurity risk management programs and using cybersecurity management technologies and infrastructure solutions. Our CISO works under the supervision of our CIO, who has extensive experience in information technology and cybersecurity functions. The CISO and the CIO are responsible for daily cybersecurity risk management, establishing risk management practices and executing the response plans when potential cybersecurity incidents arise. We engage a third-party service provider on a biannual basis to evaluate our cybersecurity risk management program and perform health checks on key applications. We also complete annual penetration testing to test our defenses against potential threats or risks.

companyName: COMMERCIAL METALS Co

ticker: CMC


text: We conduct ongoing monitoring of critical systems for any compromised or potentially compromised accounts, and conduct regular trainings for our employees and senior management on cyber and information security.

companyName: Benitec Biopharma Inc.

ticker: BNTC


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see "Risk Factors" in Part I, Item 1A in this Annual Report on Form 10-K.

companyName: Snap Inc

ticker: SNAP


text: We also maintain a comprehensive Security Response Policy designed to inform proper escalation of non-routine cybersecurity events and to coordinate our actions across departments. The policy sets forth, among other things, the following actions in the event of a suspected security breach: incident verification by our cybersecurity team; notification of our cybersecurity committee, which oversees incident response; assessment of potential impact and materiality; notification of our incident disclosure response team; coordination regarding internal and external communications, including preparation of disclosures on Form 8-K, as necessary; and determination of mitigation and remediation actions with the goal of restoring business continuity. Our Chief Technology Officer ("CTO") serves as security coordinator and leads our cybersecurity and information technology team. As of March 31, 2025, no known cybersecurity threats have materially affected, or are reasonably likely to materially affect our Company, including our business strategy, cash flows, financial condition or results of operations.

companyName: Hamilton Lane INC

ticker: HLNE


text: To date, we have not identified risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. That said, while we continually work to safeguard the information systems we use, and the proprietary, confidential and personal information residing therein, and mitigate potential risks, there can be no assurance that such actions will be sufficient to prevent cybersecurity incidents or mitigate all potential risks to such systems, networks, and data or those of our third party providers. See "Item 1A. Risk Factors – Our business and operations could suffer in the event of security breaches, cybersecurity incident, other unauthorized disclosures, or network disruptions."

companyName: Knowles Corp

ticker: KN


text: Board Oversight of Cybersecurity Risks The Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from the Company's CCO regarding the overall state of the Adviser's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.

companyName: Andalusian Credit Company, LLC


text: Cyber threat actors and the types of threats posed are becoming more sophisticated and effective and are increasingly targeting commercial companies. In an attempt to mitigate these cyber threats to our business, we take a comprehensive approach to cybersecurity risk management and make securing the data, customers and other stakeholders entrust to us, a top priority. The board of directors and our management are actively involved in the oversight of our risk management program, which includes cybersecurity. We have established policies, standards, processes and practices for assessing, identifying and managing material risks from cybersecurity threats. There may be instances where our policies and procedures are not properly followed or where such policies and procedures prove to be ineffective. As of the date hereof, we are not aware of any material risk from cybersecurity threats that has materially affected the Company, including our business strategy, results of operations or financial condition. We can provide no assurance that there will not be incidents in the future or that such incidents will not materially affect us, including our business strategy, results of operations, or financial condition. For more information regarding risks related to system security risks, data protection breaches and cyber-attacks, see the risk factor entitled "System security risks, data protection breaches, and cyber-attacks could compromise our proprietary information, impair customer and vendor relationships, disrupt our internal operations, harm perception of our products and expose us to litigation and/or regulatory penalties, which could have a material adverse effect on our business and our reputation" included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K.

companyName: CPI Card Group Inc.

ticker: PMTS


text: As of February 23, 2024, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. While we have not been materially affected by known cybersecurity threats affecting the Company, we and our hotel managers continue to face risks from cybersecurity threats that, if realized, could materially adversely affect us in the future. For more information on the risks related to cybersecurity threats, including threats faced by our hotel managers, see Part 1 Item 1A. "Risk Factors — Cyber threats and the risk of data breaches or disruptions of our managers' or our own information technology systems, or the information technology systems of third parties on which we or our managers rely, could materially adversely affect our business and results."

companyName: HOST HOTELS & RESORTS L.P.


