text: The Company's cybersecurity program is focused on the following key areas: • Governance: As discussed in more detail below, the Board's oversight of cybersecurity risk management is supported by its Audit Committee, which interacts with the Company's ERM function, the Company's Senior Vice President and Chief Information Officer ("CIO"), the Global Head of IT Security, who reports directly to the CIO, and other relevant members of management. • Collaborative Approach: We have implemented a cross-functional approach to identifying, mitigating, and managing cybersecurity risks, threats, and incidents through a broad range of controls and supporting processes. • Technical Safeguards: We deploy various technical safeguards that are designed to protect the Company's information systems and information from identified cybersecurity threats. • Incident Response and Recovery Planning: We have established, and maintain, an incident response plan that addresses the Company's planned responses to a potential or actual cybersecurity incident. This plan is periodically reviewed, tested, and evaluated. • Third-Party Risk Management: We take a risk-based approach to identifying the cybersecurity risks presented by third-party service providers and encourage our service providers to reduce cybersecurity risks using commercially available safeguards. • Education and Awareness: We provide training for our employees regarding cybersecurity threats as a means to build awareness and equip them with effective tools to identify and address cybersecurity threats, as well as to communicate the Company's evolving information security policies and practices.

companyName: GATX CORP

ticker: GATX


text: c. Conducting post-incident reviews to gather feedback on information security incident response procedures and address any identified gaps in security measures. d. Providing training and conducting periodic exercises to promote employee and stakeholder preparedness and awareness of the IRP.

companyName: UNIVEST FINANCIAL Corp

ticker: UVSP

secItem: Item 1C


text: The Company recognizes the importance of cybersecurity and the potential risks posed to our business operations, financial performance, and reputation. Cybersecurity is a significant and integrated component of the Company's risk management strategy. As a financial services company, cyber threats are present and growing, and the potential exists for a cybersecurity incident to occur, which could disrupt business operations or compromise sensitive data. To date, the Company has not, to its knowledge, experienced an incident materially affecting or reasonably likely to materially affect the Company. Cybersecurity risks and threats include, but are not limited to, unauthorized access, use, disclosure, modification, or destruction of our information systems, data, or network; denial of service attacks; malware; ransomware; phishing; social engineering; and cyberattacks by hackers, state-sponsored actors, or other malicious third parties and is compounded by the advent and availability of artificial intelligence ("AI") tools.

companyName: NB Bancorp, Inc.

ticker: NBBK


text: The Company's software development work is monitored by a dedicated Governance structure which is also responsible for cyber security of software operations. The Company is also processing compliance to standards applicable to specific industry requirements (SOC 2).

companyName: GlobalTech Corp

ticker: GLTK


text: Our cybersecurity risk management process is an integral part of our overall enterprise risk management framework. This process, overseen by our Information Technology ("IT") Director, aims to assess, identify, and manage material risks from cybersecurity threats. Our approach is designed to protect the confidentiality, integrity, and availability of our critical information systems and data, including intellectual property and confidential information.

companyName: GCT Semiconductor Holding, Inc.

ticker: GCTS


text: Managing Cybersecurity Risks; Cybersecurity Risk Management Strategy Our cybersecurity risk management program is integrated into the Company's enterprise risk management framework, and our strategy focuses on implementing effective and efficient processes, technologies, and controls to assess, identify, and manage cybersecurity risks. Our cybersecurity program is designed to be aligned with the National Institute of Standards and Technology ("NIST") framework, which organizes the management of cybersecurity risks into five categories: identify, protect, detect, respond, and recover.

companyName: Brighthouse Financial, Inc.

ticker: BHF


text: We utilize an independent external firm that provides services to detect cybersecurity risks and makes recommendations to us regarding ways the Company can better protect itself from threats and improve internal processes based on cyber threats and risks that are impacting other companies. Additionally, as part of its processes for assessing, identifying and managing risks from cybersecurity threats, we intend to periodically conduct maturity and other external cybersecurity assessments to evaluate its cybersecurity maturity and enhance its cybersecurity capabilities. Our internal auditors also perform annual inquiries and risk assessments into cybersecurity practices and potential incidents.

companyName: Orion Properties Inc.

ticker: ONL


text: As a publicly traded company, the Company recognized the critical importance of effective cybersecurity risk management to safeguard our operations, protect sensitive information and ensure the trust of the Company's customers and stakeholders.

companyName: America Great Health


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, and our critical data (such as information related to our product candidate development, collaboration activities and clinical trials), including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and sensitive personnel data and other personal data (collectively, "Information Systems and Data").

companyName: Bolt Biotherapeutics, Inc.

ticker: BOLT


text: b.protecting AT&T-owned and -managed assets and resources against unauthorized access by monitoring potential security threats, correlating network events and overseeing the execution of corrective actions;

companyName: AT&T INC.

ticker: T


text: Our product development processes apply development, security, and operations principles aligned with applicable government and commercial standards, and include vulnerability scanning and static and dynamic composition analysis. We regularly assess our product development processes, product cyber maturity, and the teams providing our secure services in relation to cybersecurity. In addition, we strive to meet all security requirements mandated by government and commercial customers and adhere to regulatory guidance and standards for system security engineering. Many of our products also undergo industry audits and regulatory compliance certifications, and our products delivered to the Department of Defense (DoD) must comply with DoD risk management requirements.

companyName: RTX Corp

ticker: RTX


text: The Bank's business continuity program is designed to ensure that necessary resources are in place to protect the Bank from potential loss during a disruption, which includes the unavailability of information technology assets due to unintentional events like weather-related events, fire, power loss, and other technical incidents such as hardware failures. The business continuity program is overseen by the Technology Committee of the Board and includes, among other items, business impact analysis for developing effective plans and a disaster recovery plan to respond, recover, resume, and restore technology assets critical for us to operate. Elements of this plan may be leveraged in support of the recovery from a cyber incident that disables critical infrastructure.

companyName: Federal Home Loan Bank of New York


text: Our internal audit function performs its own cybersecurity and privacy audits and reviews certain related practices as part of their assessment of our internal control over financial reporting. From time to time we have taken steps to improve our practices and remedy deficiencies that have been identified. Our enterprise-wide information security program is also independently assessed every other year by a third party as part of our enterprise risk management, and the Cybersecurity Subcommittee reviews the findings.

companyName: Booking Holdings Inc.

ticker: BKNG


text: For additional information regarding the risk we face from cybersecurity threats, see the risk factors entitled "The occurrence of fraudulent activity, breaches or failures of our information security controls or cybersecurity-related incidents could have a material adverse effect on our business, financial condition, results of operations, and reputation" and "We also face risks related to cyberattacks and other security breaches involving external, third-party vendors and counterparties" included in Part I, Item 1A. Risk Factors in this Annual Report on Form 10-K.

companyName: CHAIN BRIDGE BANCORP INC

ticker: CBNA


text: We also periodically perform various types of security audits and assessments, including penetration tests, via internal and external parties. In addition, certain Datadog products are subject to specific compliance requirements and standards, including, as applicable, ISO 27001, SOC 2, PCI, and FedRAMP (Low and Moderate), and are tested and evaluated by third-party auditors against those applicable compliance requirements and standards. The identified risks from such audits and assessments are triaged, prioritized, reported by our security teams to various levels of our senior management and tracked and remediated depending on the severity.

companyName: Datadog, Inc.

ticker: DDOG


text: Our Cybersecurity Incident Response Plan ("IRP") coordinates the activities we take to prepare for, detect, respond to, and recover from cybersecurity incidents, which include processes to detect, analyze, validate, investigate, contain, and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. Our processes also address cybersecurity threat risks associated with third-party service providers that may have access to our data or systems. Third-party risks are included within our broader overall risk assessment process, as well as our cybersecurity-specific risk identification program, both of which are discussed above. In addition, cybersecurity considerations may affect the selection and oversight of our third-party service providers.

companyName: Local Bounti Corporation/DE

ticker: LOCL


text: Hilton has a dedicated Global Information Security team (collectively, the "GIS team") led by our Chief Information Security Officer ("CISO") that is responsible for identifying, assessing, monitoring, managing and communicating the Company's cybersecurity risks. The GIS team is organized into five functional areas: (i) cloud, network and infrastructure architecture security; (ii) application security; (iii) incident response; (iv) endpoint security and vulnerability management; and (v) governance, risk and compliance ("GRC"). Collectively, the GIS team has decades of dedicated cybersecurity experience with personnel certified in various disciplines, including data privacy, enterprise risk management, cloud security and ethical hacking.

companyName: Hilton Worldwide Holdings Inc.

ticker: HLT


text: AutoZone's Chief Information Security Officer ( CISO) reports directly to our Chief Information Officer and Senior Vice President of Information Technology. Our CISO has over 25 years' experience in IT, with over 20 years in dedicated Information Security leadership roles. He has experience across a broad range of industries and holds credentials including the Certified Information Systems Security Professional and the CERT Certificate in Cybersecurity Oversight from the National Association of Corporate Directors.

