text: Despite our security measures, our internal and third -party information technology systems and networks may be subject to damage, disruption, or unauthorized access due to a variety of factors, including cyber-attacks by computer hackers, computer viruses, ransomware, phishing, denial-of-service attacks, physical or electronic break-ins, employee error or malfeasance, power outages, natural disasters, or other catastrophic events. Any such damage, disruption, or unauthorized access could compromise our internal and third -party networks and the information stored there could be accessed, publicly disclosed, lost, or stolen. Any such access, disclosure, or other loss of information could result in legal claims or proceedings, liability under laws that protect the privacy of personal information, regulatory penalties, disruption to our operations, damage to our reputation, loss of customers, potential harm to our competitive position and additional costs to remediate the issue.

companyName: AYTU BIOPHARMA, INC

ticker: AYTU


text: The CIO regularly informs the Company's CEO and CFO of material aspects related to cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing the Company.

companyName: Limbach Holdings, Inc.

ticker: LMB

secItem: Item 1C


text: Role of the Board of Directors The Board of Directors has delegated oversight of all enterprise risks relevant to the Company, including information technology and cybersecurity risk, to the Board Risk Committee, which consists of three independent non-employee directors. The CISO provides quarterly updates on information security and cybersecurity risk to the Board Risk Committee, as well as an annual cybersecurity overview and information security report to the full Board of Directors. The Risk Committee oversees the Information Security Program including through the annual review and approval of any material changes to the Information Security Policy.

companyName: PATHWARD FINANCIAL, INC.

ticker: CASH


text: Although we follow guidance from various standards related to cybersecurity and engage third-party attestation services to test controls relevant to our business, this does not imply that we meet any particular technical standards, specifications or requirements.

companyName: Trade Desk, Inc.

ticker: TTD


text: The SVP – Information Technology reports to the board of directors on a quarterly basis regarding the relevant key risk indicators, information technology and information security events, including key risk indicator metrics used by the board of directors to monitor risks, and quarterly technology update which includes details of information technology and cybersecurity, initiatives, projects, training, events, and incidents.

companyName: Pioneer Bancorp, Inc./MD

ticker: PBFS


text: Processes and Risk Assessment We rely on the cybersecurity program implemented by Blue Owl, the indirect affiliate of our Adviser. Blue Owl has implemented a cybersecurity program, which is focused on (i) protecting confidential business, client, investor and employee information; (ii) maintaining the security and availability of its systems and data; (iii) supporting compliance with applicable laws and regulations; (iv) documenting cybersecurity incidents and its responses; and (v) notification of cybersecurity incidents to, and communications with, appropriate internal and external parties.

companyName: Blue Owl Capital Corp II


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology ("IT") environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test, or otherwise assist with aspects of our security controls; • cybersecurity awareness training for our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.

companyName: INTUITIVE SURGICAL INC

ticker: ISRG


text: Our management cybersecurity committee is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents through various means, which may include, among other things, briefings with internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in our IT environment.

companyName: Plymouth Industrial REIT, Inc.


text: Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the CIO, Jovan Kangrga. Mr. Kangrga has managed cybersecurity and information security at Array for the past four years and has over 13 years of total experience as an information technology executive for publicly listed companies. Mr. Kangrga holds B.S. degrees in finance and computer science from Arizona State University as well as a M.B.A. from Western International University. He manages a team with over 40 years of combined experience in cybersecurity. Our CIO reports to our CLO, and both our CIO and CLO are responsible for updating the CEO, the Nominating & Corporate Governance Committee, and the Board on cybersecurity issues.

companyName: Array Technologies, Inc.

ticker: ARRY


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, our senior management along with our information technology team evaluates material risks from cybersecurity threats against our overall business objectives and reports to the Audit Committee of the board of directors, which evaluates our overall enterprise risk.

companyName: Taysha Gene Therapies, Inc.

ticker: TSHA


text: In addition to our internal cybersecurity capabilities, we regularly engage with consultants, and other third parties to assist with assessing, identifying, and managing cybersecurity risks. Specifically, the Company is engaged with third party auditors for HITRUST, PCI, and SOC 2 Type 2 for annual certification. We are also engaged with a third party Data Protection Officer to oversee compliance with the General Data Protection Regulation (GDPR).

companyName: Consensus Cloud Solutions, Inc.