text: The Board of Directors of the Company oversees the Company's risk management program as part of its general oversight function. The Board of Directors has delegated to the Audit Committee of the Board of Directors of the Company the responsibility for reviewing and discussing with management the Company's policies with respect to risk assessment and risk management and for reviewing contingent risks that may be material to the Company, including cybersecurity risks. The Audit Committee engages in regular discussions with the Company's executive officers regarding the Company's significant risk exposures and the measures implemented to monitor and control these risks, including cybersecurity risks. The Audit Committee also reports relevant material information regarding any such risks to the Board of Directors. The Company's executive officers are responsible for identifying and assessing material risks for the business on an ongoing basis, including cybersecurity risks. Although the Company's executive officers do not have cybersecurity expertise, their experience managing the Company, which includes consulting and coordinating as necessary with its service providers, enables them to effectively assess and manage material risks from cybersecurity threats.

companyName: AMREP CORP.

ticker: AXR


text: As part of its overall responsibility for oversight of our enterprise risk management, our Board of Directors reviews material risks to our Company, including risks from cybersecurity threats. The Board has designated our Audit Committee and Technology Committee with joint oversight over our information technology internal controls, cybersecurity, business continuity and disaster recovery programs.

companyName: HUMANA INC

ticker: HUM


text: We believe cybersecurity is critical to advancing our technological advancements. As a biopharmaceutical company, we face a multitude of cybersecurity threats that range from common attacks to most industries, such as ransomware and denial-of service. Our customers, suppliers, subcontractors, and business partners face similar cybersecurity threats, and a cybersecurity incident impacting us or any of these entities could materially adversely affect our operations, performance, and results of operations. These cybersecurity threats and related risks make it imperative that we expend resources on cybersecurity.

companyName: Silo Pharma, Inc.

ticker: SILO


text: • Role-based access controls to identify, authenticate and authorize individuals to access systems based on their job responsibilities; • Business resiliency planning with disaster recovery and business continuity testing; • Testing of new products and services and major changes to existing products and services to identify potential security vulnerabilities before release; • Protection, including encryption, for the secure communication of sensitive data; • Regular, proactive privacy and cybersecurity reviews of systems and applications, including third-party security practices; • Auditing of applicable data policies; • Regular internal and external security audits and penetration tests by third-party security vendors, as well as internal offensive team penetration testing; • At least annual security awareness training and testing of our employees; and • Monitoring emerging laws and regulations related to data protection and information security and implementing appropriate changes.

companyName: Jamf Holding Corp.

ticker: JAMF


text: To date, there have been no risks identified from cybersecurity threats or previous cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company. However, despite all of the above aforementioned efforts, a cyberattack, if it occurred, could cause system operational problems, disrupt service to clinical trial sites, compromise important data or systems or result in an unintended release of confidential information. See "Item 1A. Risk Factors" for additional discussion of cybersecurity risks impacting our Company.

companyName: Safe Pro Group Inc.

ticker: SPAI


text: During the fiscal year of this Report, the Company has not identified risks from cybersecurity threats, including as a result of prior cybersecurity incidents that individually or in the aggregate have materially affected or are reasonably anticipated to materially affect the organization. Nevertheless, the Company recognizes cybersecurity threats are ongoing and evolving, and we continue to remain vigilant. For more information on the Company's cybersecurity-related risks, see "Item 1A. Risk Factors – Risks Related to Cybersecurity, Third-Parties and Technology." Any prior incidents enabled us to enhance our operational and cybersecurity risk management practices. The lessons learned have also informed the Company's approach to conducting tabletop exercises simulating potential cyber threats, allowing the Company to assess and improve its response protocols.

companyName: Stellar Bancorp, Inc.

ticker: STEL


text: Our board of directors oversees risks from cybersecurity threats and has delegated responsibility for such oversight of cybersecurity matters to the audit committee. The audit committee receives periodic updates from TIAA's cybersecurity leadership regarding the overall state of TIAA's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting us.

companyName: Nuveen Global Cities REIT, Inc.


