text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, could be reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. Refer to Part I, Item 1A "Risk Factors" for risks related to cybersecurity.

companyName: TransUnion

ticker: TRU


text: Atkore's commitment to cybersecurity emphasizes maintaining secure technology and data environments and the cultivation of a security-minded culture and capability. We do this through education and training, and a layered approach to identifying, preventing, detecting, responding and restoration from cybersecurity threats and incidents. Key elements of our program for assessing, identifying, and managing material risks from cybersecurity threats are anchored in widely used and industry recognized security frameworks and are described below.

companyName: Atkore Inc.

ticker: ATKR

secItem: Item 1C


text: The Bancorp has established an Enterprise Risk Management Framework which informs the Bancorp's risk management programs. As part of this framework, the IT CSRM team maintains the Bancorp's IT CSRM Program, which is designed to identify, assess, manage, monitor, and report cybersecurity risks as part of the Bancorp's independent risk management function. The IT CSRM team is responsible for defining the risk management practices set forth in the IT CSRM Program. Refer to the Risk Management – Overview section of Item 7 (Management's Discussion and Analysis of Financial Condition and Results of Operations) of this Annual Report for additional information on the Bancorp's Enterprise Risk Management Framework and related risk management processes.

companyName: FIFTH THIRD BANCORP

ticker: FITB


text: Impact of Risks from Cybersecurity Threats. As of the date of this Report, we are not aware of any previous cybersecurity threats that have materially affected, or are reasonably likely to materially affect, the Company, including our business strategy, results of operations or financial condition. Notwithstanding the approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. more information on our cybersecurity related risks, see "Item 1A. Risk Factors" above for additional information.

companyName: MEXCO ENERGY CORP

ticker: MXC


text: Our business relies on IT systems to process, transmit and store electronic information, including customer, employee and company data. The secure processing, maintenance and transmission of this information, including information housed both within an internal IT system or with a third-party and cloud-based environments, is critical to our operations. Each of the systems utilized in our business operations is subject to continually evolving cybersecurity risks and threats that present a risk to the continuity of our business operations, potential financial losses and damage to our reputation, including a loss of public trust.

companyName: Elanco Animal Health Inc

ticker: ELAN


text: In response to the complexity and evolving nature of cybersecurity threats, incidents and risks, we engage with a range of third-party experts, including cybersecurity penetration testers, data protection services, security awareness and training, and AI based security services in evaluating and supporting our risk management. Our collaboration with these third parties includes regular independent audits, threat assessments, and consultation on security enhancements. Depending on the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, we evaluate the security and risk posture of third-party service providers according to the perceived level of risk and benchmarked against industry standard best practices.

companyName: Cue Biopharma, Inc.

ticker: CUE


text: The Company's internal controls incorporate a protocol for reporting and escalating information security matters to management and the Board of Directors for resolution and, if necessary, disclosure of any material incidents. The Board oversees continuous efforts to strengthen operational resilience and receives ongoing education to enhance their oversight capabilities in the face of evolving threats. The ISO, who reports directly to the Chief Risk Officer, periodically updates the Company's Information Technology Committee, the Company's Audit and Risk Committee ("ARC Committee") and the Board of Directors on information and cybersecurity risks, threats, exposures, and mitigation measures. The Company's IRP is regularly tested, incorporating cybersecurity scenarios.

companyName: California BanCorp \ CA

ticker: BCAL


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (Committee) oversight of cybersecurity risks, including oversight of management's implementation of our cybersecurity risk management program.

companyName: CARGO Therapeutics, Inc.


text: As part of our cybersecurity program, we have and will continue to engage third parties, such as consultants, network security firms, auditors, and forensics providers, to assist us in assessing, managing, or investigating cyber risks or incidents. For example, we have engaged industry recognized third parties to monitor and conduct penetration and vulnerability testing on our networks and to assist us in the conduct of tabletop exercises.

companyName: STANDEX INTERNATIONAL CORP/DE/

ticker: SXI


text: We use a risk management framework based on applicable laws and regulations, and informed by industry standards and industry-recognized practices, for managing cybersecurity risks within our products and services, infrastructure, and corporate resources. This risk management framework is implemented through our Cybersecurity Program. Our Cybersecurity Program is designed to provide a framework for assessing the potential threats to the security and integrity of our systems, networks, databases, applications, electronic information and intellectual property and developing appropriate defenses based on these assessments. We routinely invest to develop and implement numerous cybersecurity programs and processes, including risk management and assessment programs, security and event monitoring capabilities, detailed incident response plans, and other advanced detection, prevention and protection capabilities, including practices and tools to monitor and mitigate insider threats. We regularly assess cybersecurity risks to identify and enumerate threats to us and vulnerabilities these threats can exploit to adversely impact our business operations. In some instances, we engage third parties to conduct or assist us with conducting cybersecurity risk assessments. We have developed and implemented a security infrastructure designed to ensure infrastructure and data confidentiality, integrity, and availability.

companyName: SEI INVESTMENTS CO

ticker: SEIC


text: Board of Directors' Roles and Responsibilities The Audit Committee is responsible for oversight of the Company's risk management and mitigation, including but not limited to the Company's cybersecurity risks, and is regularly briefed by our CIO and CISO regarding the Company's cybersecurity risk management program, cybersecurity incidents involving the Company, vendors, suppliers, subcontractors and other third parties, as well as associated mitigation actions taken, in order to assess and manage associated risks and potential harm and damages. The Audit Committee reports to the Board on cybersecurity risks to the Company on a periodic basis.

companyName: Booz Allen Hamilton Holding Corp

ticker: BAH


text: Finally, Quaint Oak Bank complies with its regulatory requirements by having Federal and State safety and security examinations performed on a schedule dictated by the regulatory agencies. The results of these examinations are reviewed and approved by the Board of Directors. Additionally, all findings from these examinations are recorded and prioritized for remediation.

companyName: QUAINT OAK BANCORP, INC.

ticker: QNTO


text: The Audit Committee of the Board of Directors is responsible for overseeing the management of cybersecurity risks. The Audit Committee is informed about cybersecurity risks through quarterly reports from the Senior Director of Global IT Services and, as necessary, to the full Board. The Audit Committee also reviews and approves the company's cybersecurity policies and the Company's Senior Director of Global IT Services is responsible for developing and implementing our information security program and reporting on cybersecurity matters to the Board. This includes our overall information security strategy, policy, security engineering, operations and cyber incident detection and response reporting in alignment with Company policies. The current Senior Director of Global IT Services has more than 15 years of information technology and program management experience which includes information security, and others on our IT security team have years of cybersecurity experience and certifications.

companyName: BEL FUSE INC /NJ

ticker: BELFA


text: Identifying and assessing cybersecurity risks is integrated into our overall risk management program and processes. Cybersecurity risks related to our business, technical operations, data, and privacy, along with cybersecurity risk-related compliance issues, are identified and addressed through a framework consisting of third-party assessments, internal information technology audits, information security assessments, and risk and compliance reviews. We conduct regular privacy and cybersecurity reviews of systems, audit applicable data and information policies, perform penetration and vulnerability testing using third-party tools to test security controls, perform regular training and assessments for the Board of Directors and employees, monitor emerging data privacy and information security laws and regulations, and implement applicable changes to improve our overall security posture. We regularly engage third-party auditors to assess our cybersecurity program and compliance with all applicable "best practices" and regulations. The Company adjusts its information security policies, standards, processes and practices as necessary based on the information provided by these assessments and to remediate material identified vulnerabilities.

companyName: FARMERS & MERCHANTS BANCORP

ticker: FMCB


text: Oversee Third-Party Risk Prosper maintains stringent processes to oversee and manage the risks associated with third-party service providers, including a team focused on vendor, enterprise, and procurement risk management. We conduct diligence and security assessments of material third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. This monitoring includes an initial review of their information security program, annual re-assessments, and ongoing monitoring for security incidents. This approach is designed to mitigate risks related to data breaches or other security incidents originating from our material vendors and partners.

companyName: PROSPER MARKETPLACE, INC


text: Given our current stage of cybersecurity development, we have not experienced any significant cybersecurity incidents to date. However, we recognize that the absence of a formalized cybersecurity framework may leave us vulnerable to cyberattacks, data breaches and other cybersecurity incidents. Such events could potentially lead to unauthorized access to, or disclosure of, sensitive information, disrupt our business operations, result in regulatory fines or litigation costs and negatively impact our reputation among customers and partners. In addition, cybersecurity incidents could have material adverse effects on our business strategy, financial condition, and results of operations (e.g., a significant breach could result in direct financial losses due to fraud, system downtime impacting revenue generation, increased compliance costs or contractual liabilities with third-party are in the process of evaluating our cybersecurity needs and developing appropriate measures to enhance our cybersecurity posture. This includes considering the engagement of external cybersecurity experts to advise on best practices, conducting vulnerability assessments and developing an incident response strategy. Our goal is to establish a cybersecurity framework that is commensurate with our size, complexity and the nature of our operations, thereby reducing our exposure to cybersecurity risks.