companyName: AUTOZONE INC

ticker: AZO


text: Our assessment and management of material risks from cybersecurity threats are integrated into our enterprise risk management processes. For example, (1) cybersecurity risk is addressed as a component of our enterprise risk management program and identified in our risk heat map with a specified mitigation plan; (2) our information security department works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business; (3) our cybersecurity risk committee evaluates material risks from cybersecurity threats against our overall business objectives and reports to the audit committee of the board of directors, which evaluates our overall enterprise risk.

companyName: MANNKIND CORP

ticker: MNKD


text: We employ an information security and training program for our employees, including mandatory computer-based training, regular internal communications, and ongoing end-user testing to measure the effectiveness of our information security program. As part of this commitment, we require our employees to complete a Cybersecurity Awareness eCourse and acknowledge our Information Security policies. In addition, we have an established schedule and process for regular phishing awareness campaigns that are designed to emulate real-world contemporary threats and provide immediate feedback (and, if necessary, additional training or remedial action) to employees.

companyName: Mission Produce, Inc.

ticker: AVO


text: We have implemented a risk management program to identify and track information risks, including cybersecurity threats, from many different sources, including third parties, technology projects, acquisitions, risk assessments, technical assessments, and internal/external audits, and assesses them based on severity. Our annual information technology general control testing, which is conducted in connection with our internal control over financial reporting review process, and periodic reviews of risks and controls related to cybersecurity threats that may impact financial reporting control objectives also serve to identify and track information risks. Additionally, we partner with independent third-party service providers to perform cybersecurity assessments, such as network and application penetration testing.

companyName: Performance Food Group Co

ticker: PFGC


text: Security events and data incidents are evaluated, ranked by severity, and prioritized for response and remediation. Incidents are evaluated to determine materiality as well as operational and business impact and reviewed for privacy impact.

companyName: Bluerock Homes Trust, Inc.

ticker: BHM


text: We measure our security performance against the International Organization for Standardization 27001 Framework and Enterprise Risk Management strategies. We implement policies and practices to mitigate risks to organization data and operational processes.

companyName: VALMONT INDUSTRIES INC

ticker: VMI


text: Role of Other Employees Members of the Company's technology and security team periodically discuss cybersecurity program updates and challenges, to watch for potential threats from both external and internal sources, to monitor compliance in existing or emerging business practices, and to respond to stakeholder inquiries. This is composed of individuals with over 10 years of software, infrastructure, and security experience. The Company is continuously monitoring trends and stays current with the various cybersecurity threats and related mitigation opportunities. The Company periodically engages a third-party service provider to perform an external vulnerability scan of the Company's network to identify known threats and to date no critical vulnerabilities have been identified during these assessments.

companyName: Skillz Inc.

ticker: SKLZ


text: As part of the above processes, we regularly engage with assessors, consultants, auditors, and other third parties, including by regularly having a third-party qualified security assessor review our cybersecurity program to help identify areas for continued focus, improvement and/or compliance.

companyName: POTLATCHDELTIC CORP

ticker: PCH


text: Our Board of Directors oversees cybersecurity risk as part of its overall risk management responsibilities, and management provides periodic updates on cybersecurity matters. The Company has adopted an incident response plan to ensure timely detection, containment, and remediation of potential threats. During the fiscal year ended March 31, 2025, the Company did not experience any material cybersecurity incidents.

companyName: DeltaSoft Corp


text: The IT Committee and Audit Committee are the principal board committees that oversee the Bank's assessment and management of cybersecurity risk, including oversight of the implementation and maintenance of appropriate controls in support of the Bank's Information Security and Cybersecurity Program. Both the IT and Audit Committees are comprised of professionals with risk management and information technology expertise to manage any material risk from a cybersecurity threat standpoint.

companyName: RBB Bancorp

ticker: RBB


text: The Company depends on and engages various third parties, including suppliers, vendors, and service providers, to operate its business. The Company relies on its Chief Compliance Officer ("CCO") and the expertise of risk management, legal, information technology, and compliance personnel of the Advisor when identifying and overseeing risks from cybersecurity threats associated with its use of such entities.

companyName: Kennedy Lewis Capital Co


text: As a company, we devote significant resources to cybersecurity and risk management processes in order to adapt to the changing cybersecurity landscape and respond to emerging threats in a timely and effective manner. Our cybersecurity risk management program is led primarily by our Vice President - Cybersecurity & DevOps, who has over 15 years' experience in cybersecurity, information technology, and related compliance and holds a Certified Information Systems Security Professional certification. The information security team works cross-functionally, with significant involvement from other members of senior management and oversight by the Board.

companyName: FiscalNote Holdings, Inc.

ticker: NOTE


text: The Head of IT reports to the Chief Financial Officer (CFO), and attends regular meetings with the CFO to discuss updates relating to the Company’s cybersecurity program. The Head of IT also provides cybersecurity updates on a quarterly basis to the Company’s executive team.

companyName: Metagenomi Therapeutics, Inc.

ticker: MGX


text: All computers are protected using a cloud-powered endpoint security solution that helps enterprises prevent, detect, investigate, and respond to advanced threats on their networks. It offers endpoint protection, endpoint detection and response, mobile threat defense, and integrated vulnerability management. It also provides, among other things, malware and spyware detection and remediation, rootkit detection and remediation and network vulnerability detection. All Company computer hard drives are automatically encrypted.

companyName: Microbot Medical Inc.

ticker: MBOT


text: We (or third parties we rely on) may not be able to fully, continuously and effectively implement security controls as designed or intended. We use a risk-based approach and the judgment of our CRGC, management and third parties with extensive expertise in cyber risk management to determine which security controls we implement. It is possible we may not implement appropriate controls if we do not properly identify or inadvertently underestimate a particular risk. In addition, security controls, no matter how well designed or implemented, may only mitigate but not fully eliminate risks. Further, when security tools or third parties detect events, it may take us and our third parties time to analyze and understand the risks — and to determine the proper procedural steps to mitigate the effects of such risks — before we can effectively act upon the events. Impacts of Material Risk.

companyName: NuStar Energy L.P.


text: QNB maintains an Incident Response Plan that provides documented guidelines for handling potential threats and taking appropriate measures, including timely notification of cybersecurity threats and incidents to senior management and the Board of Directors when appropriate. The Incident Response Plan is managed by the Information Security Committee and is reviewed and tested at least annually.

companyName: QNB CORP.

ticker: QNBC


text: Our cybersecurity and IT risk management program is based on recognized frameworks established by the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, as well as the banking-specific framework from the Federal Financial Institution Examination Council's ("FFIEC's") Cybersecurity Assessment Tool. The Company's program is led by our Director of Information Technology and Information Security Officer, whose teams are responsible for leading short-term and long-term enterprise-wide cybersecurity strategy, policy, standards, monitoring, architecture and processes. Our Director of Information Technology and Information Security Officer has over fifteen years of experience in the field of cybersecurity and over a decade of experience leading cyber security oversight in the banking industry.

companyName: HAWTHORN BANCSHARES, INC.

ticker: HWBK


text: As part of our overall risk management approach, we prioritize the identification and management of cybersecurity risk at several levels, including Board oversight, executive commitment and employee training. Our Audit Committee, comprised of independent directors from our Board, oversees the responsibilities relating to the operational (including IT risks and data security) risk affairs of the Company. Our Audit Committee is informed of such risks through quarterly reports from our executive officers and it reports any material findings and recommendations to the full Board for consideration.

companyName: SOLITARIO RESOURCES CORP.

ticker: XPL


text: For a discussion of how risks from cybersecurity threats affect our business, and our reliance on Blackstone in managing these risks, see "Part 1. Item 1A. Risk Factors – Risks Related to Our Organizational Structure – Cybersecurity risks and data protection could result in the loss of data, interruptions in our business, damage to our reputation, and subject us to regulatory actions, increased costs and financial losses, each of which could have a material adverse effect on our business and results of operations" in this Annual Report on Form 10-K.

companyName: Blackstone Real Estate Income Trust, Inc.

ticker: BSTT


text: Conducting post-incident reviews to gather feedback on information security incident response procedures and address any identified gaps in security measures. Providing training and conducting periodic exercises to promote employee and stakeholder preparedness and awareness of the IRP.

companyName: NB Bancorp, Inc.