text: The ERM Working Group provides executive management oversight, from a risk perspective, of information systems security. As referenced above, the CIO provides information security updates to the ERM Working Group at each meeting. In addition, as discussed below, the Company has implemented an Incident Response Plan to provide a structured and systematic incident response process for information security incidents that affect any of the information technology systems, network, or data of the Company. The Incident Response Plan is implemented and maintained by the CIO and ISO and is subject to annual review and approval by the ERM Working Group. Cybersecurity metrics are reported to both management level committees and the ERM Committee and ERM Working Group on a quarterly basis.

companyName: NB Bancorp, Inc.

ticker: NBBK


text: Our Head of Information Security is primarily responsible for assessing and managing our material risks from cybersecurity threats. He has worked in various roles pertaining to cybersecurity for more than fifteen years and possesses a Certified Information Systems Security Professional (CISSP) certification.

companyName: Sana Biotechnology, Inc.

ticker: SANA


text: Our Board of Directors is responsible for overseeing our cyber security risk management and strategy. Our senior leadership, including our Chief Executive Officer and Principal Financial Officer, frequently meets with and provides informative updates to our Board of Directors regarding our cybersecurity risks and activities, including any recent cyber security incidents and related responses, cybersecurity systems testing, and activities of third parties.

companyName: International Stem Cell CORP

ticker: ISCO


text: The Committee and Subcommittee each conduct both regular quarterly and as-needed meetings throughout the year during which members of the CIM's IT Department provide updates and report on meaningful cybersecurity risks, threats, incidents and vulnerabilities in accordance with the Committee's and the Subcommittee's respective reporting frameworks, as well as related priorities, mitigation and remediation activities, financial and employee resource levels, regulatory compliance, technology trends and third-party provider risks. To help inform this reporting framework, CIM maintains incident response plans and other policies and procedures designed to respond to, mitigate and remediate cybersecurity incidents based on the potential impact to CIM's business, IT systems, network or data, including data held by third parties, or to the IT or other critical services provided by third-party vendors and service providers.

companyName: CIM Opportunity Zone Fund, L.P.


text: Risks and Business Impact To date, the Company has not been subject to cyberattacks that, individually or in the aggregate, have been material to our operations or financial condition. We do not believe that risks from cybersecurity threats are reasonably likely to materially affect our strategy, results of operations or financial condition over the long term. See the discussion of cybersecurity risk in Item 1A, "Risk Factors."

companyName: UNIVERSAL INSURANCE HOLDINGS, INC.

ticker: UVE


text: Although we have continued to invest in our due diligence, onboarding, and monitoring capabilities over external partners with whom we do business, including our third-party vendors and service providers, our control over the security posture of, and ability to monitor the cybersecurity practices of, such external partners remains limited, and there can be no assurance that we can prevent, mitigate, or remediate the risk of any compromise or failure in the cybersecurity infrastructure owned or controlled by such external partners. When we do become aware that an external partner has experienced such compromise or failure, we attempt to mitigate our risk, including by terminating such external partner's connection to our information technology networks and systems where appropriate. For more information on cybersecurity risks and how they affect our business, operating results and financial condition, refer to Item 1A, Risk Factors. As of the date of the filing of this Current Report on Form 10-K, we have not identified any risks from a cybersecurity threat or incident that we believe has materially affected or is reasonably likely to materially affect the Company.

companyName: Crane NXT, Co.

ticker: CXT


text: Board of Director's Cyber Oversight For cybersecurity oversight, the board of directors of our GP training program is designed to inform members of the current cyber threat tactics and provide relevant, periodic educational security technology information. The cybersecurity training program includes: • An annual presentation overview of our cyber controls and related systems for a comprehensive understanding of our cybersecurity protection and resilience; • Quarterly cybersecurity training on topics such as ransomware, phishing, impersonation, social engineering, third-party security risks, and business email compromise to reinforce general security knowledge; and • Monthly cybersecurity newsletter distribution for current threat tactics and general security awareness.

companyName: NGL Energy Partners LP

ticker: NGL


text: Employee Training and Awareness – We understand that employees play a crucial role in maintaining cybersecurity. Therefore, we provide regular training and awareness programs to educate our staff about cybersecurity best practices, common threats and how to recognize and report suspicious activities.

companyName: ESCALADE INC

ticker: ESCA


text: Communication to the Board occurs more frequently than quarterly when dictated by incident and event management policies and procedures based on the criticality and urgency of the communication.

companyName: PNC FINANCIAL SERVICES GROUP, INC.