companyName: Rubber Leaf Inc

ticker: RLEA


text: The Company faces risks from cybersecurity threats that could potentially have an adverse effect on our business, financial condition, results of operations, cash flows and/or reputation. Although such risks have not materially affected us, including our business strategy, results of operations or financial condition, to date, we have experienced threats to and breaches of our data and systems. For more information about the cybersecurity risks we face, see the risk factor entitled "Security breaches and other disruptions in the Company's IT systems, including the Company's ERP system, could limit the Company's capacity to effectively monitor and control our operations, compromise ours or our employees', customers' and suppliers' confidential information, or otherwise adversely affect the Company's operating results or business reputation" in Item 1A. Risk Factors.

companyName: ALTA EQUIPMENT GROUP INC.

ticker: ALTG


text: The VP of IT has served in various roles in information technology and information security for over 25 years, including serving as the Chief Information Security Officer of a healthcare company and a member of the cyber emergency response team at several companies. The VP of IT holds undergraduate and graduate degrees in computer science and has attained various professional certifications in cybersecurity. The NVP of Finance and the rest of the Cybersecurity Response Committee hold undergraduate and graduate degrees in their respective fields, and have over 50 years of collective experience managing enterprise risks at the Company and at similar companies, including risks arising from cybersecurity threats.

companyName: Dream Finders Homes, Inc.

ticker: DFH


text: QNB uses third-party vendors to assist in monitoring, detecting, and managing cyber threats, including managed security service monitoring, penetration testing, and vulnerability assessment. The Information Security Committee has established risk management guidelines for third-party vendors. QNB conducts due diligence reviews of third-party vendors before contracts or agreements for the provision of services are signed and conducts ongoing due diligence and oversight procedures with the frequency of the procedures determined based on a risk assessment of the services provided. Generally, QNB's agreements with service providers include cybersecurity and data privacy requirements.. All such agreements are reviewed at least annually. QNB cannot guarantee, however, that such agreements, due diligence, and oversight procedures will prevent a cybersecurity incident from impacting information systems. Moreover, as a result of applicable laws and regulations or applicable contractual provisions, QNB may be held responsible for cybersecurity incidents attributed to its service providers in relation to any data that QNB shares with such providers.

companyName: QNB CORP.

ticker: QNBC


text: We have the following security processes in place: • Cybersecurity Awareness Trainings: We educate employees on best practices for online safety and for identifying potential cybersecurity threats, including by initiating quarterly training programs for our non-represented salaried workforce. • Simulated Cyberattacks: With assistance from third-party providers, we periodically conduct penetration and vulnerability testing to test our technical controls and incident response plans. • Security Monitoring: We monitor our information technology environment with both our internal cybersecurity resources and third-party service providers. We also have processes in place to monitor the cybersecurity practices of various third-party service providers, including certain vendors that have access to our information systems or sensitive data. • Proactive Reporting and Investigation: As part of our training initiatives, we educate certain employees depending on their role on how to report any suspicious cyber activity or potential cybersecurity issues, and we investigate reported concerns.

companyName: PARK OHIO HOLDINGS CORP

ticker: PKOH


text: For a description of the risks from cybersecurity threats that may have a material effect on us, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "Security breaches, cyberattacks or other cyber-risks of our IT and production systems could expose us to significant liability and cause our business and reputation to suffer and harm our competitive position."

companyName: VARONIS SYSTEMS INC

ticker: VRNS


text: The Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated oversight of cybersecurity and other information technology risks to the Audit and Compliance Committee. The Audit and Compliance Committee oversees the development, implementation, and effectiveness of our strategies to monitor, mitigate, and respond to cybersecurity risks, as well as our procedures, policies, and resources for risk assessment and risk management. In this role, the Audit and Compliance Committee receives updates from management on these matters, including the results of risk assessments and audits and the progress of risk reduction initiatives, on a quarterly basis or more frequently, as needed. In addition, management updates the Audit and Compliance Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser potential impact.

companyName: Premier, Inc.


text: We manage risks from cybersecurity threats through our overall enterprise risk management process, which is overseen by our Board. Management has created a global information security program, which encompasses a dedicated global information security team and policies, procedures, and processes for assessing, identifying, and managing risks from cybersecurity threats. Marriott's policies, procedures, and processes follow recognized frameworks established by the National Institute of Standards and Technology ("NIST") and the International Organization for Standardization, as well as other relevant standards. Our program is designed to maintain the confidentiality, integrity, security, and availability of the data that is created, collected, stored, and used to operate our business.

companyName: MARRIOTT INTERNATIONAL INC /MD/

ticker: MAR


text: Holdings Corp. acknowledges the crucial necessity of establishing, executing, and sustaining strong cybersecurity measures to secure our information systems. This is undertaken to uphold the confidentiality, integrity, and accessibility of our data.

companyName: ASIAFIN HOLDINGS CORP.

ticker: ASFH


text: We have implemented and maintain a cybersecurity program that is aligned with the NIST Framework and designed to protect our information and to assess, identify, and manage risks from cybersecurity threats that may result in material adverse effects on the confidentiality, integrity, and availability of our information systems.

companyName: PATTERSON UTI ENERGY INC

ticker: PTEN


text: In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, as described above, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents. For additional information about these risks, see "Item 1A. Risk Factors—Risks Related to Technology and Cybersecurity" of this Form 10-K.

companyName: Wendy's Co

ticker: WEN


text: In addition, the Company's Risk Management Committee ("RMC") evaluates risks relating to cybersecurity, among other significant risks, and applicable mitigation plans to address such risks. The RMC is comprised of members of the executive leadership team. The RMC meets monthly and receives updates from the CIO or a member of our cybersecurity team. The RMC reviews security performance metrics, global security risks, security enhancements, and updates on our security posture.

companyName: CHESAPEAKE UTILITIES CORP

ticker: CPK


text: Prior to the Business Combination, we were a blank check company with no operations and therefore did not have any operations of our own that faced material cybersecurity threats. We plan to develop processes, including those intended to follow an internal Information Technology ("IT") Security Policy, which seek to assess, identify, and manage material risks from cybersecurity threats to the IT systems and information that we create, use, transmit, receive, and maintain. We also seek to integrate these processes and policies into our overall enterprise risk management system and processes. The processes for assessing, identifying, and managing material risks from cybersecurity threats, including threats associated with our use of third-party service providers, will include our efforts to identify the relevant assets that could be affected, determine possible threat sources and threat events, assess threats based on their potential likelihood and impact, and identify controls that are in place or necessary to manage and/or mitigate such risks. We plan to implement and conduct security assessments of all third-party service providers before engagement and maintain ongoing monitoring to ensure compliance with relevant cybersecurity standards.

companyName: NKGen Biotech, Inc.


text: Risk Identification and Management The Company has a cybersecurity Risk Management Policy in place that governs the life cycle in which cybersecurity risks, including: • Risk Identification: through various initiatives performed, including, annual assessments, penetration tests, Incident Response tabletop exercises, vulnerability scans, and cybersecurity reviews of critical third-party vendor engagements, etc. • Risk Evaluation & Treatment: Identified issues, vulnerabilities, and exposures are captured within the Company's Risk Register, which is updated periodically to reflect the most up to date treatment option selected by the Risk Owners. • Risk Reporting and Ongoing Management: Potentially material risks are shared as part of a monthly Cybersecurity Governance Forum, that's attended by leadership. Risk Mitigations are tracked to completion through various project updates.

companyName: Drilling Tools International Corp

ticker: DTI


text: Our Vice President of Information and Business Systems and our IRP stakeholders oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. Our Vice President of Information and Business Systems has an advanced degree in management information systems and has managed the Company's IT processes and policies inclusive of cybersecurity matters throughout his tenure at the Company, in addition to many years of prior experience in various technology roles at a large U.S. public company. He is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents by working with the IT department and external vendors to implement our security risk management, including through the use of both automated and manual tools and reporting, in accordance with the Company's incident response plan and Company cybersecurity policies.

companyName: ESS Tech, Inc.

