text: The Board of Directors oversees risks related to cybersecurity, including the security of corporate information and the steps management is taking to monitor and control these risks. Management regularly briefs the Board on our cybersecurity risk profile, emerging threats, and the efficacy of our risk mitigation strategies, including our continuous improvement initiatives. These initiatives aim to enhance the resiliency of our cybersecurity program as well as our broader operational risk management strategies.

companyName: NEWMARKET CORP

ticker: NEU


text: cybersecurity risk management program includes the following: assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents;

companyName: Webstar Technology Group Inc.

ticker: WBSR

secItem: Item 1C


text: The Company's chief information security officer, under the direction of our chief security officer, is responsible for developing and implementing our information security program. Our chief information security officer and our chief security officer each has more than 35 years of experience in technology, operations, information risk and security. Our chief information security officer has deep experience developing comprehensive information security programs for large and complex financial services and insurance organizations. Our chief security officer brings extensive experience in both the military and the private sector and is a specialist in attack surface reduction, incident response and recovery, targeted threat hunting, forensics/malware analysis and threat group analysis.

companyName: BROWN & BROWN, INC.

ticker: BRO


text: The SVP of Technology has served in that role since 2005 and the SVP, Head of Technology Operations and Implementation, who also supports the Information Security Program, has 23 years of financial technology experience, including previously as Director, Application Development and Vice President, Integration and Analytics. The Information Security Program is further supported by other members of Coastal's management team, including the President, Chief Risk Officer, and the Chief Audit Executive.

companyName: COASTAL FINANCIAL CORP

ticker: CCB


text: Lazard maintains a formal, robust cybersecurity and information security program that is aligned with the National Institute of Standards and Technology Cybersecurity Framework ("CSF") and integrated into our overall risk management process. Our Information Security Program, Policies and Standards are also designed to comply with the financial regulations and cybersecurity laws in the jurisdictions in which we operate. By focusing on the following four interconnected pillars, we aim to reduce the impact of cybersecurity incidents, safeguard our digital assets and foster a proactive and comprehensive approach to cybersecurity within our organization.

companyName: Lazard, Inc.

ticker: LAZ


text: Our cybersecurity program is managed by a vice president of global security and cybersecurity who reports to our Chief Executive Officer, or CEO, providing routine security program updates and briefings. The current vice president of global security and cybersecurity has more than 25 years of experience in cybersecurity, federal law enforcement, and cyber investigations, while possessing the required subject matter expertise, skills, experience, and industry certifications expected of an individual assigned to these duties. Our information security team, which includes the vice president of global security and cybersecurity, as well as additional professionals, is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, and processes. The vice president provides regular updates to our CEO and other members of management. Our board of directors has ultimate oversight of cybersecurity risk, which it manages as part of our Enterprise Risk Management program. Cybersecurity periodically provides updates to our management on cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape. Management informs the audit committee or the board of directors of risks from cybersecurity threats as necessary or advisable.

companyName: Celularity Inc

ticker: CELU


text: Audit Committee of the Board of Directors oversees Elite's cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. The cybersecurity stakeholders, including members of management assigned with cybersecurity oversight responsibility and/or third-party consultants providing cyber risk services, brief the Audit Committee on cyber vulnerabilities identified through the risk management process, the effectiveness of Elite's cyber risk management program, and the emerging threat landscape and new cyber risks on at least an annual basis. This includes updates on processes to prevent, detect, and mitigate cybersecurity incidents.

companyName: ELITE PHARMACEUTICALS INC /NV/

ticker: ELTP


text: An incident response plan that outlines the steps the Company will take to respond to a cybersecurity incident, which is tested on a periodic basis.

companyName: FIRST NORTHERN COMMUNITY BANCORP

ticker: FNRN


text: The Executive Director of IT & Cybersecurity is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. The Executive Director of IT & Cybersecurity, together with certain other senior management personnel, is responsible for approving functional budgets, implementing approved, phase-appropriate policies, plans and guidelines, helping prepare for potential cybersecurity incidents, reviewing security assessments and other security-related reports and overseeing cybersecurity processes.

companyName: ACELYRIN, Inc.


text: We conduct risk assessments to evaluate the effectiveness of our systems and processes in addressing threats and to identify opportunities for enhancements. Additionally, we conduct privacy and cybersecurity reviews, as well as annual employee training, and monitor emerging laws and regulations related to information security and data protection. We utilize third party tools and techniques to test and enhance our security controls, perform annual cybersecurity framework assessments, conduct ongoing penetration testing of our systems, and benchmark against best practices. Our internal audit function provides an independent assessment on the overall operations of our cybersecurity program and the supporting framework.

companyName: Investview, Inc.

ticker: INVU


text: The Company's Vice President, Information Technology works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents. To facilitate the success of this program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents in accordance with the Company's incident response and recovery plans. Through the ongoing communications from these teams, the Vice President, Information Technology and the IT Security Operations Team monitor the prevention, detection, mitigation and remediation of cybersecurity incidents in real time, and report such incidents to the Audit Committee when appropriate.

companyName: Crinetics Pharmaceuticals, Inc.

ticker: CRNX


text: The Audit Committee receives periodic updates from management concerning the Company's significant cybersecurity threats, risks, and the processes the Company has implemented to address them. In addition, the Audit Committee and management maintain an ongoing dialogue regarding emerging or potential cybersecurity risks.

companyName: Pulmonx Corp

ticker: LUNG


text: We have implemented a cybersecurity risk management program to protect the confidentiality, integrity and availability of our information and information technology environment. Our cybersecurity risk management program consists of an extensive range of risk assessments to identify the cyber threats to our environment along with multiple policies and procedures to mitigate the risks identified, including, but not limited to, information technology and cybersecurity standards, incident response and disaster recovery/business continuity. Employees receive regular information and cybersecurity training and reminders throughout the year.

companyName: SR Bancorp, Inc.

ticker: SRBK


text: Representatives from our IT Committee provide briefings regarding cyber matters to our audit committee on a quarterly basis, and directly to the full board of directors on an annual basis. Such briefings may include a discussion of cyber risks and applicable risk assessments, key updates regarding our cyber strategy and related initiatives, and the emerging cybersecurity threats that may impact our business.

companyName: Absci Corp

ticker: ABSI


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards, and/or policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including risk assessments and incident detection and response. We work with third parties from time to time that assist us to identify, assess, and manage cybersecurity risks, including professional services firms and consulting firms.

companyName: REGO PAYMENT ARCHITECTURES, INC.

ticker: RPMT


text: We take a risk-based approach to cybersecurity, which begins with the identification and evaluation of cybersecurity risks or threats that could affect our operations, finances, legal or regulatory compliance, or reputation. The scope of our evaluation encompasses risks that may be associated with both our internally managed IT systems and key business functions and sensitive data operated or managed by third -party service providers, ensuring the service providers adhere to our security standards, thereby safeguarding our integrated operations. The strategic migration of our data centers and infrastructure to secure cloud environments, coupled with the implementation of targeted technical cybersecurity measures, underscores our dedication to establishing foundational security across our users, applications, data, systems, and networks.

companyName: TRANSCAT INC

ticker: TRNS


text: Our CIO has been in his role at Williams for over 10 years and has over 30 years of combined Information Technology experience with a broad scope of responsibility. He has provided senior leadership support of the cybersecurity and risk management programs since 2013. Our CIO holds a bachelor's degree in management information systems (MIS) from the University of Oklahoma and a Master of Business Administration in MIS from the University of Dallas.

companyName: WILLIAMS COMPANIES, INC.

ticker: WMB


text: Risk Assessment: Management conducts annual cybersecurity risk assessments to identify and evaluate potential threats and vulnerabilities. Management considers the likelihood and potential impact of various cybersecurity risks, considering the Company's assets, systems, and operations, to prioritize mitigation efforts.

companyName: HUDSON TECHNOLOGIES INC /NY

ticker: HDSN


text: The Cybersecurity Committee (the "Committee") of the Managing Owner is responsible for overseeing cyber and information security. The Committee meets at least quarterly to discuss cybersecurity risks and frequently holds more informal discussions in the interim. The Committee is subject to oversight by the board of directors of the Managing Owner (the "Board"). The Committee is co-chaired by the Managing Owner's President/Chief Operating Officer, Chief Technology Officer/Co-Head of Trading, and General Counsel/Chief Compliance Officer who oversee day-to-day implementation of cyber and information security by employees with specialized expertise and experience in such matters. The Board is kept apprised of the cybersecurity policies and procedures on a formal basis at least annually, and is kept informed on a less formal basis through participation in training and policy updates. The Committee meets at least quarterly to discuss and review testing, cybersecurity risks/events and all other relevant matters. Committee members are given the opportunity at these meetings to ask questions of all relevant personnel.