ticker: PNC


text: Our Cybersecurity Incident Response Plan is an enterprise-wide cybersecurity strategy that focuses on detecting and reacting to cybersecurity incidents, determining their scope and risk, responding appropriately, communicating the results and risk to stakeholders, and reducing the likelihood of reoccurrence. To enhance our in-house capabilities, we leverage expertise from professional services firms and/or outside counsel, as needed, to assess our cybersecurity controls, and inform and collaborate on an ever-changing landscape.

companyName: RESOURCES CONNECTION, INC.

ticker: RGP


text: An important part of our business involves the receipt, storage and other processing of personal information of our customers and associates, including, in the case of our customers, payment information. Security of this information and our other proprietary or sensitive data is imperative to ensure the trust of our customers, vendors, and associates. We assess, identify and manage material risks related to potential cybersecurity attacks on or through our electronic information systems that could adversely affect the confidentiality, integrity, or availability of our information systems or the information residing on those systems through various processes. These processes include a wide variety of controls, technologies, methods, systems, and other processes that are designed to prevent, detect, or mitigate data loss, theft and misuse, and unauthorized access to, or other cybersecurity attacks or vulnerabilities affecting, our data and information technology systems.

companyName: GameStop Corp.

ticker: GME


text: The Board of Directors is responsible for overseeing our enterprise risk management process, including our information security program, compliance and risk management and cybersecurity risks. The CISO regularly provides reporting on cybersecurity matters to senior management and reports to the Board of Directors on at least a semi-annual basis and, going forward, to the newly formed Technology Committee of the Board of Directors on at least a quarterly basis. This reporting includes updates on our information security strategy, key cyber risks and threats, progress towards protecting the Company from such risks and threats, and assessments of our cybersecurity program with regard to emerging trends. Depending on the magnitude of a cybersecurity incident, certain matters are required to be reported promptly to the Board of Directors, as appropriate, in accordance with our security incident response plan.

companyName: TD SYNNEX CORP

ticker: SNX


text: Risk Assessment: On a regular basis, the Company conducts assessments to identify potential cybersecurity threats and vulnerabilities within our systems and networks. This includes evaluating the impact of potential breaches and the likelihood of occurrence.

companyName: REPUBLIC BANCORP INC /KY/

ticker: RBCAA


text: Internally, to help manage risk from potential cybersecurity threats, we require our employees to participate in mandatory cybersecurity trainings provided by a third-party specialist which focuses on building awareness of common tactics by threat actors, such as phishing. This training is provided on an annual basis.

companyName: Ubiquiti Inc.

ticker: UI


text: Our Board of Directors plays a role in guiding and overseeing our cybersecurity strategies. Our Audit Committee maintains responsibility for cybersecurity oversight by setting policies, reviewing risk management strategies and reviewing compliance with legal and regulatory requirements. The Audit Committee, as appropriate, briefs the broader Board of Directors on cybersecurity matters.

companyName: UNIVERSAL ELECTRONICS INC

ticker: UEIC


text: External Assessments Our cybersecurity policies, standards, processes and practices are regularly assessed by consultants and external auditors. These assessments include a variety of activities including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. We conduct regular independent cyber audits to assess our controls and alignment against the NIST Cybersecurity Framework, compromise assessments to baseline and assess if a current or past compromise had occurred within our infrastructure, and maintain industry certifications and attestations that demonstrate our dedication to protecting customer data. The results of significant assessments are reported to management, the board of directors and Audit Committee. Cybersecurity processes are adjusted based on the information provided from these assessments.

companyName: CPI Card Group Inc.

ticker: PMTS


text: In an effort to deter and detect cyber threats, we annually provide all employees, including part-time and temporary, with a data protection, cybersecurity and incident response and prevention training and compliance program, which covers timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, asset use and mobile security, and educates employees on the importance of reporting all incidents immediately. We also use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs.

companyName: Mersana Therapeutics, Inc.


text: Board Reporting. At least annually, the CIO reports to the Board, directly or through the Enterprise-Wide Risk Management Committee, the overall status of the Information Security Program and the Company's compliance with the Interagency Guidelines for Safeguarding Customer Information. Any material findings related to the risk assessment, risk management and control decisions, service provider arrangements, results of testing, security breaches or violations are discussed as are management's responses and any recommendations for program changes.