ticker: GWH


text: We have implemented a set of comprehensive cybersecurity and data protection policies and procedures placing special interest in addressing cybersecurity threats and effectively managing associated risks. Our cybersecurity program is designed to identify, assess, and proactively manage material risk from cybersecurity threats, which are integrated into our overall risk management systems, as overseen by the Company's Board of Directors, primarily through its Audit Committee. Risks from cybersecurity threats are regularly evaluated as a part of our broader risk management activities and as a fundamental component of our internal control system. Our information technology, or IT, program is led by our Director of Information Technology, who strives to monitor and mitigate risks from cybersecurity threats and provides reporting to the Audit Committee.

companyName: American Outdoor Brands, Inc.

ticker: AOUT


text: The CIO and members of management meet with the Audit Committee on a regular basis to review and discuss risk exposure related to our IT systems and data privacy. The purpose of these management updates is to inform the Audit Committee of potential risks related to our IT systems and data privacy, as well as any relevant mitigation or remediation tactics being implemented. The management team and/or Audit Committee, in turn, regularly provide data protection and cybersecurity reports to the full Board of Directors.

companyName: Century Communities, Inc.

ticker: CCS


text: On May 14, 2019, Retrieval-Masters Credit Bureau, Inc. d/b/a/ American Medical Collections Agency (AMCA), an external collection agency, notified the Company about a security incident AMCA experienced that may have involved certain personal information about some of the Company's patients (the AMCA Incident). The Company is involved in pending and threatened litigation related to the AMCA Incident, as well as various government and regulatory inquiries and processes. For additional information about the AMCA Incident, see Note 15 Commitments and Contingencies to the Consolidated Financial Statements "Cybersecurity" and "Risk Factors - Risks Related to Technology and Cybersecurity".

companyName: LABCORP HOLDINGS INC.

ticker: LH


text: If a cybersecurity incident occurs, our incident response team ("IRT") is immediately notified, and Griffon management is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Company. The IRT also coordinates further notifications, as applicable, to senior executives and organizational leadership, our Audit Committee and Board of Directors, business partners or service providers, and authorities.

companyName: GRIFFON CORP

ticker: GFF


text: Our cybersecurity risk management and strategy processes discussed above, are led by our Chief Information Security Officer and Chief Technology Officer, both of whom are Certified Information Systems Security Professionals. Specifically, our Chief Information Security Officer has approximately 10 years of experience developing cybersecurity strategy, incident response, and implementing cybersecurity programs for public media companies and is a certified boardroom Qualified Technology Expert and our Chief Technology Officer has approximately 16 years of experience developing cybersecurity strategy, incident response, and implementing cybersecurity programs.

companyName: USA TODAY Co., Inc.

ticker: TDAY


text: The Bank Board is responsible for overseeing our information security and technology programs, including management's actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks. Our Chief Information Officer and our Information Security Officer provide reports to the Bank Board, at least annually, regarding the information security program and the technology program, key enterprise cybersecurity initiatives, and other matters relating to cybersecurity processes. The Bank Board reviews and approves our information security and technology policies annually.

companyName: PEOPLES BANCORP OF NORTH CAROLINA INC

ticker: PEBK


text: Orchestra faces risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows or reputation. Orchestra acknowledges that the risk of cyber incident is prevalent in the current threat landscape and that a future cyber incident may occur in the normal course of its business. However, prior cybersecurity incidents have not had a material adverse effect on Orchestra's business, financial condition, results of operations, or cash flows. The Company proactively seeks to detect and investigate unauthorized attempts and attacks against IT assets, data, and services, and to prevent their occurrence and recurrence where practicable through changes or updates to internal processes and tools and changes or updates to the Company's service delivery; however, potential vulnerabilities to known or unknown threats will remain. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, investors, and additional stakeholders, which could subject the Company to additional liability and reputational harm. In response to such risks, the Company has implemented initiatives such as implementation of the cybersecurity risk assessment process and development of an incident response plan. See "Our information technology systems, or those of any of our CROs, manufacturers, other contractors, consultants, collaborators or potential future collaborators, may fail or suffer security or data privacy breaches or other unauthorized or improper access to, use of, or destruction of our proprietary or confidential data, employee data, or personal data, which could result in additional costs, loss of revenue, significant liabilities, harm to our brand and material disruption of our operations" in Item 1A (Risk Factors) for more information on cybersecurity risks.

companyName: Orchestra BioMed Holdings, Inc.

ticker: OBIO


text: Our processes also include assessing cybersecurity threat risks associated with our use of third-party services providers in the normal course of business use. Third-party risks are included within our cybersecurity risk management processes discussed above. In addition, we assess cybersecurity considerations in the selection and oversight of our third-party services providers, including due diligence on the third parties that have access to our systems and facilities that house systems and data.

companyName: NOCOPI TECHNOLOGIES INC/MD/

ticker: NNUP


text: Board of Directors considers cybersecurity risk within the Board's risk oversight function. The Board of Directors has charged management with the responsibility for oversight of cybersecurity risks and incidents and any other risks and incidents relevant to the Company's computerized information system controls and security. The Board and its Audit Committee oversee management's implementation of our cybersecurity risk management program.

companyName: Beeline Holdings, Inc.

ticker: BLNE


text: Management, in coordination with our information technology department, is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. Management, along with our information technology department, is responsible for approving budgets, approving cybersecurity processes, and reviewing cybersecurity assessments and other cybersecurity-related matters.

companyName: indie Semiconductor, Inc.

ticker: INDI


text: Audit Committee of the Company's Board of Directors, with the input of management, oversees the Company's internal controls, including internal controls designed to assess, identify, and manage material risks from cybersecurity threats. The Chief Financial Officer will directly inform the Audit Committee about the prevention, detection, mitigation, and remediation of cybersecurity incidents, when applicable, so that the Audit Committee can monitor the same. Updates on cybersecurity matters, including material risks and threats, will be provided to the Company's Audit Committee, and the Audit Committee provides updates to the Company's Board of Directors at regular board meetings.

companyName: Next Bridge Hydrocarbons, Inc.


text: Risks And Impact From Cybersecurity Threats As of December 31, 2024, we are not aware of any risks from cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. However, evolving cybersecurity threats make it increasingly challenging to anticipate, detect, and defend against cybersecurity threats and incidents. For more information regarding our cybersecurity risks, see "We and our tenants face risks related to cyber attacks that could cause loss of confidential information and other business disruptions" in Item 1A. "Risk Factors" within this Annual Report on Form 10-K.

companyName: KITE REALTY GROUP TRUST

ticker: KRG


text: Our management team's experience includes a diverse background in telecom, technology, media and other industries, with decades of experience in various aspects of cybersecurity. Liberty's Head of Cybersecurity has more than 25 years of cybersecurity and IT experience and holds Certified Information Security Manager and Certified in Risk and Information System Control certifications. Formula 1's Head of Information Security and Director of IT together have more than 30 years of experience and the Head of Information Security has multiple certifications, including Certified Cyber Professional and Senior Security & Risk Advisor. Sirius XM Holdings' Chief Information Security Officer, Chief Product and Technology Officer and Chief Information Officer each have more than 20 years of professional experience in the information security area. All have worked at a variety of companies, including large publicly traded companies, implementing and managing IT and cybersecurity programs and teams, developing tools and processes to protect internal networks, business applications, customer facing applications and customer payment systems.

companyName: Liberty Media Corp

ticker: FWONA


text: We align our cybersecurity and IT compliance programs to take advantage of natural synergies and our IT controls environment. Our Senior Vice President, Chief Information Technology Officer, who has more than 25 years of experience in technology and information security risk management in our industry and across a number of organizations, is responsible for overseeing the risks related to cybersecurity. Our cybersecurity team holds several cybersecurity industry certifications such as ISC2 CISSP, ISACA CISM and EC-Council CEH.

companyName: Cooper-Standard Holdings Inc.

ticker: CPS


text: Under our global incident response process, cybersecurity incidents are assessed and classified by severity, and significant incidents are escalated as appropriate to senior executive leadership. In addition, we have a risk-based escalation process outside of our regular reporting process to promptly notify the Board of Directors in the event of any material cybersecurity incident impacting the Company.

companyName: Kyndryl Holdings, Inc.

ticker: KD


text: Assessing, identifying and managing data security, privacy and cybersecurity related risks are integrated into our overall enterprise risk management ("ERM") process, which considers all strategic, operational, compliance and financial risks across the organization. Our ERM process is conducted on an annual basis by our internal audit team through feedback from senior management, certain functional leaders and certain Board members. Risks are categorized as low, medium and high risks based on a quantitative and qualitative evaluation of how each risk could impact the Company's operations, current objectives and long-term strategies. Each high risk is assigned to a member of senior management as the risk owner and the Board or a Board Committee for oversight, with the risk owner developing a risk mitigation plan that is tracked to completion. Low and medium risks are subject to various levels of internal monitoring. The annual risk assessment is reviewed with the Audit and Risk Committee and the Board of Directors.