ticker: NBBK


text: Risk Management and Strategy BancShares maintains robust processes for assessing, identifying, and managing material risks from cybersecurity threats that are integrated with our overall risk management program. As part of its cybersecurity risk management framework, BancShares leverages a Three Lines of Defense model (the "Three Lines Model") to promote clarity of roles and responsibilities in managing risk. Under the Three Lines Model, the ECSO, led by our Chief Information Security Officer (the "CISO"), acts as a first line of defense and has primary responsibility for identifying, assessing, monitoring, and managing material risks from cybersecurity threats. Our CISO reports to our Chief Information and Operations Officer ("CIOO"), who reports directly to our Chief Executive Officer. Within ECSO, the Cyber Security Operation Center identifies, assesses, monitors, and manages potential cybersecurity events in coordination with the Enterprise Incident Management ("EIM") team, escalating analysis and response to incidents and events in accordance with established procedures and the Enterprise Severity Matrix. In addition, BancShares maintains a third-party risk management team tasked with identifying, evaluating, and managing risk posed by all third-party engagements, including from cybersecurity threats.

companyName: FIRST CITIZENS BANCSHARES INC /DE/

ticker: FCNCA


text: Our security technology tools and processes provide protection against security breaches and reduce cybersecurity risks. Our cybersecurity incident response plan includes procedures for identifying, containing, and responding to incidents. While we continue to invest in our program and capabilities, we cannot guarantee prevention of all incidents.

companyName: J M SMUCKER Co

ticker: SJM


text: Cybersecurity is a risk area with oversight at the highest levels of the organization, including the Executive and Board Level. The overall operational program is led by the Cybersecurity Strategy Council, a cross-functional team of executives and subject matter experts, including our Chief Product Security Officer, Chief Information Security Officer and Chief Compliance Officer. The Cybersecurity Strategy Council oversees a "Three Lines Model" of Operations, Risk Monitoring and Oversight, and Audit, to effectively address cybersecurity, risk management and control. All Cybersecurity, Risk and Internal Audit functions report to the PTC Executive Leadership Team.

companyName: PTC INC.

ticker: PTC


text: We have developed and implemented a cybersecurity program intended to manage risk, and protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity program includes a cybersecurity incident response plan as well as key technology and processes required to monitor, alert and escalate in the event of malicious activity.

companyName: ARDELYX, INC.

ticker: ARDX


text: Additionally, our security team conducts regular vulnerability scans of both our non-public assets and our production environments, using a number of internal and external tools, custom scripts, and monitoring agents to watch for open-source libraries and dependency vulnerabilities. In addition to regular scanning and periodic internal security audits conducted throughout the year, we conduct open, third-party security reviews, including year-round bug bounty penetration testing.

companyName: INSTRUCTURE HOLDINGS, INC.


text: effects of cybersecurity threats cybersecurity risks have the potential to affect the business, financial condition, and results of operations, we do not believe that risks from attacks, including results from any previous cybersecurity incidents or threats, have materially affected or likely to materially affect our strategy, operations or financial condition. However, no matter how well controls or designed or how well cybersecurity risk management procedures are implemented, there can be no full assurance given that risk remains of an incident that could cause material harm to the business. See " Our business relies heavily on owned and third-party technology and computer systems, which subjects us to various uncertainties " in the section entitled " Risk Factors ".

companyName: Aeries Technology, Inc.

ticker: AERT


text: Our executive team, along with our Audit Committee, considers cybersecurity risk as part of our overall business strategy, financial planning and capital allocation. Our Audit Committee and Board of Directors engage with members of the executive team and are briefed on cybersecurity risks at least once each calendar year and with respect to any potentially material cybersecurity incidents. Our Chief Information Officer reports regularly, and at least annually, to our Audit Committee and such report may address overall assessment of our compliance with our cybersecurity policies, and include topics such as risk assessment, risk management and control decisions, service provider arrangements, test results, security incidents and responses, and recommendations for changes and updates to policies and procedures. Our Chief Information Officer has served in various senior information technology roles, responsible for information security for over 20 years.

companyName: TransMedics Group, Inc.

ticker: TMDX


text: The Information Security Team is responsible for all of Noble's cyber security-related activities such as advising on governance requirements, setting cyber security policies, standards, and procedures, reporting, determining current risk appetite, setting security posture, evaluating security maturity, and ensuring compliance to cyber security frameworks. The team monitors both internal and external threats, potential compromising internet-based attacks, phishing activities, and aims to adapt with protective measures.

companyName: Noble Corp plc

ticker: NE


text: These cybersecurity partners, including consultants and other third-party service providers, are a key part of bioAffinity's cybersecurity risk management strategy and infrastructure and provide services including maintenance of an IT assets inventory, periodic vulnerability scanning, identity access management controls including restricted access to privileged accounts, network integrity safeguarded by web-based software, including endpoint protection, endpoint detection and response, and remote monitoring management on all devices, industry-standard encryption protocols, critical data backups, infrastructure maintenance, incident response, cybersecurity strategy, and cyber risk advisory, management team, in conjunction with third-party IT and cybersecurity service providers, is responsible for oversight and administration of the cyber risk management program and informing senior management and other relevant stakeholders regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents.

companyName: bioAffinity Technologies, Inc.

ticker: BIAF


text: Our cybersecurity risk assessment and management processes are implemented and maintained by various members of our management team, IT department and other employees, including but not limited to the individuals on our cybersecurity incident management team, which includes individuals who have a diverse combination of relevant expertise, experience, education and training, with representation from our IT, legal, human resources, compliance, risk and privacy functions, among others. Our team includes individuals with relevant experience in enterprise risk management and disclosure controls and procedures. Additionally, certain members of our IT department have experience managing cybersecurity programs and are specifically assigned cybersecurity oversight.

companyName: Travere Therapeutics, Inc.

ticker: TVTX


text: We have not identified any cybersecurity incidents or threats that have materially affected our information or system or are reasonably likely to materially affect our information and systems, including our business strategy, results of operations, or financial condition. However, like other companies in our industry, we and our third-party vendors have from time to time experienced threats and security incidents that could affect our information or systems. For more information, please refer to Item 1A, "Risk Factors," in this Form 10-K.

companyName: TELA Bio, Inc.

ticker: TELA


text: Given the importance of cybersecurity to our business, we maintain a cybersecurity program to support the effectiveness of our systems and our preparedness for information security risks. This program includes a number of administrative, physical, and technical safeguards. We have conducted and continue to conduct evaluations of our cybersecurity program through periodic external audits and penetration tests. We also require cybersecurity trainings when onboarding new employees, contractors and other workforce members, as well as annual cybersecurity awareness training for our employees, contractors and other workforce members. Our program is based on industry frameworks, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF") to strengthen our program effectiveness and reduce cybersecurity risks.

companyName: MADRIGAL PHARMACEUTICALS, INC.

ticker: MDGL


text: The Board administers its oversight role in part through its committees. The Audit Committee is responsible for overseeing and reviewing cyber and information security risks, policies and programs and reviews the Company's risk assessment, risk management and compliance policies twice a year. Senior leaders, including Matson's Chief Information Officer, review the Company's cybersecurity program with the Board of Directors at least annually, and the Chief Information Officer meets with the Audit Committee at least twice per year. Matson's information security efforts are led by its Chief Information Officer, who has over 25 years of experience in enterprise software development, infrastructure and management, including over 17 years with Matson and 7 years at Charles Schwab as Senior Manager of Middleware Security, and Senior Director, Information Security, who is a Certified Information Systems Security Professional, Certified Information Systems Auditor, and is AWS Certified. The Chief Information Officer and Senior Director provide regular briefings to the Chief Executive Officer, the Chief Financial Officer, the Board of Directors, and the Audit Committee. In addition, the Corporate Compliance Committee, comprised of business unit leaders, helps oversee cybersecurity initiatives and reports twice per year to the Audit Committee. These processes are part of the risk management processes described in the risk management and strategy section above.

companyName: Matson, Inc.

ticker: MATX


text: The Audit Committee of the Board of Directors provides governance and oversight of the cybersecurity program and approves the information security program annually. Regular updates are presented to the Audit Committee by the CISO on the current state of the cybersecurity program, providing transparency including progress on initiatives, operational and compliance metrics, risks, cybersecurity and data privacy incidents (if any), and appropriate remediation actions. The outcomes of these cross-functional risk discussions noted above, are submitted quarterly to the Audit Committee of the Board of Directors.

companyName: XEROX CORP


text: Board considers cybersecurity risks as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks.

companyName: Webstar Technology Group Inc.

ticker: WBSR


text: We engage external assessors and other third parties to independently evaluate our cybersecurity risk management process, including the relevance to PMI of identified cybersecurity scenarios and the results of cybersecurity maturity assessments. The outcome of such evaluations, audits or reviews are reported to the Corporate Risk Governance Committee and to the Audit & Risk Committee, and our cybersecurity policies, standards and processes are adjusted, as necessary.

companyName: Philip Morris International Inc.