ticker: CCSI


text: Monitoring Cybersecurity Incidents The AVP, IT Security manages the information security program responsible for the regular monitoring of our information systems for cybersecurity risks. The monitoring process is led by an experienced team of information security professionals. Advanced security software preemptively detects threats and regular system scans are conducted to identify potential vulnerabilities. The AVP, IT Security regularly receives updates about potential cybersecurity threats and remains informed about the latest threat detection software technologies and new risk management solutions. In the event of a cybersecurity incident, the AVP, IT Security is supported by the cyber security incident response team and the crisis response team. The cyber security incident response plan guides the AVP, IT Security and includes immediate actions to escalate an incident based on its seriousness, to mitigate the impact, and to enact long-term strategies for remediation and prevention of future incidents.

companyName: SERVICE CORP INTERNATIONAL

ticker: SCI


text: Our Company has a dedicated team of technology professionals who consistently monitor risks related to cybersecurity. Our Corporate Vice President and Chief Information Officer, as well as our Chief Information Security Officer ("CISO") are responsible for managing our information technology ("IT") security program. Our CISO is a Certified Information Systems Security Professional (CISSP), holds a Masters Degree in Computer Information Systems, and has over 20 years of relevant expertise in assessing and managing cybersecurity risks. Their teams are responsible for leading an enterprise-wide cyber resilience strategy, policy, standards, architecture, and processes. To identify and address potential information security risks, we use a defense-in-depth methodology that employs multiple, redundant defensive measures and outlines actions to take in the event of a security control failure or vulnerability exploitation. To protect the Company from cybersecurity threats, we utilize a combination of internal resources and external consultants and providers. These consultants and providers provide services such as penetration testing, incident response, and third-party assessments. In addition, we use a combination of both proprietary and commercial solutions to proactively manage and mitigate threats to our IT environment and these processes have been integrated into the Company's overall risk management system.

companyName: VICOR CORP

ticker: VICR


text: Our executive management team has established an enterprise risk management ("ERM") program, which includes an evaluation of our cybersecurity program as well as associated risks and risk mitigation strategies. Our ERM program is led by the Senior Director of Internal Audit and our ERM Committee, which is comprised of members of senior management, including our Chief Executive Officer, Chief Financial Officer, Chief Information Officer ("CIO"), Chief Information Security Officer ("CISO") and Chief Legal Officer. Our cybersecurity policies, standards, processes and practices are integrated into our ERM program and leverage the National Institute of Standards and Technology guidelines. Generally, we seek to address cybersecurity risk through a cross-functional approach in an effort to preserve the confidentiality, security and availability of information that we collect, store and otherwise process. For a description of the risks from cybersecurity threats that could materially and adversely impact us and how they may do so, see our risk factors under Part I, Item 1A "Risk Factors—Risks Related to Our Business" of this Report.

companyName: HERC HOLDINGS INC

ticker: HRI


text: Our Chief Executive Officer and General Counsel oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The cybersecurity risk management program includes tools and activities to prevent, detect, and analyze current and emerging cybersecurity threats, and plans and strategies to address threats and incidents.

companyName: IMMUNIC, INC.

ticker: IMUX


text: While to date we have not had a major cyber incident against our platforms, nor experienced significant data loss or any material financial losses related to cybersecurity attacks, it is possible that we could experience a significant event in the future. Risks and exposures related to cybersecurity attacks are expected to remain high for the foreseeable future due to the rapidly evolving nature and sophistication of these threats. See Item 1A. "Risk Factors." – "Our business and operations could suffer in the event of cybersecurity breaches and we may incur significant legal and financial exposure." for further discussion of potential risks related to cybersecurity incidents.

companyName: LAMAR ADVERTISING CO/NEW

ticker: LAMR


text: Cybersecurity governance is a critically important part of managing security and risk, and helps ensure that the Utilities' cybersecurity program aligns with its business objectives, complies with government and industry regulations, and achieves the goals that leadership has set out for managing security and risk.

companyName: HAWAIIAN ELECTRIC INDUSTRIES INC

ticker: HE


text: As of the date of this Annual Report, we have not encountered any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. For more information on our cybersecurity related risks, see " Risk Factors - Risks Related to Our Business and Our Industry " included elsewhere in this Annual Report on Form 10-K.

companyName: CITIUS ONCOLOGY, INC.

ticker: CTOR


text: Security Governance Oversight of our security program starts at the Board level. On an annual basis, the enterprise risk team reports to the full Board regarding the top ten enterprise risks, including cybersecurity. Additionally, on a quarterly basis, the Audit Committee receives presentations by LiveRamp security, highlighting any risks, initiatives, and/or relevant industry trends.