companyName: Grocery Outlet Holding Corp.

ticker: GO


text: The Managing Owner has not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected the Managing Owner or the Trust's business strategy, results of operation or financial condition. Nonetheless, there is no guarantee that a future cyber incident would not materially affect the Managing Owner or the Trust's business strategy, results of operations or financial condition. Despite the various efforts the Managing Owner has undertaken to mitigate cyber risks and their impact, systems, networks and/or devices potentially can be breached. Such cybersecurity breaches may cause: (i) disruptions and impacts to business operations, potentially resulting in financial losses to the Trust and Unitholders; (ii) interference with the Managing Owner's ability to calculate the value of an investment; (iii) impediments to trading; (iv) the inability of the Trust and its service providers to transact business; (v) violations of applicable privacy and other laws; (vi) regulatory fines, penalties, reputational damage, reimbursement or other compensation costs or additional compliance costs; and (vii) the inadvertent release of confidential information. Similar adverse consequences could result from cybersecurity breaches affecting counterparties with which the Trust engages in transactions; governmental and other regulatory authorities; exchange and other financial market operators, banks, brokers, dealers, insurance companies and other financial institutions; and other parties. In addition, substantial costs may be incurred by these entities in order to prevent any cybersecurity breaches in the future. The nature of malicious cyber-attacks is becoming increasingly sophisticated and the Trust cannot control the cyber systems and cybersecurity systems of counterparties or third party service providers. While, to date, we have not been subject to cyberattacks that, individually or in the aggregate, have been material to our operations or financial condition, the preventive actions we take to reduce the risks associated with cyberattacks may be insufficient to repel or mitigate the effects of a major cyberattack in the future.

companyName: GLOBAL MACRO TRUST


text: Cybersecurity is an important component of our enterprise risk management program. While the full Board of Directors has primary responsibility for risk oversight, the Board of Directors utilizes its committees, as appropriate, to monitor and address the risks that may be within the scope of a particular committee's expertise or charter. The Board of Directors receives updates at quarterly board meetings on committee activities from each committee Chair.

companyName: Orthofix Medical Inc.

ticker: OFIX


text: Our board of directors, in coordination with the audit committee of our board of directors, oversees our risk management program, including the management of cybersecurity threats. Our board of directors and our audit committee receive prompt and timely information regarding cybersecurity risks, as well as ongoing updates regarding any such risk, from senior management.

companyName: Zymeworks Inc.

ticker: ZYME


text: In the ordinary course of our business, we use, store, and transmit confidential, sensitive, proprietary, personal, and health-related information. The secure maintenance of this information and our information technology systems is important to our operations and business strategy. To this end, we have implemented processes designed to help assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein. These processes are managed and monitored by a third-party information technology vendor, which is overseen by our Senior Vice President of Business Operations, and include mechanisms, controls, technologies, systems, and other processes designed to help prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data and help maintain a stable information technology environment. For example, we conduct vulnerability and data penetration testing, regularly review third party audits of our cloud-based technology vendors and perform ongoing regular risk assessments. We also conduct periodic employee training on cyber and information security, among other topics. In addition, to our third-party information technology vendor, we also consult with outside advisors and experts, when appropriate, to assist with assessing, identifying, and managing cybersecurity risks, including to help anticipate future threats and trends, and their impact on the Company's risk environment.

companyName: ATOSSA THERAPEUTICS, INC.

ticker: ATOS


text: We employ a variety of security tools and components to monitor, identify and block cybersecurity threats. In the event of a cybersecurity incident, the Company has an incident response team (IRT) whose role is to respond quickly and effectively. The IRT utilizes an incident response plan for the implementation of the its incident response capabilities that provides (i) a definition of "reportable incidents/events", and (ii) "metrics" for evaluating the IRT's response capabilities and effectiveness. The checklist is periodically reviewed by the IT Department for lessons learned from both mock and actual incidents, and to assure compliance with most current industry best practices and latest regulatory developments. The incident response plan includes processes through which cybersecurity incidents are escalated to the Company's executive officers. To improve preparedness for a cybersecurity incident, we conduct tabletop exercises at least annually. These exercises are conducted by internal personnel.

companyName: Binah Capital Group, Inc.

ticker: BCG


text: Our cybersecurity risk management and strategy processes are led by our global head of Information Technology who reports directly to our Chief Financial Officer and focus on preventing, mitigating, detecting and remediating cybersecurity incidents, as well as threat risks and related matters. The global head of Information Technology is part of our operating team and is responsible for implementing our cybersecurity risk management and strategy processes and the operation of our incident response and business continuity plan. Management uses information provided by our global head of Information Technology, along with feedback from external experts, the Audit Committee, and our Board, as part of the cyber-specific and enterprise-wide risk management process described above.

companyName: ARTIVION, INC.

ticker: AORT


text: Processes for incorporating cybersecurity risks into the overall risk management process Our process for identifying, assessing, and managing risks related to cybersecurity is incorporated into our IT processes. The Risk Management team meets at least annually with cybersecurity leadership to discuss cybersecurity related risks identified and the potential likelihood and severity of each risk. Through this process, cybersecurity risks are presented to the executive leadership team, including the CEO and CFO, as well as reported to the Committee.

companyName: STRATA Skin Sciences, Inc.

ticker: SSKN


text: Board oversees management's implementation of our cybersecurity risk management program. Our executive management team is responsible for updating the Board, as necessary, regarding significant cybersecurity incidents. Board shall also receive period reports from management on our cybersecurity risks and cybersecurity risk management program.

companyName: Zoned Properties, Inc.

ticker: ZDPY


text: As part of our cybersecurity risk management strategy, we periodically engage with assessors, consultants, auditors, and other third-parties to evaluate and test our systems. We also engage an independent Qualified Security Assessor to review our Payment Card Industry, or PCI, compliance.

companyName: WILLIAMS SONOMA INC

ticker: WSM


text: As of December 31, 2023, we've implemented a set of comprehensive cybersecurity and data protection policies and procedures. Our employees and contractors receive regular cybersecurity awareness trainings, including specific topics related to social engineering and email frauds. We have capable employees and consultants with significant expertise and certifications in cybersecurity related to our industry. We invest in advanced technologies for continuous cybersecurity monitoring across our information technology environment which are designed to prevent, detect, and minimize cybersecurity attacks, as well as alert management of such attacks.

companyName: Tarsus Pharmaceuticals, Inc.

ticker: TARS


text: We have established an incident response team which is composed of individuals from our various IT and managerial functions and consults with members of internal departments, as needed to perform an impact analysis of security incidents which may have a material effect on the Company, The Audit Committee has responsibility for oversight of information and cybersecurity risks and assessment of cyber threats and defenses, and it oversees management to ensure that the processes designed, implemented, and maintained with respect to such risks are functioning as intended and adapted when necessary to respond to changes in our strategy, as well as emerging risks. Given the importance of information security and cybersecurity to our stakeholders, our Enterprise Risk Management Committee and our Audit Committee review quarterly reports from our CISO regarding the Company's cybersecurity strategies for mitigating known risks, newly identified risks, existing projects, and key performance insights and engage in discussions with management based on such reports and other recent developments.

companyName: Maiden Holdings, Ltd.

ticker: MHLA


text: The Company has processes to oversee and identify material risks from cybersecurity threats associated with its use of third-party service providers. Such processes include evaluating service providers to ensure coverage of key cybersecurity risks have appropriate mitigations. The Company also monitors for threats impacting key service providers and assesses identified threats for potential impacts to services, data, and systems.

companyName: Orion Properties Inc.

ticker: ONL


text: The IRP sets forth the strategy to prepare for cybersecurity threats and incidents and the processes and procedures to detect, analyze, contain, and recover after any actual or suspected cybersecurity incidents. The IRP also sets forth the internal reporting process for cybersecurity incidents. In the event of the detection of an actual or suspected cybersecurity incident, the IRP provides that our IT security staff score the incident based on established criteria and manage the incident pursuant to the standard operating procedures. Depending on the assessed criticality of the incident and the systems affected, the staff will report an incident to a security triage team, consisting of the security operations incident response lead and several members of the privacy and security committee. Working with our third-party security vendors as needed, the triage team investigates the incident, manages the response, and reports threats and incidents deemed significant to securities counsel. Securities counsel then works with the executive team to assess materiality for the Company. A member of the executive team would inform our board of directors as warranted.

companyName: Encompass Health Corp

ticker: EHC


text: We further monitor, test, assess, and update these processes, including working with government agencies and peers to implement practices to guard against an evolving threat environment and to ensure we remain compliant with relevant regulatory requirements.