ticker: PM


text: We established and maintain comprehensive incident response and recovery policies and procedures that fully address the Company's response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis. We build resilience into our business model and roadmap, and work to avoid cybersecurity incidents. If an issue does occur, we rapidly identify and resolve it through our formalized incident response program designed to help us quickly detect, respond to and recover from any incident.

companyName: Matterport, Inc./DE


text: Additionally, our CIO leads an incident response team ("IRT"), charged with the on-going management of our cybersecurity program. This team is responsible for the prevention, mitigation, detection and remediation of cybersecurity risks and incidents affecting our operations pursuant to our incident response procedures. The IRT is composed of information security professionals, who collectively bring decades of relevant information security and cybersecurity experience to their roles. In the event that a cybersecurity incident is detected, the IRT performs a multi-factor, risk-based assessment to determine the appropriate level of response. Depending upon the results of the assessment, including the nature and magnitude of the event, our incident response procedures provide for oversight and management of an incident by the IRT, under the direction of the CIO, or, in the event of escalation, under the direction of the executive officers of the Company, with reporting to and oversight by the Audit Committee.

companyName: STANDARD MOTOR PRODUCTS, INC.

ticker: SMP


text: We partner with third parties to implement and assess the effectiveness of our cybersecurity prevention and response systems and processes. We have a Managed Service Provider (MSP) and Managed Security Services Provider (MSSP) that provide 24 x 7 x 365 Network Operations Center and Security Operations Center (SOC) and works with our information technology (IT) team to employ a variety of monitoring technologies to detect and be alerted to potential cyber threats, as well as establish and implement procedures for the mitigation and remediation of any cybersecurity incidents. We conduct an annual penetration test, regular phishing tests, and annual cybersecurity training for our employees.

companyName: Empire State Realty Trust, Inc.

ticker: ESRT


text: Notwithstanding any of these measures, our systems, networks, products and services remain potentially vulnerable to known or unknown cybersecurity attacks and other threats, any of which could have a material adverse effect on our consolidated results of operations, financial condition and cash flows. We have experienced, and will continue to experience, cyber incidents in the normal course of our business. As of the date of this report, we have not identified any specific risks from cybersecurity threats, including those from any previous cybersecurity incidents, that have materially affected us, our business strategy, results of operation or financial condition. However, there can be no assurances that a cybersecurity threat or incident that could have a material impact on us will not occur in the future. For additional information on the risks we face from cyber security threats, please see the risk factor titled, "Our operations, businesses, products, and business strategy are subject to cybersecurity risks,"in Item 1A. "Risk Factors."

companyName: DOVER Corp

ticker: DOV


text: Our information security program is overseen by our Chief Technology Officer ("CTO"), in consultation with our Chief Privacy Officer as needed. We employ a layered defense-in-depth system, which includes the use of continually evolving technologies to assess and protect the security of our enterprise-wide applications and Systems, our intellectual property and proprietary and other information and the data and personal information of our customers, partners and employees; monitoring of our technology environment; performing regular security audits and vulnerability assessments; and regular cybersecurity and privacy training for our employees. We engage consultants and other third parties to conduct independent security assessments of our information security program and to provide us with information on new and developing threats and tactics. We have established processes to oversee and identify risks and cybersecurity threats associated with our third-party service providers. Pursuant to our information security and privacy policies and corresponding training, our employees and third-party vendors are instructed to notify our information security team as soon as they become aware of a suspected cybersecurity incident. We have a cybersecurity incident response plan to manage our response to potential and actual cybersecurity incidents. The plan includes procedures to assess the potential impact of an incident on the Company. When an incident meets certain criteria, members of the information security team notify members of senior management as soon as reasonably practicable, including our CTO, Acting General Counsel and, under certain circumstances, the Audit Committee. All incidents are reviewed periodically with senior management.

companyName: Paramount Global


text: Dow management responsible for developing and executing its cybersecurity policies is comprised of individuals with either formal education and degrees in information technology or cybersecurity, or with experience working in information technology and cybersecurity, including relevant industry experience in security related industries. Additionally, leaders in Dow's information technology function receive periodic training and education on cybersecurity related topics. Certain leaders also obtain industry certifications, such as Certified Information Systems Security Professional or Certified Information Security Manager.

companyName: UNION CARBIDE CORP /NEW/


text: b. Containing, eradicating and restoring normal operations if an event has occurred through quick responses, isolating and preserving evidence to aid in remediation and assisting investigators, isolating additional systems from being impacted by the situation being remediated, tracking issues, communicating a strategy and protocol to follow to maintain control of information and confidentiality and to ensure members of the IRT and Westwood management are kept informed of issues as the incident develops and is resolved, and developing and implementing strategies for ensuring the integrity of impacted information systems and critical information hosted on those systems.

companyName: WESTWOOD HOLDINGS GROUP INC

ticker: WHG


text: Depending on the environment or system, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: an information security policy, access management procedures, data back-up and restoration policy, cyberattack response procedure, network security controls, data segregation for certain data, encryption of certain data, access controls, physical controls, systems monitoring, penetration testing, employee training, and cybersecurity insurance.

companyName: Immunocore Holdings plc

ticker: IMCR


text: The Committee will develop and implement cybersecurity risk mitigation strategies and activities, including the management of comprehensive incident response plans, oversee the cybersecurity risks posed by third-party vendors, ensure policies and procedures are current and followed, and receive regular updates on cybersecurity-related matters. Further, the Committee will engage subject matter experts such as consultants and auditors to assist us in establishing processes to assess, identify, and manage potential and actual cybersecurity threats, to actively monitor our systems internally using widely accepted digital applications, processes, and controls, and to provide forensic assistance to facilitate system recovery in the case of an incident.

companyName: Ispire Technology Inc.

ticker: ISPR


text: No Previous Material Cybersecurity Threats As of the date of this report, we are not aware of any previous cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company. However, we acknowledge that cybersecurity threats are continually evolving, and the possibility of future cybersecurity incidents remains. Despite the security and risk management measures that we have implemented and any additional measures we may implement or adopt in the future, our facilities and systems, and those of our third-party service providers, have been and are vulnerable to security breaches, computer viruses, lost or misplaced data, programming errors, scams, burglary, human errors, acts of vandalism, misdirected wire transfers, or other malicious or criminal activities. A successful attack on our information or operational technology systems could have material consequences for the Company. While we intend to devote resources to our security measures to protect our systems and information during 2025, these measures cannot provide absolute security. See "Item 1A. Risk Factors" for additional information about the risks to our business associated with a breach or compromise to our information technology systems.

companyName: Sable Offshore Corp.

ticker: SOC


text: The Audit Committee meets quarterly and receives reports and briefings from the CIO, Director of Cybersecurity, and the cybersecurity team on emerging threats, risk status, and mitigation strategies. The Committee engages with the cybersecurity team to increase their understanding of the specific issues facing the Company and to challenge the team as appropriate. The Committee also may consult external cybersecurity experts as needed to fulfill its oversight role. The Audit Committee regularly reports to the Board on matters addressed during the Committee's quarterly meetings, including any material cybersecurity risks or developments. Processes for Monitoring and Mitigating Cybersecurity Risks and Incidents. Regular network and system monitoring for potential threats. Regular vulnerability assessments and penetration testing. Implementation of technical controls such as firewalls, intrusion detection systems, and encryption. Employee training and awareness programs. Incident response plans designed for swift and effective mitigation. Software and vendor risk assessments. Vulnerability management solutions prioritizing patching based on risk. Privileged account management solutions for administrative access.

companyName: UFP INDUSTRIES INC

ticker: UFPI


text: Our Board of Directors recognizes the critical importance of maintaining the trust and confidence of our providers, patients, customers, clients, business partners, and employees. Our Board of Directors is actively involved in oversight of the Company's risk management program through the Compliance Subcommittee of the Audit Committee of our Board of Directors (the "Compliance Subcommittee"), and cybersecurity represents an important component of our overall approach to enterprise risk management ("ERM"). Our cybersecurity policies, standards, processes, and practices are fully integrated into our ERM program and are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization, and other applicable industry standards. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: UpHealth, Inc.


text: Chief Operating Officer and Chief Financial Officer oversee our cybersecurity policies and processes, including those described above at "Risk Management and Strategy". The cybersecurity risk management program includes tools and activities to prevent, detect, and analyze current and emerging cybersecurity threats, and plans and strategies to address threats and incidents.

companyName: LIXTE BIOTECHNOLOGY HOLDINGS, INC.

ticker: LIXT


text: The Board of Directors oversight of risks from cybersecurity threats has been limited to authorizing the engagement of National Beef to provide the information technology equipment and services described above. Management's role in assessing and managing our risks from cybersecurity risks has similarly been limited to the engagement of National Beef to provide information technology equipment and services. If National Beef were to inform us of a cybersecurity incident, that incident would be reported to the Board of Directors if material in nature.