companyName: GLOBAL MACRO TRUST


text: Sponsor takes a risk-based approach to cybersecurity and has implemented cybersecurity and IT risk management policies and procedures designed to address cybersecurity threats and incidents, including regularly assessing risks from cyber threats, monitoring IT systems for potential vulnerabilities, and testing IT systems according to its policies and practices. Our Sponsor also uses a number of security tools and external service providers to monitor, test or otherwise assist with various aspects of its cybersecurity controls.

companyName: Belpointe PREP, LLC

ticker: OZ


text: We face cybersecurity risks due primarily to our position in the industry and identity as a financial service company with potential for harm that could occur to us, our investors and our customers were we to suffer impacts of a material cybersecurity incident. We are committed to maintaining robust governance and oversight of these risks and to implementing mechanisms, controls, technologies, and processes designed to help us assess, identify, and manage these risks. While we have not, as of the date of this Annual Report, experienced a cybersecurity threat or incident that resulted in a material adverse impact or are reasonably likely to have material adverse impact on our business or operations, our business strategy, results of operations, or financial condition, there can be no guarantee that we will not experience such an incident in the future. In addition, the environment and threats are constantly evolving, thereby increasing the difficulty of successfully defending against them or implementing adequate preventative measures. We only use industry leading third party software applications for our operations and we rely on their technology to assess potential cybersecurity threats. We seek to detect and investigate unauthorized attempts and attacks against our network and services which are also dependent on third parties (multiple law firms, banks, settlement and title entities) and their technology, and to prevent their occurrence and recurrence where practical through changes, updates and enhancements to our internal processes and tools. We have an internal process to consider the cybersecurity practices of our third-party service providers and we actively review their cybersecurity notices and alerts on an ongoing basis. Our assessment of risks associated with the use of third-party providers is part of our overall risk management framework. However, we remain potentially aim to incorporate industry best practices throughout our cybersecurity program. Our cybersecurity strategy focuses on implementing effective and efficient controls, technologies, and other processes to assess, identify, and manage material cybersecurity risks. Our cybersecurity program is designed to be aligned with applicable industry standards and is assessed periodically by independent subject matter expert third parties who hold industry leading certifications such as Certified Information Systems Security Professional (CISSP), GIAC Certified Intrusion Analyst (GCIA), and GIAC Certified Incident Handler (GCIH).

companyName: Shepherd's Finance, LLC


text: The Board of Directors is committed to maintaining a strong cybersecurity and data protection framework intended to protect our customers, shareholders, employees, and other stakeholders, as well as the integrity of our operations. Our Board is involved in the oversight of the Company's cybersecurity risk management efforts. Our cybersecurity risk management consists of a set of processes designed to assess, identify and effectively manage material risks arising from cybersecurity and data protection threats. These processes are aligned with the Framework for Improving Critical Infrastructure Cybersecurity established by the National Institute of Standards and Technology. Our processes have been integrated into our overall risk management system, consistent with our commitment to safeguarding our operations and data on a Company-wide basis. Our cybersecurity risk management efforts are overseen by our Audit Committee in collaboration with individual members of our management team, specifically our Chief Information Officer, Chief Legal Officer, and Vice President of Risk Management. Generally, our cybersecurity risk management efforts seek to address cybersecurity risks and incident response through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information we collect by identifying, preventing and mitigating cybersecurity threats and effectively responding to incidents when they occur. Our efforts also emphasize continuity of systems to ensure minimal disruption and maintain operational integrity during cybersecurity threats and incidents. We regularly review and update our contingency plans, aiming to enhance the resilience of our operations and the consistent functionality of our systems in the face of potential disruptions.

companyName: WillScot Holdings Corp

ticker: WSC


text: We have also established a Cybersecurity Committee that meets on a quarterly basis to review and agree on actions to address cybersecurity risks. The Cybersecurity Committee is led by our chief information officer, or CIO, who is a part-time consultant, and includes our chief executive officer and chief financial officer. Our CIO, who reports to our chief financial officer, is responsible for the strategic leadership of our cybersecurity programs, identification of cybersecurity risks and the mitigation plans that address these risks. With over 25 years of experience in information technology, the CIO works alongside individuals across other functions, such as clinical operations, legal and quality compliance, to establish and implement our cybersecurity strategy. Our CIO has a bachelor's degree in Technology and an M.B.A. along with over 10 years of experience in information technology in the life sciences industry.

companyName: Trevi Therapeutics, Inc.

ticker: TRVI


text: We have a cross-departmental approach to addressing cybersecurity risk, including input from employees and our Board of Directors (the "Board"). The Board, Audit Committee, senior management and the Enterprise Risk Management Council (a taskforce comprised of senior representatives from primary corporate functions as well as senior representatives from field operations) devote significant resources to cybersecurity and risk management processes to adapt to the changing cybersecurity landscape and respond to emerging threats in a timely and effective manner. Our cybersecurity risk management program leverages the National Institute of Standards and Technology (NIST) framework, which organizes cybersecurity risks into five categories: identify, protect, detect, respond and recover. We regularly assess the threat landscape and take a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, detection and mitigation. Our information technology (IT) security team reviews enterprise risk management-level cybersecurity risks annually, and key cybersecurity risks are incorporated into the Enterprise Risk Management Council's framework. In addition, we have a set of Company-wide policies and procedures concerning cybersecurity matters, which include an IT security manual as well as other policies that directly or indirectly relate to cybersecurity, such as policies related to encryption standards, antivirus protection, remote access, multifactor authentication, confidential information and the use of the internet, social media, email and wireless devices. These policies go through an internal review process and are approved by appropriate members of management.

companyName: UNITED RENTALS NORTH AMERICA INC


text: Our cybersecurity risk management program is led by our Chief Information Security Officer ("CISO"), whose organization is responsible for identifying, assessing and managing risks from cybersecurity threats. Our CISO has over 20 years of experience leading information security, data risk management, application/system development and engineering teams at multiple large, global and publicly traded companies—including several Fortune 500 companies. Our CISO holds Certified Information Systems Security Professional ("CISSP"), Certified Information Security Manager ("CISM"), Certified Information Privacy Professional ("CIPP") and Security+ certifications and contributes to healthcare industry working groups. Our CISO reports to our Chief Information Officer (CIO), who has overall responsibility for the cybersecurity risk management program and organization. Our CIO has more than 25 years of experience in information technology, business transformation, cybersecurity and technology solutions, including leadership roles at multiple large, global and publicly traded companies—including several Fortune 500 companies. Our Vice President, Research and Development, Product Security ("VP of Product Security") also supports our cybersecurity risk management program by leading a team of product security professionals focused on cybersecurity across the product lifecycle—including new product development, in-market products and end-of-life strategies—for our portfolio of software-based products. Our VP of Product Security has nearly 20 years of experience in the medical device industry, including at another publicly traded company managing product security, and has also received training from the SANS Institute.

companyName: BECTON DICKINSON & CO

ticker: BDX


text: Our Board oversees cybersecurity risks through the Board's audit and risk committees. The Board's Audit Committee has primary oversight of cybersecurity risk. In performing its oversight function, the Audit Committee considers information from the senior leaders in various departments (including the IT, internal audit and law departments) who provide periodic reports on cybersecurity, including updates on the Company's cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape.

companyName: NMI Holdings, Inc.

ticker: NMIH


text: Our year-round cybersecurity awareness program mandates training for all system users, covering essential topics such as safeguarding sensitive information, identifying phishing attempts, securing mobile devices, and understanding the risks associated with artificial intelligence ("AI") platforms. Recognizing the importance of third-party risk, our strategic sourcing protocols mandate detailed cybersecurity assessments for potential third-party suppliers. New engagements with third parties are contingent upon affirmative evaluations or adherence to risk mitigation/acceptance protocols. Contracts with third parties include provisions for breach notification, investigation, root cause analysis, and remediation.

companyName: Covista Inc.