companyName: NB Bancorp, Inc.


text: We maintain a security operations center that monitors our systems and networks for anomalous activity. Additionally, our information technology ("IT") team actively monitors different cybersecurity threat intelligence sources and responds accordingly based on risk.

companyName: Stoke Therapeutics, Inc.

ticker: STOK


text: Our incident response team, headed by the Director and VP of IT, reports material cybersecurity incidents to our executive officers and to our Board of Directors. The Company has an information security advisory board comprised of senior leaders within the Company. These senior leaders include representation from functions including product line, sales and marketing, manufacturing, legal, finance, human resources, supply chain, information technology, and regional representation. Responsibilities of the advisory board include: • advise on creation and implementation of information security policy; • advise on information security strategic roadmap and investments; • review, advise, and promote security education, training, and awareness; • review and advise on ongoing legal, regulatory, compliance, threat landscape, risks, industry news, and trends concerning cyber security; and • review and advise on the mitigation of cybersecurity risks and potential incidents.

companyName: DIODES INC /DEL/

ticker: DIOD


text: In addition, the IT Committee and the Board maintain an ongoing dialogue regarding emerging or potential cybersecurity risks, ensuring the Board's oversight is proactive and responsive. The IT Committee actively participates in strategic decisions related to cybersecurity, offering guidance and approval for major initiatives. This involvement ensures that cybersecurity considerations are integrated into the broader strategic objectives of the Company.

companyName: Community Healthcare Trust Inc

ticker: CHCT


text: Management of cybersecurity also extends to third-party service providers we use for specialized purposes such as payroll processing, investment tracking, regulatory financial reporting, and equity compensation plan administration. Our communication with these providers is protected by the safeguards within our security operation center. In addition, we annually obtain a Service Organization Controls (SOC) report on the suitability and operating effectiveness of the providers' controls, known as a SOC 1 Type 2 Report. The report is prepared by an independent service auditor. We review such reports to confirm the existence of effective controls over unauthorized access at third party service providers.

companyName: HCI Group, Inc.

ticker: HCI


text: Our dedicated cybersecurity personnel supervise and monitor our controls, technologies, systems and other processes utilized to mitigate any data loss, theft, exploitation, unauthorized access or other vulnerabilities that may affect our information or data. Specifically, our cybersecurity program consists of incident response procedures, information security and vendor management due diligence, as well as participation in industry consortiums, ongoing monitoring, internal and independent testing of information systems and continuous employee education and simulations. Our independent testing includes both (i) periodic testing and evaluations performed by our internal audit team and (ii) annual network penetration testing conducted through independent third parties. Our processes for assessing, identifying and managing material risks from cybersecurity threats have been integrated into our overall risk management system and processes. As part of these processes, we monitor the privacy and cybersecurity laws, regulations and guidance applicable to us in the regions where we do business (including, but not limited to, SEC rules, the CCPA and the Gramm-Leach-Bliley Act, as further described under the caption "Business—Regulations"), as well as proposed privacy and cybersecurity laws, regulations, guidance and emerging risks.

companyName: Rithm Capital Corp.

ticker: RITM


text: The Board, in coordination with the Audit Committee, oversees our risk management process. The Board and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, the Audit Committee discuss our approach to cybersecurity risk management with the Head of IT.

companyName: ANAPTYSBIO, INC

ticker: ANAB


text: Chief Financial Officer will oversees our information security programs, including cybersecurity initiatives, and is integrated into our Cybersecurity Incident response process. The Audit committee oversees cybersecurity risk management activities, supported by Company management, the Board of Directors, and external consultants. We assess and prioritize risks based on potential impact, implement technical controls, and monitor third-party vendors' security practices.

companyName: DIH HOLDING US, INC.


text: The Company maintains cybersecurity policies, standards, and procedures, which include cyber incident response plans. These policies and procedures are continually refined to adapt to changes in regulations, identify potential and emerging security risks, and develop mitigation strategies and protocols for those risks. Regular exercises, tests, incident simulations, and system assessments are conducted to discover and address potential vulnerabilities, and improve decision-making, prioritization, monitoring, and reporting. The Company also engages external parties, such as consultants, independent assessors, computer security firms, and risk management and governance experts, to enhance its cybersecurity oversight and mitigate third-party risks.