companyName: U. S. Premium Beef, LLC


text: Our Board of Directors has ultimate oversight of cybersecurity risk, which it manages as part of our enterprise risk management program. That program is utilized in making decisions with respect to company priorities, resource allocations, and oversight structures. The Board of Directors is assisted by the Audit Committee, which regularly reviews our cybersecurity program and our use of and risks related to artificial intelligence with management and reports to the Board of Directors. Cybersecurity reviews by the Audit Committee or the Board of Directors generally occur at least twice annually, or more frequently as determined to be necessary or advisable.

companyName: BK Technologies Corp

ticker: BKTI


text: The Board also receives briefings from Yubo Beijing's management on the cyber risk management program. Board members receive presentations on cybersecurity topics certain Yubo Beijing's management, internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: Yubo International Biotech Ltd

ticker: YBGJ


text: We face a number of cybersecurity risks in connection with our business. Although such risks have not materially affected us, including our business strategy, results of operations or financial condition, to date, we have, from time to time, experienced threats to and breaches of our data and systems, including malware and computer virus attacks. For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "Any material disruption of our information systems could disrupt our business and reduce our sales" and "A data security or privacy breach could damage our reputation, harm our customer relationships, expose us to litigation or government actions, and result in a material adverse effect to our business, financial condition and results of operations."

companyName: Fossil Group, Inc.

ticker: FOSL


text: Third-party security firms are used in different capacities to provide or operate some of these controls and technology systems, including cloud-based platforms and services, as well as a security operations center. For example, third parties are used to conduct assessments, such as vulnerability scans and penetration testing. The Company uses a variety of processes to address cybersecurity threats related to the use of third-party technology and services, including pre-acquisition diligence, imposition of contractual obligations, and performance monitoring.

companyName: Cinemark Holdings, Inc.

ticker: CNK


text: Management's Role Managing Risk Our CISO is responsible for the implementation, operation and monitoring of our cybersecurity risk management program. Our current CISO, who reports to our CIDO, has over 20 years of experience managing the IT and cybersecurity operations within large, global organizations. His extensive experience assessing and mitigating cybersecurity risk, implementing governance structures and developing employee training programs is critical in developing and executing our cybersecurity strategies.

companyName: ENTEGRIS INC

ticker: ENTG


text: The Company's cybersecurity policies, standards, processes, and practices are generally based on recognized frameworks established by the National Institute of Standards and Technology ("NIST"), the International Organization for Standardization ("ISO"), applicable industry standards, and applicable data privacy and cybersecurity regulations. Annual technology and cybersecurity risk assessments are conducted to identify and evaluate applicable risks and controls designed to address such risks. In general, the Company seeks to identify, assess and manage material cybersecurity risks through a company-wide approach addressing the confidentiality, integrity, and availability of the Company's information systems and the information that the Company collects and processes.

companyName: ALTISOURCE PORTFOLIO SOLUTIONS S.A.

ticker: ASPS


text: We have established an incident response plan and playbooks, which include procedures designed to respond to and recover from cybersecurity incidents. These procedures, which our IT Risk Management function reviews on an ongoing basis both internally and with third-party consultants, provide detailed descriptions of the roles and responsibilities of key stakeholders and the procedures for communication and coordination during an incident. The procedures also provide guidelines for escalating information to senior management, our Disclosure Controls Committee, our Audit Committee, which, as discussed below, has been delegated responsibility for our Board's cybersecurity risk oversight function, and our full Board and for providing timely public disclosure, when necessary.

companyName: ALTRIA GROUP, INC.

ticker: MO


text: In furtherance of detecting, identifying, classifying and mitigating cybersecurity and other data security threats, including such threats associated with our use of any third-party service providers, we also: • assess and analyze baseline configuration standards to ensure that they meet the intent and effectiveness required for the overall safety and security (both logically and physically) of critical system components; • ensure the asset inventory for relevant system components is kept current and accurate; • ensure that network connection arrangement documents are kept current and accurate; • limit access rights to system components to authorized personnel only, with all end-users being properly granted access in accordance with stated access rights policies and procedures; • deploy anti-virus solutions on all applicable system components, with the respective anti-virus solutions being the most current versions available from applicable vendors, enabled for automatic updates and configured for conducting periodic scans as necessary; • provision, hardens, secures and locks down critical system resources; • use internal and external vulnerability scanning procedures, along with network layer and anti-hacking tests; • facilitate requests for validation of baseline configurations for purposes of regulatory compliance assessments and audits; and • provide mandatory training and optional certification accreditation for purposes of maintaining an acceptable level of information security expertise necessary for configuration management.

companyName: Shimmick Corp

ticker: SHIM


text: Overview of Cybersecurity Risk Management The Company maintains a cybersecurity program that is designed to identify, prevent, detect, respond to, and recover from cybersecurity threats, and protect the confidentiality, integrity, and availability of our information technology, including the information residing on such systems. The Company has a dedicated Chief Information Security Officer (CISO) with overall responsibility for developing and implementing the global cyber strategy, risk management, and operational initiatives. The Company leverages recognized cybersecurity frameworks to organize, improve, and assess its cybersecurity program and to manage and reduce cybersecurity risk. The global information security team, under the direction of the CISO, develops, implements, and manages cybersecurity-related internal controls and risk processes for the Company, with internal controls consisting of a mix of administrative, technical, and physical controls.

companyName: SEALED AIR CORP/DE

ticker: SEE


text: As part of our risk management framework, we also periodically assign third-party cybersecurity training to our employees on our cybersecurity policies and safeguards.

companyName: Enliven Therapeutics, Inc.

ticker: ELVN


text: (3)Defense Procedures & Preparedness. We have established and maintain a data incident response and a business continuity management plan to timely, consistently, and appropriately address cyber threats that may occur despite our safeguards. The response plan is global in scope and covers the major phases of the incident response process, including preparation, detection and analysis, containment and investigation, notification (which may include timely notice to our Board if deemed material or appropriate), eradication and recovery, and incident closure and post-incident analysis. Our response plan is reviewed annually, regularly tested, and updated based on developments in the industry. Our business continuity management system includes targets and objectives, impact analyses and risk assessments, exercise and testing, training and awareness, documentation and standards for data centers and servers.

companyName: SBA COMMUNICATIONS CORP

ticker: SBAC


text: We assess and manage risk at the enterprise level according to our Framework using a three lines of defense model. For cybersecurity and technology risks, our first line of defense includes the following: • Chief Information Security Officer: The CISO establishes and manages the enterprise-wide cybersecurity program. • Chief Information Officer: The CIO oversees the establishment of appropriate governance, processes, and accountabilities within each business area to comply with our internal policies.

companyName: CAPITAL ONE FINANCIAL CORP

ticker: COF


text: To assess and manage risks from cybersecurity threats, we maintain a cybersecurity risk management program (the "Cybersecurity Program") that employs the Critical Security Controls framework developed by the Center for Internet Security as the foundation. Our Information Security team, composed of members of the Company's Corporate Information Technology ("IT") Department and Software Product Operations team, is tasked with monitoring and assessing, and the day-to-day management of, cybersecurity and operational risks related to information security and system disruption. The Cybersecurity Program includes, among other elements: • ongoing identification and assessment of cybersecurity threats based on periodic internal and external assessments and monitoring; • technical and organizational measures designed to protect against, detect, and respond to cybersecurity threats, including documented processes, procedures and technical controls aligned with our information security management system; • an incident management and response program that continuously monitors the Company's information systems for vulnerabilities, threats, and incidents; manages and takes action to contain incidents that occur; remediates vulnerabilities; and communicates the details of threats and incidents to management, as deemed necessary or appropriate; and • organization-wide cybersecurity training and compliance exercises, including formal educational material and compliance testing that is administered to all employees on an annual basis, as well as ad hoc testing and awareness exercises.

companyName: ITERIS, INC.


text: o Communication Strategy: Management, together with the board, are in the process of establishing a communication strategy for addressing cybersecurity disclosures with stakeholders, including customers, employees, and the public.

companyName: ONE STOP SYSTEMS, INC.

ticker: OSS


text: For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K, including the risk factors entitled, "Our internal computer systems, or those of any of our CROs, manufacturers, other contractors or consultants or potential future collaborators, may fail or suffer actual or suspected security or data privacy incidents or other unauthorized or improper access to, use of, or destruction of our proprietary or confidential data, employee data, or personal information, which could result in additional costs, loss of revenue, significant liabilities, harm to our brand and material disruption of our operations, and potentially significant delays in our clinical trials and delivery to market." and "We are subject to stringent and changing privacy, data protection and data security laws, regulations and standards as well as policies, contracts and other obligations related to data privacy, data protection and data security. Our actual or perceived failure to comply with such obligations could lead to enforcement or litigation (that could result in fines or penalties), a disruption or cancellation of clinical trials or commercialization of products, reputational harm, or other adverse business effects."