ticker: CVSA


text: We also identify our cybersecurity threat risks by comparing our processes to standards set by NIST and Center for Internet Security, as well as by engaging experts to attempt to infiltrate our information systems. To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and protect against and respond to cybersecurity incidents, we also perform periodic risk assessments, which includes cybersecurity risks, monitor emerging data protection laws and implement changes to our processes that are designed to comply with such laws; through our policies, practices, and/or contracts (as applicable), require employees and certain third parties to treat confidential information and data with care; periodically update our relevant policies and procedures; employ technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence; provide regular, mandatory training for our employees regarding cybersecurity threats as a means to equip them with effective tools and knowledge necessary to identify or address cybersecurity threats and to communicate our evolving information security policies, standards, processes and practices; conduct regular phishing email simulations to enhance awareness and responsiveness to possible threats; conduct annual cybersecurity training for our board of directors and senior management; run tabletop exercises to simulate a response to a cybersecurity incident and use the findings to improve our processes and technologies; leverage the NIST incident handling framework to help us identify, protect, detect, respond, and recover when there is an actual or potential cybersecurity incident; engage consultants to help us oversee and manage cybersecurity risks, processes, and incident response measures; and carry information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident.

companyName: Fulgent Genetics, Inc.

ticker: FLGT


text: Despite our efforts and resource allocation, we acknowledge the challenges posed by the evolving nature of cyber threats and the limitations in fully mitigating these risks. We have not observed any significant impacts from known cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected our operational results and strategic or financial condition. Criteria used to determine the materiality of an incident includes, but is not limited to, evaluating the scope, nature, type, systems, data, operational impact, and pervasiveness of the incident. Materiality also considers both quantitative and qualitative factors in determining impact. Nevertheless, given the unpredictable nature of cyber threats, we cannot assure that potential future impacts will not have a material impact. See "Risk Factors – If we or our third-party providers experience cyberattacks or data security incidents, there may be damage to our brand and reputation, material financial penalties, and legal liability, which would materially adversely affect our business, results of operations, and financial condition."

companyName: BED BATH & BEYOND, INC.

ticker: BBBY


text: Although no cybersecurity incidents during the year ended December 31, 2024 had a material impact on our strategy, financial condition or results of operations, the scope and impact of any future incident cannot be predicted. See Item 1A. Risk Factors for additional discussion regarding AAM's IT and cybersecurity risks.

companyName: Dauch Corp

ticker: DCH


text: Our Information and Technology service providers manages the Company's security program, which is focused on assessing, identifying, and managing cyber risk and information security threats. We evaluate cybersecurity on an ongoing basis, and it is a risk monitored through our overall enterprise risk management program, including by the executive leadership and board of directors, described below under "Governance."

companyName: Vyome Holdings, Inc

ticker: HIND


text: We maintain an information security program with a dedicated internal team that is tasked with leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. Our information security team is responsible for identifying, assessing, managing, and responding to cybersecurity risks, threats and incidents relating to the protection of our information assets, systems and operations. The information security team also oversees the detection, prevention, mitigation and remediation of all cybersecurity incidents. Our information security team proactively monitors emerging cyber threat activity to proactively tune and upgrade our cyber capabilities to maintain a robust security posture.

companyName: FACTSET RESEARCH SYSTEMS INC

ticker: FDS


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF").This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Verona Pharma plc

ticker: VRNA


text: Through the RAP, which is a tool in our ERM program, we identify and assess cybersecurity risks at a business unit level, evaluating the likelihood and potential impact of a risk universe encompassing finance, human capital, operations, information technology, legal and regulatory compliance, and strategy. Risks are individually analyzed from both inherent and residual perspectives, considering existing controls and mitigation processes in place. The businesses leverage the results from the assessment process to identify and implement efforts to further mitigate risks. Progress on mitigation projects is monitored and regularly reported to leadership as part of the RAP. In addition to our ERM and RAP, we have a cybersecurity program led by our Chief Information Officer ("CIO"), who reports to our Chief Financial Officer. Our current CIO has over 20 years of experience with large global companies where he worked extensively in providing strategic IT leadership and management in the areas of digital transformation, cybersecurity, risk management and ERP implementation. Our CIO oversees our Information Security department, chairs the Vontier Information Security Executive Committee ("VISEC"), which includes cross-functional leaders from finance, internal audit, information security, information technology, and legal and corporate affairs, and works with the businesses to conduct enterprise product security assessments, perform penetration testing and advance our cybersecurity policies and procedures. We have developed information security policies and standards based on the NIST Cybersecurity Framework, an internationally recognized framework; and we engage with third parties on our incident response processes, cybersecurity maturity assessment, as well as on our cyber security awareness, data security governance and vendor cyber risk management. Additionally, we review our cybersecurity maturity assessment on an ongoing basis to measure the Company's ability to detect, protect, respond and recover from a cyber incident.

companyName: Vontier Corp

ticker: VNT


text: Enterprise and product cybersecurity are incorporated into the Company's overall risk management process. On a monthly basis, the Company's cross-functional Enterprise Risk Management Committee meets to discuss short-term and long-term enterprise-wide risks and necessary action plans to mitigate those risks. The Chief Information Security Officer (the "CISO") regularly presents to the Company's Enterprise Risk Management Committee on key cybersecurity risks, threats and developments, as well as the Company's strategies to mitigate those risks.

companyName: Aptiv PLC

ticker: APTV


text: The Audit Committee periodically receives reports from the Vice President of Information Technology on the Company's significant cybersecurity threats, risks, and mitigation processes. The Audit Committee also receives various summaries, presentations, and reports pertaining to cybersecurity threats, risks, and mitigation.

companyName: Olema Pharmaceuticals, Inc.

ticker: OLMA


text: Our processes for assessing, identifying, and managing material risks from cybersecurity threats and incidents are integrated into our multi-disciplinary enterprise risk management ("ERM") process. Our ERM process is managed through our ERM Committee, which we have established to assess, identify and manage enterprise-wide risks to the Company, and is comprised of personnel from our senior leadership team. The ERM Committee is convened at least quarterly to review and update our top risks, including cybersecurity risks. Existing risks are evaluated for changes, and mitigation strategies are discussed as needed. New risks are discussed and evaluated for consideration as a top risk. Results are discussed with our Board of Directors at quarterly Board meetings as needed.

companyName: Ventas, Inc.

ticker: VTR


text: Our CISO reports to our CCO. The CCO reports to the Compliance Committee and the CLO. The CFO and CLO report directly to the company's Chief Executive Officer. Each of the CFO, CLO, CCO and CISO report regularly to our Board of Directors on, among other matters, our global risk landscape and risk management efforts, including those related to cybersecurity risks.

companyName: TripAdvisor, Inc.

ticker: TRIP


text: Risks from Cybersecurity Threats We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing during the financial year ended December 31, 2023.

companyName: Qrons Inc.

ticker: QRON


text: The DPIRC is responsible for implementing, reviewing and revising cybersecurity policies and directives, as well as overseeing the protection, detection and response capabilities of cybersecurity resources. In addition, the DPIRC promotes, endorses and validates Vista's cybersecurity risk posture, reviews industry best-practices, provides strategic direction for cybersecurity matters and oversees cybersecurity training programs. The DPIRC is informed about and monitors the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, Vista's cybersecurity risk program and the operation of the Incident Response Plan and Business Continuity Plan and works in coordination with Vista's internal information technology departments to, among other things, implement, review and revise the policies underlying its cybersecurity program. Additionally, Vista's Enterprise Risk Committee receives quarterly information security updates from the Vista CIO.

companyName: VISTA CREDIT STRATEGIC LENDING CORP.


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks.

companyName: TechnipFMC plc

ticker: FTI


text: The Board of Directors oversees the Company's information security program that institutes and maintains controls for the systems, applications, and databases of the Company and of its third-party providers and has delegated primary oversight of cybersecurity risks to the Audit Committee, which monitors the steps our management has taken to monitor and control exposures, including guidelines and policies to govern the process by which risk assessment and management is undertaken.

companyName: INTEGRAL AD SCIENCE HOLDING CORP.


text: Board Governance and Management The FE Board has identified cyber security as a key enterprise risk and prioritizes the mitigation of this risk through FirstEnergy's enterprise risk management process. Responsibility for oversight of risk management generally lies with the FE Board and the Audit Committee has primary responsibility to oversee enterprise risk management. To effectively manage oversight of FirstEnergy's cyber security risk management practices, since 2022, the FE Board has delegated oversight authority to each of FirstEnergy's Audit and Operations and Safety Committees, respectively, as detailed in each Committees' charters. The Audit Committee has primary responsibility to oversee the disclosure of material cyber security incidents, as well as the general obligation to ensure the proper risk oversight structure of cyber security as part of FirstEnergy's overall enterprise risk management program and the internal controls applicable to cyber security matters. The Operations and Safety Oversight Committee has primary responsibility to oversee the operational aspects of FirstEnergy's cyber security policies, programs, initiatives and strategies, as well as operational risk considerations related to cyber security matters. FirstEnergy's CISO regularly provides reports at the Audit Committee, Operations and Safety Oversight Committee, and to the full FE Board. Each such Committee and the full FE Board work collaboratively to ensure fulsome oversight with the proper focus of each respective Board body. These reports include, among other things, current and emerging cyber security risks to FirstEnergy, incidents that were escalated to management during the prior quarter, including those that did not require immediate escalation to the appropriate Committee and/or full FE Board, internal and external assessments of FirstEnergy's cyber security program, and a roadmap of projects to manage its cyber security posture.