companyName: LiveRamp Holdings, Inc.

ticker: RAMP


text: The response plans define a cross-functional cyber incident response team (the "CIRT") that includes members of senior management, including the CISO and CIO, among other skilled employees. The CIRT supports the detection, mitigation and remediation of cybersecurity incidents and informs relevant members of management and the audit committee about cybersecurity threats and events. Select CIRT members participate in regular technical readiness exercises. Moreover, our executive officers participate in annual crisis tabletop exercises and attack simulations to prepare for a swift, effective and thorough response to potential cybersecurity incidents.

companyName: COMMERCIAL METALS Co

ticker: CMC


text: Our cybersecurity risk management is a critical component of our comprehensive business continuity and enterprise risk management programs. Our information security team regularly collaborates with cross-functional subject matter experts and leaders to assess and enhance our cybersecurity risk posture and preparedness. Management employs the following defense mechanisms throughout the enterprise: employee training program to increase cybersecurity awareness, vulnerability management to identify and address potential weaknesses, multifactor authentication for secure access, tabletop exercises to simulate and prepare for potential incidents, and evaluation of third-party service providers, business partners and cloud suppliers, including through assessments of their cybersecurity practices prior to service utilization.

companyName: NORDSON CORP

ticker: NDSN


text: We have developed a cybersecurity incident response plan ("CSIRP") for cybersecurity incidents that may jeopardize the confidentiality, integrity, or availability of our IT systems. Our CSIRP guides the internal response to cybersecurity incidents, following a process that generally aligns with the industry-standard cybersecurity frameworks. Pursuant to the CSIRP and its escalation protocols, we engage the incident response team ("IRT"), which includes designated personnel responsible for: (1) analyzing the severity of the incident and associated threat; (2) notifying management of the threat; (3) containing the threat; (4) eradicating the threat; (5) restoring data and access to systems; (6) working with management to determine the reporting and disclosure obligations associated with the incident; and (7) performing post-incident analysis and improvements. The IRT is led by an incident response coordinator, which in the event of a cybersecurity incident would generally be the CIO, and includes members of our IT resources, risk management, legal, communications, finance, and accounting teams, in addition to any other necessary personnel depending on the particular facts and circumstances of the incident. When a cybersecurity incident is detected, the incident response coordinator notifies relevant members of management, as appropriate and consistent with the escalation protocols of the CSIRP, such as the CEO, CFO, and General Counsel, and provides an assessment of the incident and containment strategy, if applicable.

companyName: Brixmor Property Group Inc.

ticker: BRX


text: Our Chief Information Security Officer (CISO) is responsible for day-to-day risk management activities, including identifying and assessing cybersecurity risks, establishing processes in an effort to ensure that potential cybersecurity risk exposures are monitored, implementing appropriate mitigation or remediation measures and maintaining cybersecurity programs. Our CISO is responsible for providing a single consolidated view of the Company's enterprise cybersecurity risk in various industries. OpenText's CISO reports to the Chief Digital Officer (CDO) who is responsible for OpenText's broader IT program, which includes the Company's ability to remediate and recover from a cybersecurity incident while minimizing impacts to the business and operations. Management, including the CDO, updates the Audit Committee and the Board of Directors on the Company's cybersecurity programs, material cybersecurity risks, and mitigation or remediation strategies as needed or appropriate.

companyName: OPEN TEXT CORP

ticker: OTEX


text: We have not experienced cybersecurity events that have materially affected our operations, results of operations, or financial condition. However, we face certain ongoing risks from cybersecurity threats that, if realized, would be reasonably likely to materially affect us, including our operations, results of operations, or financial condition.

companyName: Avery Dennison Corp

ticker: AVY


text: Our cybersecurity risk management program includes: risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment designated team members are responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and Maintain insurance coverage that is intended to address certain aspects of cybersecurity risks. To date, there have not been any cybersecurity threats that have materially affected the Company.

companyName: FENNEC PHARMACEUTICALS INC.

ticker: FENC


text: Other members of our management team, including those from legal, finance, and internal audit, will supervise efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants we engage; and alerts and reports produced by security tools deployed in the IT environment.

companyName: Revelyst, Inc.


text: Our process for managing third-party risk includes security assessments of key third-party service providers before entering into or renewing business with them or granting them access to our data or information systems. Additionally, we impose contractual restrictions on these providers based on their risk profile.

companyName: Vynleads, Inc.