text: Board Oversight and Governance As discussed above, we have historically relied upon AIG to provide oversight of cybersecurity risk management and cybersecurity services that AIG provides to us pursuant to the Transition Services Agreement. In connection with our separation from AIG we are in the process of implementing certain processes, including training and reporting, to help facilitate oversight of information security risks by Corebridge's senior management and Board of Directors. These processes will enable our operations and risk management functions that monitor cybersecurity risks and examine control performance to report and escalate cybersecurity risks to senior management and the Board of Directors, as appropriate.

companyName: Corebridge Financial, Inc.

ticker: CRBG


text: Incident Response Planning We have established an Incident Response Policy for identifying, responding to, containing, eradicating, and recovering from security breaches and other cybersecurity incidents, as well as communicating with relevant stakeholders. Our Incident Response Policy sets forth incident response and communication responsibilities for our employees, management, and Board of Directors. We regularly test and evaluate the effectiveness of the policy as part of our cybersecurity assessments described above.

companyName: Premier, Inc.


text: Cybersecurity risks are overseen by the Audit Committee of our Board. Annually, the Audit Committee reviews an assessment of our risk management processes with the Board. The Audit Committee is responsible for reviewing significant cybersecurity risk exposures and the steps management has taken to monitor, control, and report such exposures. The Audit Committee receives quarterly updates from our CISO regarding our cybersecurity risk management program. These updates include a status of current capabilities, ongoing initiatives, and the evolving cybersecurity threat landscape.

companyName: PAYCHEX INC

ticker: PAYX


text: Our Board of Directors is responsible for overseeing the Company's business and affairs, including risks associated with cybersecurity threats. The Board oversees the Company's corporate risk governance processes primarily through its committees, and oversight of cybersecurity threats is delegated primarily to our Board Risk Committee. The Board also periodically designates directors as its cybersecurity contact points. Our Chief Operating Officer facilitates the involvement of these designated directors in oversight of potentially significant cybersecurity incidents. The current directors designated as cybersecurity contacts are Chairman Jerry Levens, Board Risk Committee Chair Frank Bertucci, and Suzette Kent.

companyName: HANCOCK WHITNEY CORP

ticker: HWC


text: We use third-party service providers to assist us to identify, assess, and manage material risks from cybersecurity threats, including threat intelligence service providers, cybersecurity software and managed cybersecurity providers, penetration testing firms, and forensic investigators.

companyName: PetIQ, Inc.


text: Cybersecurity Incident Response The Company has established a Cybersecurity Incident Response Testing Plan ("CSIRTP"), integrated into the Business Continuity Plan. This plan outlines a systematic approach to managing information security incidents, supplemented by specific playbooks for various attack types. The CSIRTP requires approval by the Information Technology Steering Committee and is governed by the Business Continuity Plan that is approved annually by the Board of Directors. We are not aware of any cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company's business strategy, results of operations or financial condition.

companyName: SUMMIT FINANCIAL GROUP, INC.


text: Cybersecurity Risk Oversight and Governance Our Board of Directors is responsible for the overall oversight of our enterprise risk management. The Audit Committee periodically reviews the Company's enterprise risk management framework, including enterprise risk management processes, and assists the Board of Directors in its oversight over certain key areas of risks, including overseeing cybersecurity, data governance and privacy risk and regularly reporting on such matters to the Board. The Audit Committee and full Board of Directors receive periodic updates from our CISO about Kyndryl's cybersecurity policies and practices, cybersecurity developments, trends, risks, notable incidents, mitigation strategies, maturity initiatives and other developments throughout the year, as well as periodic updates from our CIO, Security & Resiliency global practice leader and other senior leaders on cybersecurity-related matters.

companyName: Kyndryl Holdings, Inc.

ticker: KD


text: Our Chief Financial Officer is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Our Chief Financial Officer is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: NETSTREIT Corp.

ticker: NTST


text: Jeff Housman. Mr. Housman, age 43, was appointed Chief People & Services Officer of RBI in April 2021 and previously served as Chief Human Resources Officer beginning in February 2017 as well as Head of Global Business Services from January 2015 to January 2017. Mr. Housman joined Burger King in April 2013 serving in finance, real estate and business services roles. Prior to joining Burger King, Mr. Housman worked in investment banking at J.P. Morgan.

companyName: Restaurant Brands International Limited Partnership

ticker: RSTRF


text: We have implemented a cybersecurity risk management program based on the National Institute of Standards and Technology (NIST) Cybersecurity Framework to assess, identify and manage cybersecurity risk that may result in material adverse effects on the confidentiality, integrity and availability of our business and information systems.

companyName: Domtar CORP


text: To date, we have not experienced any cybersecurity incidents that materially affected or were reasonably likely to materially affect our business strategy, results of operations or financial condition.

companyName: US Foods Holding Corp.

ticker: USFD


text: HEI does not have an information technology (IT) or cybersecurity risk management (CRM) department, including the resources or expertise, to manage IT/CRM-related matters and processes. HEI relies on Hawaiian Electric to provide most of its IT/CRM-related services pursuant to a Service Level Agreement (SLA), amended, as of November 1, 2023 between HEI and Hawaiian Electric. HEI also employs third party cybersecurity consultants to assist in managing CRM-related matters. The SLA outlines specific services that Hawaiian Electric provides to HEI which includes support on all IT/CRM-related matters, IT service desk support, electronic file storage and backup, hardware and software installation, inventory and maintenance, standard networking and telecommunication support, and other various IT/CRM matters, including periodic reporting to HEI's board of directors and CWG. Refer to Hawaiian Electric's cybersecurity discussion for more information.

companyName: HAWAIIAN ELECTRIC INDUSTRIES INC

ticker: HE


text: faces risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows or reputation. Elite acknowledges that the risk of cyber incident is prevalent in the current threat landscape and that a future cyber incident may occur in the normal course of its business.

companyName: ELITE PHARMACEUTICALS INC /NV/

ticker: ELTP


text: As a technology vendor within the hosted services segment, Crexendo understands the importance of cybersecurity and data privacy. To proactively protect against related threats, and to be fully prepared for timely and effective response in case of an incident, a comprehensive program has been put in place leveraging the following:

companyName: Crexendo, Inc.

ticker: CXDO


text: Cybersecurity risk management is an essential part of our overall risk management strategy. We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: STANDARD PREMIUM FINANCE HOLDINGS, INC.

ticker: SPFX


text: Our incident response plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the Company's Chief Executive Officer, CIO, security management team, and our legal team (including privacy). These stakeholders work with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response plan includes reporting to the board of directors for certain cybersecurity incidents.

companyName: Veritone, Inc.

ticker: VERI


text: The Company has integrated its processes for assessing, identifying, and managing material risks from cybersecurity threats into its overall risk management framework, including through coordination with the Company's internal leader of Enterprise Risk Management, and through quarterly reporting to the Company's Audit Committee. Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition, except as disclosed in the risk factor titled "Our systems, and those of our third-party vendors, contain personal information and payment data of our retail store and eCommerce customers, and other third parties could be breached, which could subject us to adverse publicity, costly government enforcement actions or private litigation, and expenses" in Part I, Item 1A, "Risk Factors".

companyName: CARTERS INC

ticker: CRI


text: Key elements of our cybersecurity risk management program include: • periodic risk assessments designed to help identify material cybersecurity risks to our critical systems and information; • a formal register documenting and mitigating identified risks, reviewed by management on a quarterly basis; • a data protection team principally responsible for managing our cybersecurity risk assessment processes, our security controls, and our response to cybersecurity incidents; • the regular use of external service providers to independently assess and test security posture, as well as to otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, including incident response personnel and senior management; • a written cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents, including data storage and restoration and disaster recovery plans; and • a third-party risk management process for key service providers based on our assessment of their criticality to our operations and respective risk profile.

companyName: SIFCO INDUSTRIES INC

ticker: SIF


text: Our Board of Directors receives regular updates on relevant IT matters affecting the Company, including cybersecurity risks and mitigation strategies. In addition to the general oversight provided by the full Board of Directors, the Audit Committee is responsible for oversight of our risk assessment and management processes, including with respect to IT and cybersecurity risks. The Audit Committee receives a quarterly cybersecurity report and regular updates from our Vice President and Chief Information Officer and our Director of Cybersecurity Risk and Business Continuity, which includes, among other information, the steps management has taken, and the specific guidelines and policies that have been established, to monitor, control, mitigate and report exposure to IT and cybersecurity risk.

companyName: SM Energy Co

ticker: SM


text: Tenable recognizes the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data and our exposure management solutions. We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, our critical data (including without limitation intellectual property, confidential information that is proprietary, strategic or competitive, customer vulnerability data, and information systems data), and exposure management solutions.