companyName: FIRSTENERGY CORP

ticker: FE


text: Our Board has ultimate oversight over our privacy and cybersecurity programs and strategy and is responsible for ensuring that we have risk management policies and processes in place to meet and mitigate evolving risks and threats. Certain members of the Board have cybersecurity certifications. The Board executes this oversight directly and through both the Audit Committee, for cybersecurity purposes, and the Compliance Committee, for privacy purposes. In these capacities, these committees are regularly briefed by the Global Chief Information Security Officer ("GCISO") and Chief Privacy Officer on cybersecurity and privacy matters. These briefings are designed to provide visibility about the identification, assessment and management of critical risks, audit findings, and management's risk mitigation strategies. Additionally, these briefings include information about current trends in the environment, incident preparedness, artificial intelligence and various components of our cybersecurity and privacy programs. On an annual basis, the Board reviews our cybersecurity program, including the threat landscape and related controls, and periodically conducts cybersecurity tabletop exercises.

companyName: Cigna Group

ticker: CI


text: The Company has processes in place to assess, identify, and manage material risks from cybersecurity threats. The Company's business is dependent on the communications and information systems of GC Advisors and other third- party service providers. GC Advisors manages the Company's day-to-day operations and has implemented a cybersecurity program that applies to the Company and its operations.

companyName: Golub Capital Direct Lending Unlevered Corp


text: Like other technology companies, we have faced cybersecurity incidents in the past. As of the date of this Annual Report on Form 10-K, however, we have not assessed any risks from prior cybersecurity incidents as having materially affected or being reasonably likely to materially affect us. We face risks from cybersecurity threats, including those associated with cyberattacks and security breaches and incidents, in the future. For additional information regarding whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition in "Item 1A. Risk Factors" and "Item 7. Management's Discussion and Analysis of Financial Condition and Results of Operations" of this Annual Report on Form 10-K, which disclosures are incorporated by reference herein.

companyName: Bakkt, Inc.

ticker: BKKT


text: We have implemented a third-party service provider risk assessment program to assess material cyber threats associated with using third-party providers. This program is designed to assess risk prior to the onboarding of new providers as well as to review high risk and medium risk providers on an annual basis.

companyName: FIVE BELOW, INC

ticker: FIVE


text: The Board of Directors is acutely aware of the critical nature of managing risks associated with cybersecurity threats. The Board has established oversight mechanisms to ensure effective governance in managing risks associated with cybersecurity threats because we recognize the significance of these threats to our operational integrity and stakeholder confidence, Board of Directors Oversight

companyName: Versus Systems Inc.

ticker: VS


text: CRH has not been subject to a cyber-attack that has had a material impact on our operations or financial results. For additional information, please refer to Item 1A. "Risk Factors".

companyName: CRH PUBLIC LTD CO

ticker: CRH


text: Following these risk assessments, we implement and maintain reasonable safeguards to minimize identified risks, reasonably address any identified gaps in existing safeguards, and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our Chief Security Officer and Chief Information Officer, to manage the risk assessment and mitigation process.

companyName: MICRON TECHNOLOGY INC

ticker: MU


text: The CISO leverages open source and private threat intelligence sources to remain current about the latest developments in cybersecurity, including potential threats and risk management techniques. The CISO implements and oversees processes and technologies for regular monitoring of our information systems. Third party cybersecurity advisory services are employed to consult on, monitor, respond and/or assess our IT landscape and cybersecurity response.

companyName: CLEAN HARBORS INC

ticker: CLH


text: Review of Third-Party Risks : We routinely conduct risk and compliance assessments of third-party service providers prior to exchanging any sensitive data or integrating with any key third-party provider.

companyName: MAGNACHIP SEMICONDUCTOR Corp

ticker: MX


text: We rely on a multidisciplinary team, including our information security function, legal department, management, and third-party consultant s, as described further below, to identify, assess, and manage cybersecurity threats and risks. We identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods including, using manual and automated tools such as vulnerability scanning software, monitoring existing and emerging cybersecurity threats, analyzing reports of threats and threat actors, conducting scans of the threat environment, evaluating our industry's risk profile, utilizing internal and external audits and assessments, and conducting threat and vulnerability assessments.

companyName: QVC Group, Inc.

ticker: QVCGA


text: We have developed a comprehensive Information Security Program ("ISP") that was designed as the guiding policy to establish standards designed to protect the confidentiality of nonpublic, sensitive personal and business information, protect against potential threats to the security or integrity of such information, and protect against unauthorized access to or use of such information. The ISP applies to all Company employees, contractors, consultants, and third-party vendors as well as all technology owned and operated by the Bank. The scope of the ISP covers customer data as well as the Company's strategic and proprietary information. The Board of Directors approves the ISP annually. Additionally, the Information Technology Steering Committee ("ITSC") must approve significant modifications to the ISP prior to review and approval by the Board of Directors. The Chief Information Officer ("CIO") is responsible for the implementation and maintenance of the ISP.

companyName: MIDDLEFIELD BANC CORP

ticker: MBCN


text: AWS, short for Amazon Web Services, is a comprehensive cloud computing platform offered by Amazon. It provides on-demand access to various computing resources like servers, storage, networking, databases, analytics, machine learning, and more. AWS eliminates the need for physical hardware investments and gives organizations flexibility and scalability. S3 (scalable object storage), Amazon EC2 (virtual servers), Amazon RDS (managed databases), Amazon CloudFront (Content Delivery Network)

companyName: RYTHM, Inc.

ticker: RYM


text: Notwithstanding the approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured.

companyName: Dianthus Therapeutics, Inc. /DE/

ticker: DNTH


text: The use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls. Cybersecurity awareness training of our employees, including our incident response personnel. A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.

companyName: EDUCATIONAL DEVELOPMENT CORP

ticker: EDUC


text: Role of the Board and Management in Cybersecurity Risk Oversight The Board's Risk Committee provides oversight of cybersecurity and privacy risks, including overseeing management's efforts to monitor and mitigate those risks and reviewing with management any significant privacy and cybersecurity incidents and the effectiveness of the Incident Management and Information Security Plan. The CIO and IT Management inform key management personnel on relevant cybersecurity issues, which can span a wide range of topics, including but not limited to recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, and the current threat environment.

companyName: UNIVERSAL INSURANCE HOLDINGS, INC.

ticker: UVE


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example professional service firms (including legal counsel), threat intelligence services, and cybersecurity consultants.

companyName: Snap Inc

ticker: SNAP


text: We have not identified any cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial situation. However, despite our efforts to identify and respond to cybersecurity threats, we cannot eliminate all risks from cybersecurity threats or provide assurances that we have not experienced an undetected cybersecurity incident or will not experience a cybersecurity incident in the future. For additional information on cybersecurity related risks, see "Item 1A. Risk Factors" of this Annual Report on Form 10-K.

companyName: OSI SYSTEMS INC

ticker: OSIS


text: Governance and Oversight of Cybersecurity Threats Our information security program is managed by our Chief Corporate Planning and Supply Chain Officer (CCPO), who has more than ten years' experience managing IT services for Agile and possesses the required subject matter expertise, skills, and experience expected of an individual assigned to these duties. Our information security team, which includes the CCPO as well as additional professionals from our IT services provider, is responsible for leading enterprise-wide cybersecurity threat strategy, policy, standards, and processes. Our CCPO provides regular updates to our Chief Executive Officer and other members of management regarding cybersecurity threats and participates in the quarterly Compliance Committee meetings.

companyName: AGILE THERAPEUTICS INC


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services and our broader enterprise-IT environment; • adoption of various cybersecurity software, including but not limited to cloud-based malware, ransomware and antivirus software, phishing monitoring and artificial intelligence-based anomaly detection; • a security team principally responsible for managing (1) our cybersecurity risk-assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • security audits and a third-party risk assessment process for key service providers, suppliers and vendors.

companyName: Praxis Precision Medicines, Inc.