companyName: NORFOLK SOUTHERN CORP

ticker: NSC


text: The CISO has been at Williams for over 25 years. During that time, he has held a variety of information technology positions at multiple levels in the organization ranging from network engineering to application development and project management, as well as several IT Manager and Director roles. He has had oversight of the cybersecurity and risk management programs since 2017. Active in government and private sector partnerships, he is currently serving as the Chair of Emergency Response Working Group under the Oil & Natural Gas Subsector Coordinating Council and recently acted as the Chair of the Interstate Natural Gas Association of America security committee. He holds degrees in Business Administration and MIS from the University of Oklahoma and is certified in Leadership from Harvard Business School's executive education. In 2018, he obtained his Chief Information Security Officer certification from Carnegie Mellon University.

companyName: WILLIAMS COMPANIES, INC.

ticker: WMB


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our Confidential Information and Critical Systems. Our cybersecurity risk management program is integrated into our overall enterprise risk management program and includes a cybersecurity incident response plan.

companyName: Peakstone Realty Trust

ticker: PKST


text: We maintain an incident response plan that includes processes to triage, assess severity for, escalate, contain, investigate and remediate material cybersecurity incidents, as well as to comply with potentially applicable legal obligations. As part of the above processes, we periodically engage with assessors, consultants, auditors, and other third-parties, including by periodically annually having a third-party/an independent Qualified Security Assessor review our cybersecurity program to help identify areas for improvement and/or compliance. Our risk management processes also address cybersecurity threat risks associated with our use of third party service providers.

companyName: Evolent Health, Inc.

ticker: EVH


text: To address cybersecurity risks facing our organization, we have adopted a "continuous risk assessment" process. We engage a third party to conduct a bi-annual National Institute of Technology-Cyber Security Framework assessment to determine the maturity of our program and related controls. The results of that assessment are shared with management, which drives prioritization and investment in resources to address those risks. Likewise, annual penetration tests occur to review the efficacy of our technical controls, results which are reviewed by management and resolved in a timely manner. Other factors that feed into our risk management practices are also operational events and incidents, which can lead to controls being reviewed and enhanced.

companyName: UNIVERSAL HEALTH SERVICES INC

ticker: UHS


text: We also maintain a written Cyber Security Policy that establishes a framework for how we respond to data breaches, cyber attacks, and other security incidents, and discusses our employees' obligations with respect thereto. We maintain additional policies, including regarding the establishment of physical and environmental security requirements for protection of our information assets and security measures taken to protect privileged accounts with access to critical resources, sensitive data, and system configurations. Further, we have adopted a Cyber Security Incident Response Plan that applies in the event of a cybersecurity threat or incident (the "IRP") to provide a standardized framework for responding to security incidents. The IRP sets out a coordinated approach to investigating, containing, documenting, and mitigating incidents.

companyName: Tri Pointe Homes, Inc.

ticker: TPH


text: The Board is responsible for the oversight of cybersecurity risk management, as well as the selection of a Chief Information Security Officer ("CISO"), the management official responsible for administering and executing the information security program. The Board's Technology Oversight Committee (the "TOC") assists the Board in its oversight of the information security program. The TOC reviews information security metrics, oversees significant instances of non-compliance with the information security policy and monitors remediation of those instances, and reviews the appointment of the CISO for recommendation to the Board.

companyName: EAGLE BANCORP INC

ticker: EGBN


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels, and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas. As part of this process, we have elected to engage third-party managed service providers to maintain our network and to manage the monitoring, detection, mitigation, and prevention of cybersecurity threats. These service providers are responsible for managing our hosted services, all of the computer and computer-related hardware and software we use, and for managing our backup processes. Our primary managed service provider supplies management with weekly updates and activity reports related to network alerts, connectivity issues, and help desk tickets.

companyName: Seritage Growth Properties

ticker: SRG


text: Our Board actively oversees our risk management activities both directly and through its committees and considers various risk topics throughout the year, including cybersecurity and information security risk management and controls. As part of its oversight function, the Audit Committee of the Board oversees the Company's risk assessment and risk management policies, including related to cybersecurity and the data protection program, and performs an annual review and assessment of the primary operational and regulatory risks facing the Company, their relative magnitude and management's plan for mitigating these risks. At least annually, our CIO reports to the Audit Committee with a comprehensive report addressing a broad range of topics, including significant cybersecurity incidents that have occurred since the last update, the status of projects and initiatives to update our cybersecurity policies and practices, and ongoing efforts to prevent, detect, and respond to internal and external critical threats.

companyName: MUELLER INDUSTRIES INC

ticker: MLI


text: The Board, in coordination with the Audit Committee, oversees the Company's ERM process, including the management of risks arising from cybersecurity threats. The Board and the Audit Committee each receive regular updates on cybersecurity program key metrics, outstanding vulnerabilities, and emerging cybersecurity risks.

companyName: FUELCELL ENERGY INC

ticker: FCEL


text: Third Party Security Experts We engage third party security experts for cyber security assessments, penetration tests and program enhancements, including vulnerability assessments, security framework maturity assessments and identification of areas for continued focus and improvement. In addition, our third-party experts work with us to conduct cybersecurity tabletop exercises and internal phishing awareness campaigns. We use the findings of these exercises to improve our practices, procedures, and technologies. We also engage third party security experts to support our cybersecurity threat and incident response management and maintain information security risk insurance coverage.

companyName: TEAM INC

ticker: TISI


text: Our CIO has over 28 years of experience leading our technology operations and a total of over 40 years of experience in information technology experience in the banking and fashion apparel industries. Our Global Director of Cybersecurity has over 20 years of experience in information technology, including a dedicated focus of more than 6 years in cybersecurity, risk management and compliance and he is a Certified Information Systems Security Professional ("CISSP") and a Certified Ethical Hacker ("CEH"). Additionally, our Global Director of Cybersecurity currently serves in the role of a governing body member for the New York Evanta CISO community.

companyName: G III APPAREL GROUP LTD /DE/

ticker: GIII


text: Information Security Risk Assessment Information security controls result from an effective risk assessment process. The Company identifies, measures, controls, and monitors threats to avoid risks that threaten the safety and soundness of the organization. In accordance with the Gramm-Leach-Bliley Act (GLBA) and FDIC regulation 12 CFR Part 364 Appendix B III B, the objectives of the information security risk assessment include:

companyName: FS Bancorp, Inc.

ticker: FSBW


text: We have not established specific processes for assessing, identifying, and managing material risks from cybersecurity threats or engaged third parties to assess such risks. However, if exposed to such a risk, we would assess any potential unauthorized attempts to access our information systems that may result in adverse effects on the confidentiality, integrity, or availability of those systems.

companyName: Texas Mineral Resources Corp.

ticker: TMRC


text: In addition, various management committees assess and manage Truist's cybersecurity risks. These committees promote visibility and awareness of cybersecurity risks and drive action and escalation as needed. The primary management committees involved in Truist's Information Security Program are the Enterprise Technology Risk Committee and the Technology Risk Oversight Committee, each of which is a sub-committee of the ERC. Truist's cybersecurity teams that implement the Information Security Program and the risk partners who oversee the program leverage these committees to report on and escalate current or emerging cybersecurity risks or other changes in the business environment which could affect Truist's risk profile or control environment.

companyName: TRUIST FINANCIAL CORP

ticker: TFC


text: Chegg and its Board of Directors (the "Board") recognize the critical importance of maintaining the trust and confidence of our students, business partners, and employees. We have established an Information Security and Governance Program ("ISP") utilizing the National Institute of Standards and Technology Cybersecurity Framework as an authoritative source of cybersecurity standards and framework for measurement. The ISP is comprised of the following components: (i) policies which describe the core requirements and design aspects of the program, (ii) standards that provide quantifiable and prescriptive requirements to meet the program's design, (iii) processes that provide operational requirements to meet the ISP's policies and standards consistently, and (iv) implementation playbooks which are created, maintained, and used by the respective team responsible for implementation.

companyName: CHEGG, INC

ticker: CHGG


text: The Cybersecurity Committee is responsible for the general oversight of our cybersecurity policies, plans, program and practices and risks related to cybersecurity and data security. The Cybersecurity Committee reviews the adequacy and effectiveness of our cybersecurity program and regularly receives reports from management on cybersecurity matters. It also reviews our management of risks and compliance with legal and regulatory requirements and industry standards related to our IT security systems and processes, including network security and data protection. The Cybersecurity Committee regularly reports on its activities to the Board to promote effective coordination and to ensure the entire Board remains apprised of the effectiveness of our cybersecurity risk management and our cybersecurity risk landscape, and also assesses how management is managing these risks.