companyName: Tenable Holdings, Inc.

ticker: TENB


text: Inc. acknowledges the crucial necessity of establishing, executing, and sustaining strong cybersecurity measures to secure our information systems. This is undertaken to uphold the confidentiality, integrity, and accessibility of our data.

companyName: DSwiss Inc

ticker: DQWS


text: third-party security expert consultant overseeing the risk assessment process, maintenance of security controls, and coordination of responses to cybersecurity incidents;

companyName: NexMetals Mining Corp.

ticker: NEXM


text: Although members of our senior management do not have direct cybersecurity expertise obtained through certifications, their experience managing the Company, which includes consulting and coordinating as necessary with in-house information-technology specialists, enables them to effectively assess and manage material risks from cybersecurity threats.

companyName: AmpliTech Group, Inc.

ticker: AMPG


text: Cybersecurity risk management is an integral part of our overall enterprise risk management program. The Company manages cybersecurity and data protection through a continuously evolving program. Our cybersecurity risk management program is designed to provide a framework for assessing, identifying and managing cybersecurity threats and incidents, including threats and incidents associated with the use of services provided by third-party service providers, and to facilitate coordination across different departments of our Company. Our processes include steps for assessing the severity of a cybersecurity threat, identifying the source of a cybersecurity threat, including whether the cybersecurity threat is associated with a third-party service provider, and implementing cybersecurity countermeasures and mitigation strategies and informing management and the board of directors of material cybersecurity threats and incidents.

companyName: iPower Inc.

ticker: IPW


text: Third-Party Risks Our Program is designed to reduce the likelihood of impacts on Customers' operations, reputation, or revenue due to issues, vulnerabilities, or compromises related to a third-party or fourth-party vendor, supplier, service provider, or partner of Customers ("Third-Party"). The Program accomplishes this goal through a combination of monitoring, information gathering, and analysis of Third-Party quality and security at the due diligence, contracting, ongoing monitoring and termination stages.

companyName: Customers Bancorp, Inc.

ticker: CUBI


text: Our board of directors is responsible for understanding the primary risks to our business. The audit committee of our board of directors is responsible for reviewing our and our Manger's IT security controls with management and evaluating the adequacy of our and our Manager's IT security program, compliance and controls with management.

companyName: BLACKSTONE MORTGAGE TRUST, INC.

ticker: BXMT


text: Employees are one of our most valuable resources, and it is essential that education, particularly related to social engineering, is persistent and relevant. The Company requires ongoing cybersecurity awareness training for all employees, including weekly simulated emails to test the knowledge and reaction of employees. The training is customized based on actual events or anticipated emerging threats, keeping the education applicable and purposeful.

companyName: Global Water Resources, Inc.

ticker: GWRS


text: Cybersecurity Risk Management Strategy Our cybersecurity risk management program is integrated into our overall enterprise risk management system. We have developed and implemented policies, procedures and practices designed to protect the information and systems that support our operations and assets. In developing our policies and procedures, we were informed by certain industry standards and guidelines. We routinely train our employees on cybersecurity awareness and our information security and data protection policies.

companyName: COMPASS Pathways plc

ticker: CMPS


text: To operate our business, we use certain third-party service providers to perform a variety of functions. We seek to engage reliable, reputable service providers that maintain cybersecurity programs and we generally rely on such providers to maintain appropriate cybersecurity practices.

companyName: BRT Apartments Corp.

ticker: BRT


text: The Company's President and Chief Executive Officer, Luca Fabbri, is the member of the Company's management that is principally responsible for overseeing the Company's cybersecurity risk management program and incident reporting, in partnership with other business leaders across the Company. In the event there is a material cybersecurity breach or incident, Mr. Fabbri works in coordination with the Company's General Counsel, Christine Garrison, to assess and respond, including by reporting this incident to the Board and/or applicable regulatory authorities, as necessary or required. Mr. Fabbri has a high level of exposure to cybersecurity oversight through his current and previous work in the technology sector. Mr. Fabbri has served in various roles in information technology and information security for over 30 years, including serving as a consultant with Elk Creek Ventures Inc. from 2003 to 2012, through which he provided consulting services in technology, and serving as co-founder and vice president of engineering of Co3 Systems Inc., an enterprise software company in the cybersecurity space that is now part of IBM, from 2010 to 2011. Mr. Fabbri also co-founded a software company called HomeSphere, for which he served as senior vice president and chief financial officer from 2000 to 2002, and currently serves on the board of directors of Basil Systems Inc., a healthcare software company. Mr. Fabbri, Ms. Garrison and the Company's Chief Financial Officer each hold degrees in their respective fields, and each have over 15 years of experience with managing risks at the Company and in environments similar to the Company's, including risks arising from cybersecurity threats.

companyName: Farmland Partners Inc.

ticker: FPI


text: We face a number of cybersecurity risks in connection with our business. Based on the information we have as of the date of this Annual Report, we do not believe that any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company's business strategy, results of operations or financial position. See Item 1A, Risk Factors, of this Annual Report for further discussion of cybersecurity risks.

companyName: ELUTIA INC.

ticker: ELUT


text: As part of our program to mitigate risk from cyber security threats, the Company actively evaluates and refines its cyber security tools and processes with the intention of reducing cyber security risks and aligning with the National Institute of Standards and Technology Cyber-security Framework for risk management. Features of our cybersecurity program include: Processes designed to comply with information security standards and privacy regulations, including the European Union's General Data Protection Regulation. Management Standard certification. Implementation of a variety of security controls, such as firewalls, and intrusion detection systems. Protection against Denial-of-Service attacks which prevent legitimate use of our services. Security events monitoring in our security operations center. Development of incident response policies and procedures designed to initiate remediation and compliance activities in a timely manner. Implementation of data loss prevention tools. Implementing an ID management system to enforce granular role-based access controls. Performing penetration testing on cloud and app platform. Administration of a comprehensive cyber security awareness program to educate employees about cyber security risks and best practices. Retention of a third-party, independent cyber security firm to conduct cyber security assessments of our systems and procedures.

companyName: SOLAREDGE TECHNOLOGIES, INC.

ticker: SEDG


text: While such technologies, controls, and procedures cannot entirely eliminate cybersecurity threats, we believe the risks from cybersecurity threats (including as a result of previous cybersecurity incidents) have been effectively managed and contained, and have not materially affected, and are not reasonably likely to materially affect, us and our business strategy, results of operations or financial condition.

companyName: Cyber App Solutions Corp.


text: The Technology Committee meets no less than quarterly, and its purpose is to (i) assist the Board with the oversight of technology strategy and significant technology initiatives and programs, including those that can position the use of technology to drive strategic advantages and (ii) fulfill oversight responsibilities with respect to technology risk, information management, and security risks (including cyber security, cyber fraud, and physical security risks), and the adequacy of PNC's business recovery, resiliency and contingency plans and test results.

companyName: PNC FINANCIAL SERVICES GROUP, INC.

ticker: PNC


text: In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Item 1A. Risk Factors – Risks Related to the Company - Cybersecurity risks and cyber incidents may adversely affect our business in the event we or any other party that provides us with essential services experiences cyber incidents" in this Annual Report on Form 10-K.

companyName: HG Holdings, Inc.

ticker: STLY


text: Our Chief Information Security Officer (CISO), working together with our Chief Information Officer (CIO), oversees a team of employees dedicated to cybersecurity. Our CISO receives ongoing updates from the cybersecurity team regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and regularly reports to the CIO. Our CISO is an active member of our management-level enterprise risk management committee, which has broad oversight of the company's enterprise risks, including cybersecurity risks. In addition, our CIO and CISO both attend regular meetings of the executive officer team, including our Chief Executive Officer, Chief Financial Officer, General Counsel and other senior executive officers, dedicated to compliance and risk, and report on cybersecurity matters as appropriate. Our Board of Directors has delegated primary responsibility for the oversight of cybersecurity matters to its Risk and Compliance Committee; however, the full board reviews significant cybersecurity matters as appropriate. Our CIO and CISO report on cybersecurity and information security at each quarterly meeting of the Risk and Compliance Committee.

companyName: Arthur J. Gallagher & Co.