ticker: PRAX


text: We have also established a cross-functional Cybersecurity Committee led by our Chief Legal Officer and Chief Compliance Officer serving as the chair and consisting of senior leaders within our organization. The Cybersecurity Committee, with assistance from our outside information technology management/cybersecurity consultant, oversees our cybersecurity policy, which includes risk assessment, investments in cybersecurity technologies, cybersecurity insurance and review of relevant information technology policies.

companyName: KALA BIO, Inc.

ticker: KALA


text: Our management team, including our Chief Compliance Officer and Director of Engineering, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and external cybersecurity consultants. Our management team's experience includes a combined two decades of experience in various software development, cybersecurity, product management, and other technology-related roles. Our Chief Compliance Officer and Director of Engineering have each served in a number of significant leadership roles at our company since 2017 and 2013, respectively, including oversight of security, safety, and integrity initiatives Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.

companyName: Expensify, Inc.

ticker: EXFY


text: The CISO has served in various roles in information security and information technology for over 20 years for global travel, hospitality, casino, and energy companies along with consulting for both the U.S. Department of Defense and intelligence community. He holds an undergraduate degree in computer information systems, a master's degree in business administration, and has attained the Certified Information Systems Security Professional certification. The CTO holds an undergraduate degree in computer science and a master's degree in business administration, and has served in various roles in information technology for over 30 years for global travel, hospitality, and finance companies, including serving as either the Chief Technology Officer or Chief Information Officer of Qatar Airways Group and MGM Resorts International.

companyName: Travel & Leisure Co.

ticker: TNL


text: The Audit Committee of our Board of Directors is primarily responsible for overseeing the Company's compliance and risk management obligations, including the management of risks from cybersecurity threats. Pursuant to its charter, the Audit Committee is responsible for monitoring the effectiveness of the Company's information system and cybersecurity controls.

companyName: Akari Therapeutics Plc

ticker: AKTX


text: Response to Security Vulnerabilities In response to identified risks, management may take certain steps to correct and respond to security vulnerabilities, which may include: • Eliminating unwarranted risks by applying vendor-provided software fixes, commonly called patches. • Ensuring that changes to security configurations are documented, approved, and tested. • Ensuring that exploitable files and services are assessed and removed or disabled based upon known vulnerabilities and business needs. • Updating vulnerability scanning and intrusion detection tools to identify known vulnerabilities and related unauthorized activities. • Conducting subsequent penetration testing and vulnerability assessments, as warranted. • Reviewing performance with service providers to ensure security maintenance and reporting responsibilities are operating according to contract provisions and that service providers provide notification of system security breaches that may affect the Company.

companyName: CFSB Bancorp, Inc. /MA/

ticker: CFSB


text: While we are regularly subject to cybersecurity attacks, ransomware and other security breaches, the Company has not experienced any material cybersecurity incidents or a series of related unauthorized occurrences for the year ended December 31, 2023. The Company does not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect the Company or its business strategy, results of operations or financial condition. However, as discussed under " Item 1A. Risk Factors," specifically the risks titled "Disruptions, failures or security breaches of our information technology infrastructure could have a negative impact on our operations," the sophistication of cyber, ransomware and other security threats continues to increase, and the preventative actions we take to reduce the risk of these incidents and protect our systems and information may be insufficient. Accordingly, no matter how well designed or implemented our controls are, we will not be able to anticipate all cybersecurity attacks, ransomware and other security breaches and we may not be able to implement effective preventive measures against such security breaches in a timely manner.

companyName: HERSHEY CO

ticker: HSY


text: Risks from cybersecurity threats are integrated into Medtronic's enterprise risk management (ERM) program. The ERM program establishes a risk management framework that seeks to identify, assess, and mitigate risks that could materially impact the Company's business and operation.

companyName: Medtronic plc

ticker: MDT


text: The Program is designed to adapt to an evolving landscape of emerging cybersecurity threats and advancing technology to determine the Company's cybersecurity preparedness. Through routine data gathering, emerging risks, internal incidents, technology investments and internal controls, our Program and overall cybersecurity risk strategy is adjusted as needed.

companyName: F&M BANK CORP

ticker: FMBM


text: Process We strive to follow the guidelines set by the National Institute of Standards and Technology Cybersecurity Framework to manage information assets, protect sensitive data and mitigate security risks. To address risks from cybersecurity threats, we maintain an information security team, automated monitoring and detection services, and policies and procedures for managing risks to our information systems. As part of our information security program, our operations strive to assess, identify and manage cybersecurity threat risks by: • identifying cybersecurity threats and critical information assets; • implementing cybersecurity prevention, detection and response controls; • incorporating cyber risk assessment practices into program activities; and • integrating cyber risk management into our business risk governance practices.

companyName: OIL STATES INTERNATIONAL, INC

ticker: OIS


text: On an annual basis, the Board of Directors and Audit Committee discuss the Company's approach to cybersecurity risk management with the members of management's Sarbanes-Oxley & Cybersecurity Steering Committee, which includes the Company's President and Chief Financial Officer ("CFO") and Vice President of Information Technology.

companyName: TRANSACT TECHNOLOGIES INC

ticker: TACT


text: Cybersecurity risk oversight and management is a critical component of the Company's overall enterprise risk management and top priority for the Company and its Board of Directors. The Company's Board of Directors has delegated management of Enterprise Risk Management, which includes cybersecurity, to the HEI and Hawaiian Electric Audit and Risk Committees (collectively, the ARCs). The ARCs exercise their oversight responsibility of cybersecurity through quarterly (or more frequently if necessary) cybersecurity risk updates and reports of incidents, if any, by management (primarily the Utilities' Chief Information Officer and Chief Information Security Officer). In early 2023, in recognition of the increased cybersecurity threats and heightened cybersecurity risks facing the Company, the ARCs formed the Cybersecurity Working Group (CWG), which is currently comprised of two directors, one from each of the HEI and Hawaiian Electric Boards of Directors. The purpose of the CWG is to oversee and conduct periodic meetings with management to discuss cyber risk, risk treatment, and operational activities relative to cyber risk treatment and to report matters to the ARCs. The CWG also evaluates cybersecurity areas highlighted by the ARCs including areas the CWG deems higher risk or topical and reports back to the ARCs on a quarterly basis. The CWG also coordinates with the Company's management on regular trainings and tabletop exercises for the Board of Directors.

companyName: HAWAIIAN ELECTRIC INDUSTRIES INC

ticker: HE


text: FactSet's information security program is grounded in a risk-based approach. Our information security team undertakes various activities to assess, identify, and manage risks from cybersecurity threats, including managing security controls, conducting penetration testing, leading training and tabletop exercises, and conducting internal and external vulnerability assessments. Findings from our internal and external vulnerability assessments are classified using a combination of scores and internal business metrics. Findings are remediated commensurate with the respective risk rating. FactSet's IT Risk Management Policy includes severity-based escalation requirements designed to ensure proper management-level visibility and evaluation of risk issues, regardless of the source of that risk.

companyName: FACTSET RESEARCH SYSTEMS INC

ticker: FDS


text: Bank policies and processes are designed such that the Board would receive prompt and timely information from the Information Security Department or the Enterprise Risk Committee on any cybersecurity or information security incident or threat that may pose significant risk to the Bank and would continue to receive regular reports on any incident until its conclusion. At least quarterly, or more often, as necessary, the Board discusses cybersecurity and information security risks with the Bank's Chief Information Security Officer.

companyName: Federal Home Loan Bank of San Francisco


text: CFO, in his capacity, regularly informs the Chief Executive Officer (CEO) of all aspects related to cybersecurity risks and incidents.

companyName: BIOXYTRAN, INC

ticker: BIXT


text: • Third-party assessments of Wheels Up: We have engaged third-party cybersecurity companies to periodically assess our cybersecurity and data privacy processes and procedures, and to assist in identifying and remediating risks from cybersecurity threats. Our third-party assessors regularly conduct penetration testing and measure our processes, procedures and responses against industry standard frameworks. We use the results of these periodic assessments to implement programmatic changes and continuous improvements in alignment with business requirements, industry standards and regulatory requirements.

companyName: Wheels Up Experience Inc.

ticker: UP


text: We conduct periodic risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks. Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards.

companyName: AEHR TEST SYSTEMS

ticker: AEHR


text: Related to Cybersecurity Risks Our Board of Directors is responsible for the strategic leadership and direction of our cybersecurity program. Our Board has oversight over cybersecurity risks. Our management may provide periodic presentations to the Board on our cybersecurity program, including updates on cybersecurity risks and related cybersecurity strategy, as applicable.

companyName: Pioneer Green Farms, Inc.


text: As of the date of this Report, we have not experienced any material cybersecurity incidents or identified any material cybersecurity threats that have affected or are reasonably likely to materially affect us, our business strategy, results of operations or financial condition.