companyName: QUEST DIAGNOSTICS INC

ticker: DGX


text: The Company's Board of Directors believes it understands the significance of risks associated with cybersecurity threats to its operational integrity and stakeholder confidence and believes it has established mechanisms to effectively manage such risks based on the current understanding of the threat environment. As part of the Company's entire Board of Directors operational risk management responsibilities, it has oversight of risks from cybersecurity threats. Notwithstanding that fact, the full Board of Directors has been designated the primary responsibility for oversight of the Company's cybersecurity risk management. As discussed below, members of management report the entire Board of Directors about cybersecurity threat risks, among other cybersecurity related matters, at least annually and management also reports to the Audit Committee with respect to cybersecurity risks with financial statement or financial statement reporting implications. The Audit Committee routinely interacts and reports out to the entire Board of Directors on these matters.

companyName: Limbach Holdings, Inc.

ticker: LMB


text: Our Audit Committee, comprised of independent directors from our Board, oversees the Board's responsibilities relating to CenterPoint Energy's cybersecurity and data privacy programs, including cybersecurity risk management and cybersecurity disclosures required by applicable securities laws or regulations, as appropriate. As part of its risk oversight responsibilities, the Audit Committee receives quarterly reports from our Executive Vice President and General Counsel, Senior Vice President and Chief Information Security Officer (CISO) or other representatives from our cybersecurity or data privacy groups and periodic reports from our third-party consultants. These reports include updates on certain cybersecurity or data privacy matters, including, among other items, CenterPoint Energy's progress in maturing its cybersecurity program, results of significant cybersecurity assessments and testing, the cybersecurity landscape and emerging threats, status of ongoing initiatives and strategies, incident reports and learnings from any cybersecurity events, compliance with regulatory requirements and industry standards, data privacy matters, and the cybersecurity budget.

companyName: CENTERPOINT ENERGY RESOURCES CORP


text: Material Risks & Integrated Overall Risk Management have strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. Our risk management team works closely with our IT department to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.

companyName: Clubhouse Media Group, Inc.


text: As part of the Company's information security program, we leverage both internal and external assessments and partnerships with industry leaders to help approach information security company-wide. Additionally, we maintain a comprehensive program that defines standards for the planning, sourcing, management, and oversight of third-party relationships and third-party access to our system, facilities, and/or confidential or proprietary data.

companyName: Bankwell Financial Group, Inc.

ticker: BWFG


text: The Company's cybersecurity risk management processes are a component of the Company's overall risk management program. The Company's Cybersecurity Committee (the "CSC") oversees the establishment and operations of cybersecurity risk management processes and strategies and directs activities to identify and detect cybersecurity threats, protect the Company's assets and to respond and recover from cybersecurity incidents. The CSC is responsible for coordination with the Company's internal audit, risk management and/or crisis management teams to review and respond to cybersecurity threats.

companyName: HYSTER-YALE, INC.

ticker: HY


text: We have built a cybersecurity leadership team designed to align with key services, with a separate lead overseeing each service offering, all reporting to the CISO. We also maintain relationships with law enforcement and industry groups to support our cybersecurity intelligence and risk management efforts.

companyName: Moderna, Inc.

ticker: MRNA


text: Our Audit Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity. Our Board of Directors also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from information security management, internal security staff, our internal audit group and external experts as part of our Board of Director's continuing education on topics that impact public companies.

companyName: EXPAND ENERGY Corp

ticker: EXE


text: The Company and each of its consolidated subsidiaries/affiliates are responsible for developing a cybersecurity program appropriate for their respective businesses. The design of these cybersecurity programs is informed by the ISO 27001 standards and the Center for Internet Security Critical Security Controls framework ("CISCSC"). This does not imply that these programs meet all specifications of ISO 27001 and CISCSC, but rather that we use them as a guide to help us identify, assess and manage cybersecurity risks relevant to our business. The cybersecurity programs developed by the Company and its consolidated subsidiaries/affiliates include, among other things, (i) advanced threat protection and detection systems; (ii) vulnerability scanning and testing of network defenses; (iii) user authentication, role-based access, and privileged access management; (iv) data encryption, loss prevention, backup and recovery mechanisms; (v) employee testing and training; (vi) technical and business team-focused incident response tabletop exercises; (vii) disaster recovery testing and (viii) security assessments of third-party service providers. White Mountains engages both its internal auditors and third-party information security experts to assist management in assessing the effectiveness of these cybersecurity programs.

companyName: WHITE MOUNTAINS INSURANCE GROUP LTD

ticker: WTM


text: In addition, regular ongoing cybersecurity threat risk assessments, which also cover third-party business applications, are performed throughout the year and reported to our officers and Board of Directors by our CCO no less than quarterly. Cybersecurity risks are assessed in general as part of the overall enterprise risk management for us, but also specifically between the ISP and our Adviser and Administrator in monitoring and determining not only the risks but also in assessing corresponding processes and procedures to mitigate those risks appropriately.

companyName: GLADSTONE CAPITAL CORP

ticker: GLAD


text: Managing Third Party Risk Oceaneering recognizes the risks associated with the use of vendors, service providers and other third parties that provide information system services to us, process information on our behalf, or have access to our information systems, and the Company has processes in place to oversee and manage these risks. We conduct thorough risk-weighted security assessments of various third-parties and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. This monitoring includes both annual assessments and assessments on an ongoing basis.

companyName: OCEANEERING INTERNATIONAL INC

ticker: OII


text: We also maintain a comprehensive Security Response Policy designed to inform proper escalation of non-routine cybersecurity events and to coordinate our actions across departments. The policy sets forth, among other things, the following actions in the event of a suspected security breach: incident verification by our cybersecurity team, notification of our ERM committee, notification of an incident response and disclosure team composed of members of our operations, legal, finance and compliance teams, mitigation and remediation actions, and steps to restore business continuity. Our Chief Technology Officer ("CTO") serves as security coordinator and leads our cybersecurity and information technology team. As of March 31, 2024, no known cybersecurity threats have materially affected, or are reasonably likely to materially affect our Company, including our business strategy, cash flows, financial condition or results of operations.

companyName: Hamilton Lane INC

ticker: HLNE


text: We have not experienced any material cybersecurity incidents that have impacted PNC's business strategy, results of operations or financial condition to date. Notwithstanding our approach regarding cybersecurity, we may not be successful in preventing or mitigating the impact of a cybersecurity incident that could have a material impact on our business, results of operations or financial condition. See Item 1A Risk Factors of this Report for a discussion of cybersecurity risks.

companyName: PNC FINANCIAL SERVICES GROUP, INC.

ticker: PNC


text: The Company also manages cybersecurity threats through its proactive risk management program and cybersecurity awareness program, which have been integrated with the Company's overall risk management process. That is, material risks from cybersecurity threats, including those associated with the Company's use of third-party service providers, are assessed during the Company's annual review of its enterprise risks, during which leaders discuss the Company's overall risk profile, inventory material risks, and map management activities and corporate initiatives to each risk. The Company's cybersecurity awareness program includes policies regarding information security and data protection and cybersecurity training. Policies and training are periodically reviewed by a cross-functional committee of management. Training is provided to employees and contractors annually.

companyName: BURLINGTON NORTHERN SANTA FE, LLC


text: Role of Management The Group Chief Information Security Officer ("Global CISO") is responsible for the Group's cyber strategy and policies and supporting risk, assurance and reporting processes. Our Global CISO has over 20 years of extensive experience in cyber security domains and in senior leadership roles in the financial, media and government sectors. In addition, there are divisional directors of information security who are supported by over 250 cybersecurity specialists employed across Flutter to support the implementation of our cyber strategy.

companyName: Flutter Entertainment plc

ticker: FLUT


text: Cybersecurity is an important part of our risk management at iRhythm. Our cybersecurity program includes mitigating risks for our company and for other companies that may have access to our data and systems. Our board of directors recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners, and employees. The risk oversight responsibility of our board of directors and its committees is supported by our cybersecurity management reporting processes, which are designed to provide visibility to our board of directors and to our personnel that are responsible for risk assessment and information about the identification, assessment, and management of critical risks and management's risk mitigation strategies. These areas of focus include risks from cybersecurity threats as well as competitive, economic, operational, financial, legal, regulatory, privacy, compliance, and reputational risks, among others. We understand that our customers, patients, and stakeholders entrust us with sensitive data, including Protected Health Information, and we take this responsibility seriously.

companyName: iRhythm Holdings, Inc.