companyName: EASTMAN CHEMICAL CO

ticker: EMN


text: In the event of a cyber incident, our CIO leads the execution of our cyber response plan, which includes a cross-functional group and triggers for escalation. We also have established a business continuity program to assess the cyber risks associated with our critical facilities' ability to recover and resume operational functionality. We continue to engage and educate employees internally on relevant cybersecurity threats.

companyName: Vontier Corp

ticker: VNT


text: In the ordinary course of our business, we utilize technology systems to collect, use, store, and transmit information. The confidentiality, integrity, and availability of the information in our systems is important to our operations, business strategy, and maintaining the trust of our customers, employees and partners. As part of our enterprise risk management program, we have processes in place to identify, assess, and manage material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K.

companyName: 1 800 FLOWERS COM INC

ticker: FLWS


text: Our Chief Executive Officer, Anthony Coniglio, leads our cybersecurity risk assessment and management processes. Mr. Coniglio is an experienced risk management professional. Mr. Coniglio has served as our Chief Executive Officer, President and Chief Investment Officer, overseeing risk management activities. Previously, Mr. Coniglio was the Chief Executive Officer of Primary Capital Mortgage Company ("PCM"), a residential mortgage company, where he was responsible for overseeing information technology, including cybersecurity, for the highly regulated business. Mr. Coniglio currently serves on the board of St. Mary's Hospital for Children, as chair of the IT & cybersecurity committee and chair of the audit committee.

companyName: NewLake Capital Partners, Inc.

ticker: NLCP


text: We have implemented robust processes to assess, identify, and manage cybersecurity risks, including potentially material risks, related to our internal information systems and our products. In response to the increasing threats presented by cyber incidents, in 2023 we established a Cybersecurity Steering Committee, which meets bimonthly. This committee is comprised of our Chief Information Officer, Head of IT and Security Leader, along with our Deputy General Counsel who reports to our General Counsel. The Cybersecurity Steering Committee oversees activities related to the monitoring, prevention, detection, mitigation and remediation of cybersecurity risks. The Cybersecurity Steering Committee develops and implements cybersecurity risk mitigation strategies and activities, including the management of comprehensive incident response plans, oversees the cybersecurity risks posed by third-party vendors, ensures policies and procedures are current and followed, and receives regular updates on cybersecurity-related matters.

companyName: Turning Point Brands, Inc.

ticker: TPB


text: Our Board of Directors is responsible for overseeing our enterprise risk management activities in general, including cybersecurity risks. The full Board receives a network health report at each board meeting from our Senior Vice President/ Operations & IT Manager, which addresses our overall network risk including any relevant cybersecurity threats and incidents.

companyName: Bank7 Corp.

ticker: BSVN


text: Notwithstanding our vigilant cybersecurity measures, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. For further discussion of the risks associated with cybersecurity incidents, see the cybersecurity risk factor in Item 1A. Risk Factor in this report, titled "Increased cybersecurity requirements, threats and more sophisticated and targeted computer crime could pose a risk to our systems, networks, data and our third-party service providers. Our business operations could be negatively impacted by an outage or breach of our informational technology systems or a cybersecurity event".

companyName: MARINEMAX INC

ticker: HZO


text: As of the date hereof, we have not experienced any material cybersecurity incidents. However, future incidents, whether direct or through our third-party providers, could have a material impact on our business strategy, results of operations, or financial condition. We maintain cybersecurity insurance to mitigate the risks of a material cybersecurity incident; however, the costs may exceed our coverage and, therefore, may not be fully insured. See Part I, Item 1A - "Risk Factors" in this Annual Report on Form 10-K for a further discussion of various cybersecurity risks to the Company.

companyName: CARVANA CO.

ticker: CVNA


text: The cybersecurity program includes regular assessment on the effectiveness of the firm's risk mitigation strategies. Assessments include third-party validation to help ensure our internal controls and safeguards adhere to security and compliance standards. We annually undergo external examinations, such as Sarbanes-Oxley relating to financial reporting and SOC 1 and/or SOC 2 for key operational Business Units. In addition, we periodically engage with third-party partners to perform an independent evaluation of our cybersecurity program as well as external network penetration testing. This complements our internal assessments, such as application security testing, vulnerability management, and penetration testing. The firm participates in various industry threat intelligence information sharing forums to stay current on evolving cyber risks and threats. The results of these assessments are discussed with and reviewed by the Audit Committee, and shared with the Board, annually.