companyName: CHINA PHARMA HOLDINGS, INC.

ticker: CPHI


text: In connection with the board's oversight of risk management, cybersecurity updates are provided to the board at least quarterly, including, but not limited to, the following materials: Annual Gramm-Leach-Bliley Act Information Security Program (ISP) Report, IT Risk Management and IT Security Metrics, Penetration Testing and Tabletop Exercise updates, IT Risk Assessments, Disaster Recovery Test Results, Third Party Risk Management Metrics, Incident Response Metrics, Security Awareness Training Metrics and additional cybersecurity education topics.

companyName: GREAT SOUTHERN BANCORP, INC.

ticker: GSBC


text: Protective Operations includes the Security Operations Center, cyber threat intelligence, offensive security, and application security teams. New cybersecurity threats surface daily, and existing cybersecurity threats evolve constantly. Our 24x7x365 in-house Security Operations Center is organized to not only monitor for signs of intrusion but also to provide contextual threat intelligence to system and platform owners across the enterprise, empowering them to take an active role in defending the enterprise. The Security Operations Center conducts daily briefings, identifies emerging cyber threats affecting the financial and education sectors, and reviews new tactics, techniques, and procedures utilized by cyber criminals and nation-state cyber actors. The Security Operations Center is also our incident response team, focused on detecting, analyzing, containing, eradicating, and recovering from cyber incidents. While we have experienced cybersecurity incidents in the past, to date none have materially affected us, including our business strategy, results of operations, or financial condition. Our offensive security team conducts continuous threat-based and risk-based red team activities, and our application security team utilizes a combination of training, tools, code reviews, and awareness designed to ensure that our applications are developed with security at the forefront. We also engage with professional cybersecurity firms to conduct penetration tests on specific systems and applications annually. For more information about the cybersecurity risks we face, see the factors set forth under the caption "Risk Factors" in Part I, Item 1A of this report.

companyName: NELNET INC

ticker: NNI


text: The Cybersecurity Program maintains a cybersecurity governance and oversight framework that seeks to drive accountability for all levels of employees, including senior management and executive officers. Cybersecurity matters are generally managed by a combination of working groups led by senior management that report to the cybersecurity steering committee or cybersecurity executive oversight committee, as appropriate, on matters such as, among other things, enterprise level cybersecurity initiatives and directives, threat intelligence and product cybersecurity risks and remediations. Our cross functional cybersecurity steering committee, which is led by the CISO, is composed of members of senior management, including the Chief Information Officer, and reviews matters such as product security escalations, critical remediations and disclosure recommendations. The output from the steering committee meetings is discussed at meetings of Baxter's cybersecurity executive oversight committee, which is led by the CISO and includes the Chief Executive Officer, Chief Financial Officer, General Counsel, Chief Compliance & Trust Officer and our business segment presidents. The cybersecurity executive oversight committee meets quarterly, oversees enterprise and cybersecurity risk management and reports to the Audit Committee and QCT Committee of the Board. The Audit Committee currently oversees our information technology functions generally, including non-product-related cybersecurity matters, and the QCT Committee oversees product or service-based information technology matters, including with respect to product cybersecurity matters. The Audit Committee is also responsible for the oversight of any cybersecurity incident, including ones related to our products and services. Both committees receive updates from management on cybersecurity-related topics within their purview throughout the year. Additionally, the full Board generally receives periodic updates on information technology and cybersecurity matters from management and external advisors.

companyName: BAXTER INTERNATIONAL INC

ticker: BAX


text: Our Program includes the following elements: (i) internet and perimeter security; (ii) endpoint and email security; (iii) threat intelligence, monitoring and management; (iv) data security for PHI, PII, and PCI; (v) personal accountability, which includes comprehensive training for our employees and third party-contractors (including onboarding and annual training), exercises (including advanced phishing exercises), and awareness for our employees to promote vigilance of cybersecurity risks and opportunities; (vi) access management; (vii) application and cloud security; and (viii) compliance audits and assessments, which include routine technical and non-technical audits and assessments internally and in collaboration with independent third parties at least annually.

companyName: R1 RCM Inc. /DE


text: The audit committee receives periodic reports from our Chief Information Officer concerning significant cybersecurity threats and risk and the processes we have implemented to address them. Under our incident response plan, certain incidents would also be reported to the board.

companyName: Arcus Biosciences, Inc.

ticker: RCUS


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, cybersecurity risk is addressed as a component of the Company's enterprise risk management program. The IT department works with Company management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business. Our senior management evaluates material risks from cybersecurity threats against our overall business objectives and reports to the Board, which evaluates our overall enterprise risk.

companyName: EMERSON RADIO CORP

ticker: MSN


text: The Company has established a Core Incident Response Team, which is comprised of the VP of Information Technology and members of the cybersecurity, legal and enterprise risk & commercial compliance teams. The Core Incident Response Team works with other members of the Company's management and collaboratively across the Company to promptly respond to cybersecurity incidents in accordance with the Company's incident response and recovery plans. Through the ongoing communications from these teams, the Core Incident Response Team, along with the Chief Financial Officer, monitors the prevention, detection, mitigation and remediation of cybersecurity incidents in real time. Cybersecurity events that meet specified criteria are escalated for further review by the Audit Committee and/or the Disclosure Committee.

companyName: Revance Therapeutics, Inc.


text: Wesbanco continues to foster a risk averse focus and leverages various threat intelligence sources to continually evaluate current and future risks to the organization. The bank invests in continuing education of the security team and in technologies that help protect its systems and data. Required security awareness training is provided to all employees to ensure that corporate policies are understood and followed. The bank's cybersecurity strategy and roadmap are frequently evaluated and updated according to multiple inputs including any tangible cybersecurity incidents. Incident Management and Response is led by a cross functional incident response team that handles critical incidents inclusive of cybersecurity incidents. In addition to handling critical incidents, the response team coordinates an annual tabletop exercise aimed at continually practicing documented incident response processes. These tabletop exercises include participation from executive leadership and periodically members of the board of directors. The Incident Response team is chaired by the Chief Security Officer and membership of the Incident Response team includes representation from Human Resources, Information Technology, Fraud and BSA, Corporate Communications, Risk Management, Investor Relations, Retail Banking, Compliance, Bank Operations, Legal Counsel, Customer Support, and Digital Banking and Payments.

companyName: WESBANCO INC

ticker: WSBC


text: Providing company-wide training and conducting periodic exercises to promote employee and stakeholder preparedness and awareness of the Plan; and Reviewing the Plan at least annually, or whenever there is a material change in the Company's business practices that may reasonably affect its cyber incident response procedures.

companyName: JUNIATA VALLEY FINANCIAL CORP

ticker: JUVF


text: For the years covered by this report, the Company did not identify any security threats or incidents that have materially affected or are reasonably likely to materially affect its business strategy, results of operations or financial condition. However, like all other enterprises, the Company faces known and unknown cybersecurity risks and threats that are not fully mitigated. While the Company works continuously to enhance its security programs and risk management efforts, it discovers vulnerabilities from time to time and there can be no assurance that the Company has not experienced an undetected cybersecurity incident or that it will not experience material loss or damage from an incident in the future.

companyName: BLACKBERRY Ltd

ticker: BB


text: Our board of directors established a technology committee (the "Technology Committee") to oversee the risks from cybersecurity threats. The Technology Committee is currently comprised of three independent directors and chaired by Maryann Goebel, who was awarded the CERT Certificate in Cybersecurity Oversight from the National Association of Corporate Directors (NACD). Our CTO works closely with the Technology Committee to develop the meeting agenda and to prepare the relevant materials for each committee meeting. The Technology Committee typically reviews an updated version of the cybersecurity risk assessment program (described above) at each meeting. The Technology Committee receives and reviews cybersecurity incidents that are reported in accordance with the SIRP and our other procedures. The Technology Committee typically meets on a quarterly basis. The Chairperson of the Technology Committee makes a regular report to our board of directors following each meeting of the Technology Committee. Our board of directors retains ultimate responsibility for the oversight of the major risks inherent in our business, including risks from cybersecurity threats.

companyName: Repay Holdings Corp

ticker: RPAY


text: Our cybersecurity risk management program is overseen by our Board of Directors. Members of the Board of Directors and the Audit Committee will periodically meet with our CITO to discuss material cybersecurity risks facing our organization and significant changes or updates to our cybersecurity processes. The full Board of Directors receives a cybersecurity risk management update from management generally on a quarterly basis.