ticker: IRTC


text: Our entire Board is actively involved in overseeing risk management and the Audit Committee Charter tasks the Audit Committee with providing oversight of management's guidelines and policies to govern the process by which risk assessments and risks are managed, including the Company's major financial risk exposures and the steps management has taken to monitor and control such exposures. The Audit Committee also discusses with management the processes undertaken to evaluate our systems of disclosure controls and procedures, including those relating to cybersecurity risk management. Our CIO reports quarterly to the Audit Committee and Board regarding cybersecurity matters, which includes emerging cybersecurity threats and the risk landscape as well as updates on our cybersecurity program and related readiness, resiliency, and response efforts.

companyName: CAMDEN PROPERTY TRUST

ticker: CPT


text: The Company's Chief Information Officer has been serving in this role for the Company since 2013 and has over 30 years of experience in various information security and related technology roles. The Chief Information Officer oversees the information technology and information security functions of the Company which includes our cyber risk management team.

companyName: BrightView Holdings, Inc.

ticker: BV


text: During the fiscal year ended March 31, 2025, we have not identified any risks from cybersecurity threats that have materially affected our business operations or financial conditions.

companyName: Jerash Holdings (US), Inc.

ticker: JRSH


text: The Board of Directors takes an active role, as a whole, in overseeing management regarding our Company's risks, including cybersecurity risks. Our management, including our Chief Executive Officer and our Chief Financial Officer, keeps the Board of Directors apprised of significant risks facing our Company and the approach being taken to understand, manage, and mitigate such risks, including with respect to potential cybersecurity threats.

companyName: Sonoma Pharmaceuticals, Inc.

ticker: SNOA


text: Our information technology team have decades of operational experience both in private as well as classified government settings, advanced degrees in the information technology field from accredited universities, certifications within their areas of expertise (e.g., Certified Information Systems Security Professional (CISSP), Operating Systems Certifications, Network Engineering certifications, etc.).

companyName: Rumble Inc.

ticker: RUM


text: Honda's Risk Management Committee, chaired by the Risk Management Officer, has been established to deliberate on important matters related to risk management, including risk from cybersecurity threats. Honda has established the Honda Global Risk Management Policy, which stipulates Honda's basic policy for risk management, the collection of risk information, and the response system in the event of risk occurrence.

companyName: AMERICAN HONDA FINANCE CORP


text: Primary responsibility for managing cyber risk is vested in the Company's Information Security Officer. The ISO reports to the CRO and serves as the primary custodian of the Company's Information Security Program, which quantifies and documents our ability to identify and control risks to information systems and customer information.

companyName: TFS Financial CORP

ticker: TFSL


text: The Company's Board recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Board is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to risk management. Our Adviser maintains cybersecurity policies, standards, processes and practices that are based on recognized security frameworks such as the National Institute of Standards and Technology cybersecurity framework (the "NIST CF") and the Azure Security Benchmark. In general, our Adviser seeks to address cybersecurity risks of the Company through a comprehensive, cross-functional approach that is focused on continually assessing the Company's information systems to detect, prevent and mitigate cybersecurity threats and effectively respond to cybersecurity incidents when they occur.

companyName: NEXPOINT DIVERSIFIED REAL ESTATE TRUST

ticker: NXDT


text: We established a thorough, risk-based cybersecurity program aimed at safeguarding our data, along with the data of our customers and partners. The identification, assessment, and management of cyber risks fall under our Enterprise Risk Management ("ERM") program, overseen by the board of directors of our general partner. Our Chief Technology Officer & Digital Officer/Chief Information Officer holds overall responsibility for IT, OT, and cybersecurity. The Partnership follows well-organized cybersecurity frameworks with a Chief Information Security Officer dedicated to overseeing cybersecurity initiatives throughout the entire enterprise.

companyName: Delek Logistics Partners, LP

ticker: DKL


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with our Chief Information Officer who reports to our Chief Commercial Officer, to manage the risk assessment and mitigation process.

companyName: BullFrog AI Holdings, Inc.

ticker: BFRG


text: The Company has not experienced a material cybersecurity incident during the year ended December 31, 2024. For more information on how material cybersecurity incidents may impact our business, see Part I, Item 1A. "Risk Factors—Risks Relating to Our Business—Other Business Risks—A cyberattack or threat could harm our business" of this Form 10-K.

companyName: DT Midstream, Inc.

ticker: DTM


text: Other processes in place to further manage any additional security risk to the organization include: • identifying, reporting, and correcting information system flaws, security alerts, and advisories; • monitoring inbound and outbound communications for unusual or unauthorized activity; • designing and implementing application systems to include sound backup and recoverability principles, such as periodic data backups in the case of a disaster; • mechanisms designed for the physical protection of IT resources; and • use of all third-party and cloud computing services are reviewed and evaluated for material risks of cybersecurity threats by the IT security department before being formally authorized for use. Use of services must comply with all laws and regulations governing the handling of personally identifiable information, corporate financial data, controlled unclassified information, or any other data owned or collected by the company.

companyName: TTM TECHNOLOGIES INC

ticker: TTMI


text: Our IT security leader helps our management team stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which include briefings from internal personnel and our SOC, threat intelligence and other information obtained from governmental, public or private sources, including external cybersecurity service providers, and alerts and reports produced by security tools deployed in the IT environment.

companyName: Enovis CORP

ticker: ENOV


text: Management prepares comprehensive cyber security reports that are discussed at each meeting of the Finance Committee. The reports focus on the changing threat landscape and the risks to the Company, describe Eversource's cyber security drills and exercises, attempted and actual breaches on our systems, cyber incidents within the utility industry and around the world, and mitigation strategies. In addition, third-party experts of cyber security risks provide periodic assessments to the utility industry and the Company in particular to the Finance Committee. The Company regularly reviews and updates its cyber and system security programs, and the Finance Committee continues to enhance its robust oversight activities, including meetings with financial, information technology, legal and accounting management, other members of the Board, representatives of the Company's independent registered public accounting firm, and outside advisors and experts in cyber security risks, at which cyber and system security programs and issues that might affect the Company's financial statements and operational systems are discussed.

companyName: NSTAR ELECTRIC CO

ticker: NSARO


text: The Audit Committee of the Board of Director's has the responsibility of overseeing the Company's cybersecurity risks. The Chief Financial Officer provides periodic updates to the Board of Director's regarding actions taken to mitigate the Company's exposure and protection to cybersecurity risks. Management routinely evaluates the Company's security processes, procedures, and systems to determine if enhancements are needed to reduce the possibility of a future cybersecurity event. This includes safeguards implemented by the Company, such as a multi-factor authentication process for remote access to systems; restricted firewall settings; network monitoring, email phishing tests, and enhancing the Company's backup recovery strategy, among others. The IT Director is responsible for assessing, monitoring, and managing the Company's cybersecurity risks.

companyName: AURA SYSTEMS INC

ticker: AUSI


text: We use third-party service providers to perform a variety of functions throughout our business, such as using application providers for core applications (including finance, HR, CRM, email services, collaboration tools etc.), hosting companies for our websites, contract manufacturing organizations, distributors and supply chain resources for software, hardware, manufacturing and distribution of our products. We have a vendor management process designed to manage cybersecurity risks associated with our use of these providers. This process includes risk assessments, security questionnaires, review of vendor security programs, review of available security assessments, reports, and audits. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the type of provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.

companyName: NETGEAR, INC.

ticker: NTGR


text: The Company employs strategic partnerships with third-party entities to leverage resources and technologies for operational support, optimization, and heightened security. Collaboration with third parties forms a critical part of the Company's risk management strategy, facilitating effective management and mitigation of risks through partnerships, and ensuring adherence to applicable regulatory and industry standards. The Company incorporates supplier qualification processes and conducts thorough security and privacy risk assessments for third parties and lifecycle management.

companyName: Penumbra Inc

ticker: PEN


text: an information technology team principally responsible for managing ( 1) our cybersecurity risk assessment processes, ( 2) our security controls, and ( 3) our response to cybersecurity incidents;

companyName: LIQUIDMETAL TECHNOLOGIES INC

ticker: LQMT


text: Our CSO and cybersecurity team actively monitor our systems, regularly review our policies, compliance, regulations and best practices, perform penetration testing, conduct incident response exercises and internal ethical phishing campaigns and provide periodic training and communication across our organization to strengthen security focused behavior and foster a culture of digital safety. Our cybersecurity team also routinely participates in industry-wide programs to further information sharing, intelligence gathering and unity of effort in responding to potential or actual attacks. We also periodically review our business continuity plan to develop an effective recovery strategy that seeks to decrease incident response times, limit financial impacts and maintain customer confidence during any business interruption. Our cybersecurity team also administers a third-party risk governance program that identifies potential risks introduced through third-party relationships, such as vendors, software and hardware manufacturers or professional service providers. We seek to obtain certain contractual security guarantees and assurances with these third-party relationships to help ensure the security and safety of our information. The cybersecurity team works closely with a broad range of departments, including legal, regulatory, corporate communications, audit services, information technology and operational technology functions critical to our operations, as well as engaging external vendors to help ensure our cybersecurity program operates effectively.