companyName: PRICE T ROWE GROUP INC

ticker: TROW


text: Management Oversight Our senior leadership team is actively involved in cybersecurity governance, ensuring the highest level of oversight of cybersecurity risks. Establishing clear lines of ownership and accountability, along with regular and transparent communication among our standing Board committees, the Board of Directors and executives, is crucial for effectively handling cybersecurity risks and opportunities. Our Chief Technology & Data Officer reports to the President, dedicating a substantial amount of their efforts to ensure the safety and security of our networks and systems. Our Chief Technology & Data Officer has nearly 20 years of IT experience including areas of technology, cybersecurity, data, analytics, and digital transformation as well as being an Adjunct Lecturer at Tel-Aviv University and the Technion for Big Data Technologies, Data Science and Data Visualization. Representing the state of Israel at MIT's CDOIQ forum. Our Chief Technology & Data Officer oversees a team of security professionals and regularly updates the Board of Directors on any potential risks and threats to the Partnership. Senior leadership including our Chief Technology & Data Officer/Chief Information Officer and the Chief Information Security Officer brief the Board on information security matters multiple times throughout the year.

companyName: Delek Logistics Partners, LP

ticker: DKL


text: The potential impact of risks from cybersecurity threats on the Company are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. An annual assessment of threats and effectiveness of security controls is conducted by an independent third party following the methodologies outlined by the (NIST) Cybersecurity Framework. Additionally, an annual SOC 1 Type II assessment is conducted and reported for the verification of IT and security controls that covers various aspects of the Information/Cybersecurity Program.

companyName: Lord Abbett Private Credit Fund


text: WTW engages third parties to conduct assessments to help it identify, categorize and manage cyber risks including SOC 2 - Type 2, ISO 27001 and a National Institute of Standards and Technology ('NIST') cybersecurity maturity assessment. Additionally, management and third parties from time to time conduct penetration testing and vulnerability scanning to help WTW identify and reduce the threat of known and emerging cybersecurity risks.

companyName: WILLIS TOWERS WATSON PLC

ticker: WTW


text: Despite our efforts, our control over and ability to monitor the security of third parties is limited and there can be no assurance that we can prevent, mitigate or remediate the risk of any compromise or failure in the security infrastructure owned or controlled by third parties. Additionally, any contractual protections with such third parties may be limited or insufficient to prevent a negative impact on our business from such compromise or failure.

companyName: GoDaddy Inc.

ticker: GDDY


text: Our Information Security and Privacy Team includes over 70 full-time positions with at least 50% of our associates holding relevant industry certifications, such as the Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), and Certified Information Privacy Professional (CIPP). All associates and contractors with access to our Company's systems receive comprehensive initial and ongoing annual training on responsible information security, data security, and cybersecurity practices and how to protect against cyber threats.

companyName: Jackson Financial Inc.

ticker: JXN


text: We recognize the importance of assessing, identifying, and managing material risks from cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, operational risks, financial loss, intellectual property theft, fraud, extortion, loss of sensitive data, harm to individuals including stockholders, violation of privacy or security laws, increased costs associated with mitigation of damages and remediation, and other legal and reputational risks. We have implemented several cybersecurity processes and controls to aid in our efforts to assess, identify, and manage such material risks.

companyName: SLR Investment Corp.

ticker: SLRC


text: We rely extensively on information technology (IT) services to conduct our business. We also rely on networks and services, including internet sites, cloud and software solutions, data hosting and processing facilities and tools and other hardware, software and technical applications and platforms to assist in conducting our business.

companyName: PROCYON CORP


text: We design and assess our program based on the NIST CSF. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess and manage cybersecurity risks relevant to our business.

companyName: HESS CORP


text: On the technical front, we deploy a variety of safeguards to protect our systems. These include firewalls, intrusion detection and prevention systems, data encryption, and strict access controls. Regular updates and patches are applied to software and firmware to mitigate known vulnerabilities and strengthen our security posture.

companyName: MONARCH CASINO & RESORT INC

ticker: MCRI