companyName: UNIFIRST CORP

ticker: UNF


text: We design and assess our cybersecurity risk management program against the National Institute of Standards and Technology Cybersecurity Framework (the "NIST Framework"). This does not imply that Okta satisfies any particular specifications or requirements, only that we use the NIST Framework to guide our efforts to improve our security posture.

companyName: Okta, Inc.

ticker: OKTA


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Our information technology systems or data, or those of our service providers or customers or users could be subject to cyber-attacks or other security incidents, which could result in data breaches, intellectual property theft, claims, litigation, regulatory investigations, significant liability, reputational damage and other adverse consequences" included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K.

companyName: Tesla, Inc.

ticker: TSLA


text: Our cybersecurity risk assessment, identification, and management process consists of a dedicated Governance Risk and Compliance ("GRC") team, within our Information Security organization, that implements a repeatable, ISO/IEC 27001-compliant methodology to asses and track cybersecurity risk. This team, reporting to and working with the Chief Information Security Officer ("CISO"), identifies, tracks, and updates cybersecurity risks that threaten the Company directly and through third parties. The GRC team collaborates closely with risk owners throughout the Company, vendors, and suppliers, working with them in an effort to ensure their risks are identified, documented, and mitigated in a timely fashion. In addition to our active ISO/IEC 27001 certification, the Company also assesses itself against the National Institute of Standards and Technology Special Publication 800-171 as required by the Defense Federal Acquisition Regulation Supplement. In accordance with our ISMS, we also actively monitor known threats that could affect our products and services and work with our suppliers to provide us with real-time reports of threats or vulnerabilities that may affect our enterprise-wide systems. Our program also includes a cyber incident response plan that provides controls and procedures for timely and accurate reporting of any material cybersecurity incident as well as a business continuity plan that is designed to provide a clear framework for how the Company can continue in the event of any significant disruption in an effort to ensure that we can offer the same level of security, support, and excellence to all our customers. In the normal course, our Security and GRC teams engage assessors, consultants, and other third parties to assist in various cyber-related matters. For example, to maintain our ISO certification, the Company utilizes an external third party to conduct yearly audits of its ISMS. Our Information Security organization also leverages third-party advisors, as appropriate, for various tasks such as conducting annual third-party penetration testing.

companyName: TELOS CORP

ticker: TLS


text: Our Board recognizes the critical importance of maintaining the trust and confidence of our customers, suppliers, business partners and employees. Our Board and our Audit Committee are actively involved in oversight of our risk management program, and cybersecurity represents an important component of our overall approach to enterprise risk management ("ERM"). Our cybersecurity policies, standards, processes, and practices are fully integrated into our ERM program and are based on recognized frameworks and applicable established industry standards. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: JEWETT CAMERON TRADING CO LTD

ticker: JCTC


text: As referenced in the Operational Risks/Cyber Risks section of Item 1A. Risk Factors included in this Form 10-K, our organization may be materially affected by cybersecurity threats and incidents that target its internally managed information technology systems or our critical vendor systems.

companyName: COMMUNITY TRUST BANCORP INC /KY/

ticker: CTBI


text: From time to time, we engage third-party service providers to enhance our risk mitigation efforts. For instance, we have routinely engaged an independent cybersecurity advisor to lead a cybersecurity crisis simulation exercise that has been used by our senior leaders to prepare for a possible cyber crisis. In addition, we have engaged: Novacoast, an international cybersecurity company specializing in IT services and software development, to augment our monitoring and detection efforts; Synopsys, Inc., a leader in electronic design automation, to perform our external penetration testing and vulnerability assessment; Recorded Future, one of the world's largest intelligence companies, and Mandiant, a recognized leader in cyber defense, threat intelligence and incident response services, to provide threat intelligence and analysis services; and Mandiant to augment our incident response ability and provide forensic services. We also purchase insurance to protect us against the risk of cybersecurity breaches. Our Senior Vice President and Treasurer is responsible for our insurance programs and reviews on a regular basis our cyber insurance policies and assesses whether we have appropriate coverage.

companyName: SIRIUS XM HOLDINGS INC.

ticker: SIRI


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. For additional information, see Item 1A. "Risk Factors—Information technology system failures or breaches of our network security could interrupt our operations and harm our business, financial condition and results of operations."

companyName: CHUY'S HOLDINGS, INC.


text: As a biotechnology company, we must comply with extensive regulations, including requirements imposed by the Food and Drug Administration related to adequately safeguarding patient information and reporting cybersecurity incidents to the SEC. We work with our cybersecurity consultant on assessing cybersecurity risk and on policies and practices aimed at mitigating these risks. We believe we are positioned to meet the requirements of the SEC. In addition to following SEC guidance and implementing pre-existing third party frameworks, we have developed our own practices and frameworks, which we believe enhance our ability to identify and manage cybersecurity risks. Third parties also play a role in our cybersecurity. We engage third-party services to conduct evaluations of our security controls, whether through penetration testing, independent audits, or consulting on best practices to address new challenges. Assessing, identifying, and managing cybersecurity related risks are factored into our overall business approach.

companyName: Unicycive Therapeutics, Inc.

ticker: UNCY


text: Frequent testing/auditing activities, bottom-up cybersecurity risk assessments, vulnerability scanning, monitoring of external threat intelligence and supplier risk sources, and 24/7 incident monitoring are executed by the cybersecurity function to inform our understanding of the cybersecurity risk landscape, including solutions from third-party service providers, and what areas of enhancement to prioritize. Further input is gained from regular maturity assessments executed by third parties as well as TISAX assessments executed by external audit bodies.

companyName: AUTOLIV INC

ticker: ALV


text: Management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and maintaining cybersecurity programs. The Company's cybersecurity team regularly meets with the COO to report its findings. The COO in turn periodically reports on such matters to the Chief Executive Officer and other members of management.

companyName: Mobileye Global Inc.

ticker: MBLY


text: We have an incident response process that is activated in the event of a direct or third-party attack. The plan is designed to help us detect, respond to and recover from cybersecurity incidents. Criteria are in place to determine the scope and severity of an incident, in relation to: incident reporting to the Audit Committee and/or the Board; disclosure or other external reporting; compliance with applicable legal obligations and mitigation of the impact to our brand, its reputation and any impacted parties.

companyName: Portillo's Inc.

ticker: PTLO


text: The CISO has over 26 years of experience with information technology management, information security, compliance, audit, and process improvement. Our Information Security Analysts have a combined 22 years of experience with information security, information technology servers and information technology networks. The CISO and Information Security Analysts are active members of the following management level committees at the Bank: Information Technology Steering Committee and the Change Control Committee.

companyName: CHEMUNG FINANCIAL CORP

ticker: CHMG


text: Through oversight of the cybersecurity risk management program, our CSO is continually informed about the status of the program, including the effectiveness of the process and controls to monitor, prevent, detect, mitigate, and remediate cybersecurity incidents. The CSO is also made aware of the latest developments in cybersecurity, including potential threats and innovative risk management techniques. The CSO, in his capacity, regularly informs the Chief Information Officer and other members of our senior management team of all aspects related to cybersecurity risks and incidents.

companyName: BLACK HILLS CORP /SD/

ticker: BKH


text: We evaluate the risks associated with technology and cybersecurity threats and monitor our information systems for potential weaknesses. We review and test our information technology system on an as-needed basis (and at least on an annual basis) and also utilize internal team personnel to evaluate and assess the efficacy of our information technology system and enhance our controls and procedures. The results of these assessments are reported to our Audit Committee and, from time to time, our Board of Directors.

companyName: Beauty Health Co

ticker: SKIN


text: To date, our business strategy, results of operations, and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity-related risks, see "Risks Related to Information Security and Technology" in Item 1A, Risk Factors, of this Form 10-K.

companyName: GAP INC

ticker: GAP


text: The Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics which may pose potential impacts to the Company's operations from our Chief Technology Officer. Board members also receive external training or attend seminars on cybersecurity topics that impact public companies as part of their continuing education.

companyName: Consolidated Communications Holdings, Inc.


text: From time to time, the Company is subject to attempted cyber-attacks and other cybersecurity risks. The nature of our business requires that we store and exchange electronically with appropriate parties and systems personally identifiable information that may be targeted in an attempted cybersecurity breach. In addition, our business is heavily reliant on various information technology and application systems that may be impacted by a malicious cyber-attack. These cyber incidents may cause lost revenues or increased expenses stemming from reputational damage and fines related to breach of personally identifiable information, inability to use certain systems for a period of time, loss of financial assets, remediation and litigation costs and increased cybersecurity protection costs. We have developed and continue to invest in a variety of controls to prevent, detect and appropriately react to such cyber-attacks including periodically testing our systems' security and access controls. However, cybersecurity risks continue to become more complex and broad ranging, and our internal controls provide only a reasonable, not absolute, assurance that we will be able to protect ourselves from significant cyber-attack incidents.