companyName: Liberty Global Ltd.

ticker: LBTYA


text: Impact of Cybersecurity Risks As of the filing of this Form 10-K, we are not aware of any cyber-attacks that have occurred since the beginning of the fiscal year ended June 30, 2024 that have materially affected, or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. We acknowledge that we cannot eliminate all security risks within our organization, and we cannot guarantee that any undetected cybersecurity incidents have occurred. For additional information about these risks, see "Item 1A. Risk Factors" in this Annual Report on Form 10-K.

companyName: Great Elm Group, Inc.

ticker: GEG


text: Our Chief Risk, Privacy and Information Security Officer (" CISO ") leads the company's privacy, data protection and security program. An expert in cyber and data security trends, our CISO has over twenty years of experience in the data protection field, was a founding member of the Women Leading Privacy Advisory Board and former member of the Education Advisory Board for the International Association of Privacy Professionals (IAPP) and has been a finalist for the Women in IT Awards in the Security Leader of the Year category, included in the SIA Women in Security Power Forum 100, featured in Forbes, and named a Top Global CISO by Cyber Defense Magazine. including being featured in the "CSO Hall of Fame".

companyName: AvePoint, Inc.

ticker: AVPT


text: During the fiscal year ended July 31, 2025, the Company did not experience any material cybersecurity incidents that affected our operations, financial condition, or results.

companyName: Naploy Corp.


text: Our cybersecurity programs are under the direction of our Chief Executive Officer. Management regularly updates the Audit Committee on our cybersecurity programs, which includes cybersecurity risks and mitigation strategies, vulnerability management, and on-going cybersecurity projects.

companyName: Enlightify Inc.

ticker: ENFY


text: Any of these outcomes could have a material adverse effect on our business, operations, and financial condition. While we have experienced cybersecurity incidents in the past, risks from cybersecurity threats have not materially affected the Corporation to date.

companyName: MUNCY COLUMBIA FINANCIAL Corp

ticker: CCFN


text: Third Party Onboarding We depend on third parties and applications on virtualized (cloud) infrastructure to operate and support our information systems and have a third-party risk management program and assessment process for onboarding third parties.

companyName: Zoetis Inc.

ticker: ZTS


text: We employ a formal process to identify, track, prioritize and remediate cybersecurity incidents that may impact the confidentiality, integrity and availability of data stored and processed on our information systems. This process addresses event detection, triage and classification, investigation and escalation, containment and mitigation, recovery and corrective actions. We maintain a written incident response plan that establishes roles, responsibilities and procedures to guide incident response operations.

companyName: HUBSPOT INC

ticker: HUBS


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – We operate in markets that are dependent on Information Technology (IT) systems and technological change. Failure to maintain and support customer-facing services, systems, and platforms, including addressing quality issues and execution on time of new products and enhancements, could negatively impact our revenues and reputation" and "Risk Factors – The failure to prevent a cybersecurity incident affecting our systems could result in the disruption of our services and the disclosure or misappropriation of sensitive information, which could harm our reputation, decrease demand for our services and products, expose us to liability, penalties, and remedial costs, or otherwise adversely affect our financial performance".

companyName: Stride, Inc.

ticker: LRN


text: Matters determined to present potential material impacts to our financial results, operations, and/or reputation would immediately be reported by our Senior Vice President of Technology to our Chief Financial Officer and escalated, as appropriate, to our board of directors or individual members or committees thereof, in accordance with our escalation framework. Given the lack of material cybersecurity incidents relating to our company, we have not been required to escalate any matters to our board of directors, although management keeps the board of directors periodically informed of cybersecurity matters. In addition, we have established procedures to ensure that members of our management responsible for overseeing the effectiveness of disclosure controls are informed in a timely manner of known cybersecurity risks and incidents that may materially impact our operations and that timely public disclosure is made, as appropriate.

companyName: Vivos Therapeutics, Inc.

ticker: VVOS


text: The Director of Compliance and Internal Audit and third-party service providers utilize the direction and resources provided by the senior management team to develop procedures, standards and guidelines to achieve the strategic goals defined by the Board of Directors. Operational and security health is reported monthly to the Board of Directors. Recommendations for improvements are shared between operational staff and the senior management team as part of a continuous improvement program for information security and cybersecurity.

companyName: Magnolia Bancorp, Inc.

ticker: MGNO


text: Bel employs a full-time Cyber Security Expert who reports directly into our Senior Director of Global IT Services. During 2023, the Company worked with third-party cybersecurity companies to continually enhance the programs Bel has in place. These relationships involve regular communication and collaboration between the Bel cybersecurity team and our third-party providers to share threat intelligence and implement proactive measures to safeguard our systems and data. The Company has continued to invest in IT security, including additional end-user training, using layered defenses, identifying, and protecting critical assets, strengthening monitoring and alerting, and engaging experts. Our cybersecurity team regularly monitors alerts and meets to discuss threat levels, trends, and remediation. Further, we conduct periodic external penetration tests. In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with the use of third-party service providers that host our applications. The internal business owners of the hosted applications are required to document user access reviews at least annually and provide from the vendor a System and Organization Controls (SOC) 1 or SOC 2 report. Third party contractors or vendors that require access to our network are given specific limited access to only the specific resource. The access provided expires automatically after a period determined by the project and must follow all Company security measures.

companyName: BEL FUSE INC /NJ

ticker: BELFA


text: Our Chief Information Officer (CIO) is responsible for leading the Cybersecurity Program, which is coordinated and primarily executed by our Senior Manager of Information Security. Our CIO has more than 25+ years of information technology and cybersecurity experience, and has served in this role since 2021.

companyName: ROGERS CORP

ticker: ROG


text: At this time, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors - IT outages, data loss, data breaches and cyberattacks could disrupt operations and compromise our intellectual property or other sensitive information, be costly to remediate or cause significant damage to our business, reputation, financial condition and results of operations."

companyName: ADVANCED MICRO DEVICES INC

ticker: AMD


text: As of the date of this Report, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, the sophistication of cyber threats continues to increase, and the preventative actions we take to reduce the risk of cyber incidents and protect our systems and information may be insufficient. Accordingly, no matter how well our controls are designed or implemented, we will not be able to anticipate all security breaches, and we may not be able to implement effective preventive measures against such security breaches in a timely manner.

companyName: Shapeways Holdings, Inc.


text: At the employee level, we maintain an experienced information technology team who is tasked with implementing our privacy and cybersecurity program and support the CTO in carrying out reporting, security, and mitigation functions.

companyName: Getty Images Holdings, Inc.

ticker: GETY


text: The Norfolk Southern Board, both directly itself and indirectly through the F&RM Committee, has oversight of cybersecurity risks. The F&RM Committee receives periodic reports from the CIDO regarding the primary technology risks impacting the company, including risks impacting our information and operational systems, service resiliency, cybersecurity risks, and the related threat environment. Agendas for these periodic updates may be further adjusted to address any emerging risks or key topics in greater detail, including emerging regulations, best practices, cyber readiness, and third-party assessment results. Regular updates are also provided to the F&RM Committee regarding all material or potentially material cybersecurity incidents, including root causes, and identification of and progress towards, remediation activities through completion.

companyName: NORFOLK SOUTHERN CORP

ticker: NSC


text: Management ' s Role. Our ELT team is composed of several support teams that address and respond to cyber risk, including cyber risks related to security architecture and engineering, identity and access management and security operations. The ACT oversees compliance with our cybersecurity framework within the organization and facilitates cybersecurity risk management activities throughout the organization. The ACT also assists with the review and approval of policies, completes benchmarking against applicable standards, maintains a cyber risk registrar and oversees the security awareness program.

companyName: QXO, Inc.

ticker: QXO


text: Cybersecurity incident identification and response. We use a number of processes and procedures to protect our data, systems and employees from cyber incidents, to reduce our overall cybersecurity risk profile, and to identify and respond to cybersecurity incidents in a timely manner. These processes and procedures leverage a variety of tools, including a security incident and event manager interface that uses behavioral analytics and provides live metrics and reports of attempted breaches and logs of firewalls, authentication attempts, emails, anti-malware, attempted intrusions and applications. We also conduct periodic tests to assess our processes and procedures and the threat landscape, which include, among other things, the engagement of third-party experts for external and internal penetration testing and system security assessments.

companyName: VECTOR GROUP LTD