ticker: AJG


text: The Audit and Risk Committee, responsible for the oversight of our overall enterprise risk management program, oversees our cybersecurity program. They ensure management identifies and evaluates cybersecurity risks, implements risk management processes designed to ensure that potential cybersecurity, data privacy and information technology risks are identified, monitored, assessed and remediated, puts in place appropriate mitigation and remediation measures, and maintains our cybersecurity programs. We have established a (i) Regulatory Cybersecurity Committee which reviews new and changing regulatory requirements and recommendations and assesses any impacts on our business and (ii) an Information Security Council which enables collaboration for ongoing security incidents and emerging threats, reviews our information technology security roadmap and evaluates the current state of the information security program. Our cybersecurity programs are managed under the direction of our Chief Information Security Officer ("CISO") in consultation with our General Counsel and Chief Information Officer. Certain members of our executive team have extensive experience in assessing risks associated with cybersecurity threats, and our CISO and the cybersecurity team are certified and experienced information systems security professionals and information security managers with many years of experience and focus on preventing, detecting, mitigating, and remedying cybersecurity risks. Updates on the Company's cybersecurity programs, material cybersecurity risks and mitigation strategies, and cybersecurity reports are provided to the Governance Committee on at least on a monthly basis and our Audit and Risk Committee receives updates on our information security programs at least annually. Such updates cover, among other topics, third party assessments of the Company's cybersecurity programs, updates to the Company's cybersecurity programs and mitigation strategies, and other cybersecurity developments.

companyName: AssetMark Financial Holdings, Inc.


text: Cybersecurity risk oversight and management is a critical component of the Company's overall enterprise risk management and top priority for the Company and its Board of Directors. The Company's Board of Directors have delegated management of Enterprise Risk Management, which includes cybersecurity, to the HEI/Hawaiian Electric Audit and Risk Committees and ASB Risk Committees (collectively, the ARCs). The ARCs exercise their oversight responsibility of cybersecurity through quarterly (or more frequently if necessary) cybersecurity risk updates and incidents, if any, by management (primarily the Utilities' Chief Information Security Officer and Chief Information Officer, and the ASB Director, Information Security). In early 2023, in recognition of the increased cybersecurity threats and heightened cybersecurity risks facing the Company, the ARCs formed the Cybersecurity Working Group (CWG) comprised of three directors, one from each of the Company's Board of Directors. The purpose of the CWG is to oversee and conduct periodic meetings with management to discuss cyber risk, risk treatment, and operational activities relative to cyber risk treatment and to report matters to the ARCs. The CWG also evaluates cybersecurity areas highlighted by the ARCs including areas the CWG deems higher risk or topical and reports back to the ARCs on a quarterly basis. The CWG also coordinates with the Company's management on semi-annual trainings and annual tabletop exercises for the Board of Directors.

companyName: HAWAIIAN ELECTRIC INDUSTRIES INC

ticker: HE


text: The ERM program and ERA process is described in the company's Enterprise Risk Management Policy which was released this year. The program includes enterprise level risks grouped in 12 risk categories. Cybersecurity is included as a standing risk category. The ERM program does not itself independently review cybersecurity policies and practices. In first quarter 2024, ERM, in collaboration with Emergent's Policy and Training Center of Excellence, provided training on Emergent's Enterprise Risk Management Policy to all employees who are at the vice president level and above. We are currently working on an all-employee awareness communication to further educate the full employee population about the ERM program, policy and intranet page. Timing for this communication is expected in first half of 2024. Annually, an ERM training will be provided to all participants in advance of the Company's annual ERA. Full retraining on the ERM policy will occur every three years. The Company leverages the Committee of Sponsoring Organizations'("COSO") guidelines as the foundation for our ERM program and leverage external expertise.

companyName: Emergent BioSolutions Inc.

ticker: EBS


text: UHS' cybersecurity risk management and strategy processes are overseen by leaders from their Information Security, Compliance, Legal and Internal Auditing teams. Such individuals have an average of over 20 years of prior work experience in various roles involving information technology, including security, auditing, compliance, systems and programming. These individuals monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan.

companyName: UNIVERSAL HEALTH REALTY INCOME TRUST

ticker: UHT


text: Cybersecurity is an important part of our overall risk management processes and an area of focus for our Board and management. Our Audit Committee of the Board oversees our cybersecurity risk and receives reports from our Chief Information Officer on a quarterly basis. This includes existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any), status on key information security initiatives, industry trends, and other areas of importance.

companyName: PROKIDNEY CORP.

ticker: PROK


text: We engage the SOC on a regular basis to conduct external audits and assessments of our cybersecurity posture and performance. The SOC provides independent and objective feedback and recommendations on how to improve our cybersecurity strategy, policies, processes, and controls. The SOC also assists the Company in identifying and prioritizing the most critical and emerging cybersecurity risks and threats, and to align our cybersecurity initiatives with the best practices and standards in the industry.

companyName: AGREE REALTY CORP

ticker: ADC


text: Conducting periodic reviews of user credentials and access privileges; and date, we have not identified any cybersecurity incidents that have materially affected, or are reasonably likely to materially affect, our business strategy, financial condition, or results of operations. As our business grows, we intend to expand our cybersecurity risk management protocols through the adoption of formal written policies, periodic third-party assessments, and a documented incident response plan.

companyName: SafeSpace Global Corp

ticker: SSGC


text: Cybersecurity risks are identified and processed in a Risk Register by an information security team that includes the vCISO and internal management. We conduct risk assessments, penetration testing, vulnerability scanning, receive alerts from security tools, and engage in an ongoing discussion of business processes and policy management. We use advanced tools to track governance, risk, and compliance tied to a security framework tailored from industry standards and best practices, and we test our tools and policies regularly.

companyName: Dianthus Therapeutics, Inc. /DE/

ticker: DNTH


text: The Company continuously monitors the risk associated with its third-party service providers. The Company mandates that our key third-party service providers undergo an annual SOC 1 audit, which assist in identifying risks from cybersecurity threats. In cases where a waiver is granted, the Company ensures that alternative measures are in place to maintain rigorous oversight. The Company reviews all SOC1 audit reports to ensure our third-party service providers are maintaining adequate IT security and business process controls. This review process is part of our commitment to confirming that these third-party service providers are safeguarding our operations and data integrity.

companyName: AIR T INC

ticker: AIRT


text: Security Operation and Governance Our Board Chartered, IT Committee oversees implementation, monitoring, and assessment of cybersecurity risks as it relates to the comprehensive Information Systems Security Program (ISSP). In fulfilling its duties, the Committee ensures the development of appropriate policies. The Committee reviews and discusses policies, procedures, and projects with management and after taking into consideration any matters that the Committee may deem advisable, the Committee annually recommends such policies to the Board of Directors for review and ultimately approval.

companyName: River Financial Corp

ticker: RVRF


text: In general, our incident response process follows the NIST framework and focuses on four phases: (i) preparation; (ii) detection and analysis; (iii) containment, eradication, and recovery; and (iv) post-incident remediation. As cybersecurity incidents occur, including at third party providers, the Director of Information Security leads the Information Security Team through a standardized incident response process that focuses on responding to and containing the threat, minimizing any business impact, and evaluating its severity level. The severity level assessment determines how widespread the incident is and to what degree it could impact our overall business and manufacturing environment. In the event an incident is determined by the Information Security Team to be a high severity level, our cross functional team, with expertise in various disciplines, will assess the incident to determine if it has had a material affect or is reasonably likely of having a material effect on the Company's business strategy, results of operations or financial condition.

companyName: STEEL DYNAMICS INC

ticker: STLD


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. We believe these risks include, among other things, operational risks resulting in system disruption; intellectual property theft; fraud; extortion; harm to associates or customers including by way of inadvertent release of information; violation of privacy or security laws and other litigation and legal risk; and reputational risks. We have implemented several cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage such material risks. We have invested in data security and privacy protections, and we follow what we believe to be industry-standard recommendations for data security. However, if we fail to properly assess and identify cybersecurity threats, we may become increasingly vulnerable to such risks.

companyName: COLUMBIA BANKING SYSTEM, INC.

ticker: COLB


text: Cybersecurity threats, whether or not successful, could result in our incurring significant costs related to rebuilding our internal systems, writing down inventory value, implementing additional threat protection measures, providing modifications or replacements to our products and services, defending against litigation, responding to regulatory inquiries or actions, paying damages, providing customers with incentives to maintain a business relationship with us, or taking other remedial steps with respect to third parties, as well as incurring significant reputational harm. In addition, these threats are constantly evolving, thereby increasing the difficulty of successfully defending against them or implementing adequate preventative measures. We have seen an increase in cyberattack volume, frequency and sophistication.

companyName: Rackspace Technology, Inc.

ticker: RXT


text: The Trust does not have any officers, directors or employees. The Sponsor, a subsidiary of WisdomTree, Inc., is responsible for the oversight and overall management of the Trust. The Sponsor relies on WisdomTree Inc.'s cybersecurity framework for the Trust's cybersecurity risk management and strategy. Key aspects of such framework are summarized below.

companyName: WisdomTree Bitcoin Fund

ticker: BTCW


text: Our cybersecurity program is designed to safeguard against an evolving threat landscape through effective identification, prevention, detection, response and recovery processes. Our cybersecurity risk management processes include frequent assessment of our top cybersecurity risks and mitigations.

companyName: WORTHINGTON ENTERPRISES, INC.

ticker: WOR