companyName: Unique Logistics International, Inc.


text: In 2024, we were a SPAC with no business operations other than that following our Offering, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. We assess and identify the possibility of risk from cybersecurity threats considering both our operations and the nature of our assets, which consist solely of the funds in our Trust account managed by a third-party Trustee and the funds in our operating bank account. To date, we have not experienced any cybersecurity attacks. In light of the nature of our operations in identifying and evaluating suitable acquisition transaction candidates, we believe that cybersecurity threats are not reasonably likely to materially affect these business operations. In addition, the procedures in place with third parties that maintain our assets are such that it also should not be reasonably likely for cybersecurity threats to materially affect our financial condition. But we recognize that a penetration of our systems or a third party's systems could subject us to business, regulatory, litigation and reputation risk, which could have a negative effect on our business, financial condition and results of operations.

companyName: GigCapital7 Corp.

ticker: GIG


text: We maintain a Cybersecurity Incident Management Policy (Cybersecurity Policy), which provides guidance and processes for identifying, reporting, assessing, resolving and ensuring timely public disclosure, when appropriate, of cybersecurity threats, including both cybersecurity threats directed at our company and those associated with our use of third-party service providers. We have retained a leading cybersecurity incident response vendor to assist us in responding to cybersecurity incidents and we maintain relationships with integration vendors to help us recover or rebuild technology systems in the event of a large-scale cybersecurity incident.

companyName: EQT Corp

ticker: EQT


text: Delek has not experienced a significant cybersecurity breach or associated expenses, penalties, or settlements for years ended December 31, 2023, 2022 and 2021. Delek continuously assesses and enhances the confidentiality, integrity, and availability of our IT and OT assets.

companyName: Delek US Holdings, Inc.

ticker: DK


text: The Company's cybersecurity incident response and breach management processes are intended to detect and analyze security incidents; to contain, eradicate and recover from such incidents; and to conduct a post-incident analysis to determine whether any changes to processes or security measures are merited. Such incident responses are overseen by a Breach Response Team consisting of leaders from the Company's Information Technology, Legal, Finance, Risk Management and Human Resources departments, with the assistance of external technical, legal and law enforcement support, as and when appropriate. Security events and data incidents are evaluated, ranked by severity and prioritized for response and remediation. Incidents are evaluated to determine materiality and operational, business and privacy impact, as well as the potential need for timely public disclosure.

companyName: MOVADO GROUP INC

ticker: MOV


text: Cybersecurity Risks We have not experienced or identified risks from cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.

companyName: Galera Therapeutics, Inc.

ticker: GRTX


text: Our cybersecurity risk management program includes a number of components, such as information security program assessments and ongoing monitoring of critical risks from cybersecurity threats using automated tools. We periodically engage third parties to conduct risk assessments and testing of our systems, including penetration testing and other vulnerability analyses. Additionally, we have implemented an employee education program that is designed to raise awareness of cybersecurity threats, including risks posed by phishing attempts. We have implemented a process for this training to be included during the employee onboarding process and periodically thereafter.

companyName: BridgeBio Pharma, Inc.

ticker: BBIO


text: Cybersecurity threats continue to evolve. We consider cybersecurity threats along with other significant risks that we face within our overall enterprise risk management framework. In the last fiscal year, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us. However, cybersecurity attack techniques change frequently, and with increased volume and sophistication of such attacks, there can be no guarantee that we will not be the subject of future successful attacks, threats or incidents that could materially affect us.

companyName: Leslie's, Inc.

ticker: LESL


text: Our processes also address cybersecurity risks associated with our use of third-party service providers, including those in our supply chain, which also include, but are not limited to, open-source software in our application development processes, or those who have access to our customer and employee data or our systems. Our cybersecurity program is closely aligned with our commitment to data privacy. We adhere to applicable data protection laws and regulations, integrate privacy-by-design principles into our processes, and routinely assess our practices to ensure that we protect customer, employee, and partner information. Addressing these risks is part of our enterprise risk management program. Cybersecurity risks affect the selection and oversight of our third-party service providers. We perform diligence on third-parties that have access to our critical systems, data or facilities that house such systems or data, and monitor cybersecurity threat risks identified through such diligence. Additionally, we may impose contractual requirements related to cybersecurity on certain third parties that could pose significant cybersecurity risk to us and require them to agree to audits as appropriate.

companyName: Sunrun Inc.

ticker: RUN


text: We also use third-party service providers to perform a variety of functions throughout our business, such as contract research organizations, contract manufacturing organizations, and other distributors, including those who process clinical trial data on our behalf. Depending on the nature of the services provided, the sensitivity of the critical systems, information and assets at issue, and the identity of the provider, our third-party risk management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider, including, for example, a review of security assessments and imposition of contractual obligations related to cybersecurity on the provider.

companyName: Immunocore Holdings plc

ticker: IMCR


text: We have established processes and policies for assessing, identifying and remediating material risks posed by cybersecurity threats. Our processes and policies are based upon the National Institute of Standards and Technology Cybersecurity Framework. Our processes are focused on: (i) effecting organizational education on how to manage cybersecurity risks, (ii) implementing safeguards to protect our systems, (iii) detecting the occurrence of a cybersecurity incident, (iv) responding to a cybersecurity incident and (v) recovering from a cybersecurity incident. Additionally, we have a cybersecurity incident response plan including specific responsive protocols administered by an incident response team, led by our Vice President of Information Technology and comprised of other members of management.

companyName: Thryv Holdings, Inc.

ticker: THRY


text: We utilize a set of third parties for technical and non-technical evaluation of our security posture, including regular assessment of our products for vulnerabilities. We also perform an annual external "red team" assessment that provides an attack simulation for our security operations team to identify and triage. We perform a vendor security assessment process for purchases over a certain minimum threshold.

companyName: TRIMBLE INC.

ticker: TRMB


text: 1.Identification: We evaluate the activities of our lines of business on a regular basis to identify potential technology risk, including cybersecurity threats and vulnerabilities. This process takes into account the changing business environment, the technology and cyber threat landscape, and the objectives of the line of business being assessed. Capital One Financial Corporation (COF)

companyName: CAPITAL ONE FINANCIAL CORP

ticker: COF


text: Our cybersecurity program leverages both internal and external techniques and expertise across the cybersecurity spectrum. We maintain and utilize industry best practice capabilities, processes, and other security-related measures, based upon National Institute of Standards and Technology (NIST) and Control Objectives for Information Technologies (CoBIT) frameworks. Our capabilities, processes, and other security measures include, among others: • Threat detection through the use of security information and event management software; • Incident management processes for any security-related activity, requiring senior management signoff; • Corporate endpoint detection and response software, which monitors for malicious activities on external-facing endpoints; • Cloud monitoring tools, running on primary public and private cloud environments; • Data encryption at rest and during transit and immutable data backups; and • Business continuity, disaster recovery and incident response plans.

companyName: AMERICAS CARMART INC

ticker: CRMT


text: Our Chief Executive Officer and President (CEO) has ultimate responsibility for developing strategy and overseeing execution to meet the firm's objectives. The CEO has delegated to our Chief Operating Officer (COO) oversight of this operational execution. The COO has several leaders within the COO organization who develop and oversee the firm's risk management, technology, and information security practices. These executive leaders play a critical role in cybersecurity risk management and strategy, as further described below.

companyName: PRICE T ROWE GROUP INC

ticker: TROW


text: Water utilities face several cybersecurity risks due to their critical role in monitoring and controlling water treatment and distribution processes and servicing customers. The key risks the Company has evaluated that could adversely impact system confidentiality, integrity, and/or availability include:

companyName: YORK WATER CO

ticker: YORW


text: Pursuant to its charter, the Audit and Finance Committee of our Board of Directors is principally responsible for oversight of managements' actions to monitor and control cybersecurity risk exposure. The CIO routinely reports to the Audit and Finance Committee on enterprise cybersecurity matters, including, as appropriate, information security strategy, policies, and procedures, status of cybersecurity initiatives, results of third party assessments, emerging cybersecurity threats and risks, steps taken to mitigate such threats and risks, and cybersecurity developments and trends. The Audit and Finance Committee reports to the full Board and, if warranted, coordinates with the Board to address material risks. In addition, the full Board receives a cybersecurity briefing from the CIO annually.

companyName: ADVANCED ENERGY INDUSTRIES INC

ticker: AEIS