ticker: VYND


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition. However, there can be no assurance that our cybersecurity risk management program and processes, including our policies, controls, or procedures, will be fully implemented, complied with or effective in protecting our systems and information. Please see the section entitled "Risk Factors –Failure to maintain the security of our information technology networks, or those of service providers and other our third-parties, or cybersecurity incidents could harm our reputation and have a material adverse effect on our results of operations, financial condition and cash flow," for more information.

companyName: GCM Grosvenor Inc.

ticker: GCMG


text: Our cybersecurity risk management program aligns with the National Institute of Standards and Technology Cyber Security Framework, which establishes five areas of focus: identify, protect, detect, respond and recover. Our cybersecurity risk management program is designed to manage industry-specific threats, as well as threats arising from the overall evolving cybersecurity landscape and consists of two principal areas of focus: (i) enterprise systems, which consists of all business systems used in our daily operations and (ii) operational technology, which consists of all process control, supervisory control and data acquisition systems. Key elements of our cybersecurity management program include: • identifying, monitoring and mitigating the cybersecurity risks to our systems, assets, data and capabilities; • a critical response process for cybersecurity incidents, including the process for detection, investigation, containment and remediation of any such incidents; • establishment of disaster recovery plans; • testing, at least bi-annually, of select critical systems for disaster recovery and periodic walk-throughs of procedures for disaster recovery; • identity access policies that aim to identify and monitor for potential cyber intrusions; • periodic security tests, including monthly internal vulnerability scans, weekly external vulnerability scans, monthly phishing campaigns and recurring penetration testing by third-party cybersecurity firms; • table-top exercises, at least quarterly, for incident response preparedness for the Cybersecurity team and Information Technology department; and • annual drills for potential threats on various aspects of our technology assets based on the then-existing IT threat landscape for our industry. Pursuant to our incident response plan, the Cybersecurity team has defined roles in responding to all cybersecurity incidents to provide an efficient and organized approach to handling cybersecurity threats, with the CIO receiving all reports and status updates regarding cybersecurity threats. The incident response plan provides a documented framework for when and how the CIO informs and updates our Board, the executive officers and other internal parties and when external parties are notified or consulted about a cybersecurity threat and the status thereof.

companyName: PBF Energy Inc.

ticker: PBF


text: Cybersecurity Risks. Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While we maintain cybersecurity insurance, the costs related to cybersecurity incidents may not be fully insured. See "Risk Factors — A cybersecurity incident, disruption, or failure of our information systems or those of our third-party providers could adversely impact our reputation, business, and financial results."

companyName: TERADATA CORP /DE/

ticker: TDC


text: The Company utilizes a cross-functional, multilayered approach risk management to its cybersecurity to identify, prevent, and mitigate cybersecurity threats to the Company designed to preserve the confidentiality, security, and integrity of the Company's information and data. The Company conducts periodic tests to assess the Company's processes and procedures and the threat landscape. The Board and the Audit Committee receive regular presentations on cybersecurity-related topics ranging from the results of penetration testing, recent developments, evolving standards, the threat environment, technological trends, and information security considerations facing the Company and its peers. At least annually, the Board discusses the Company's approach to cybersecurity risk management with the Company's Director of Information Technology, and at least annually, or more frequently as necessary, the Company's Director of Information Technology meets with the Audit Committee to discuss cybersecurity risk management. The Company's security program and IT-related controls are regularly examined by internal auditors, external auditors, and various regulators.

companyName: Canterbury Park Holding Corp

ticker: CPHC


text: Our information security department, which is led by the CISO, is comprised of specialized professionals who are responsible for the day-to-day, hands-on management of the cybersecurity risk and who handle the processes and procedures to mitigate and implement protective, proactive and reactive measures to protect us against those risks. The department is responsible for developing, documenting, and approving our technical information security control standards, guidelines, and procedures designed to preserve the confidentiality, integrity, and availability of our information technology assets and data.

companyName: Federal Home Loan Bank of Indianapolis


text: We periodically engage both internal and external auditors and consultants to assess and enhance our program. These independent external auditors and consultants are accredited under various information security standards, including those administered by the International Organization for Standardization and the PCI Security Standards Council. These engagements typically include penetration testing, third-party certifications, compliance assessments, audits, and assessments of vulnerabilities and emerging threats. We also periodically deploy our Internal Audit processes to conduct additional reviews and assessments. We also mutually exchange threat intelligence with government agencies, cyber analysis centers and cybersecurity associations.

companyName: Lumen Technologies, Inc.

ticker: LUMN


text: We aim to incorporate industry best practices throughout our cybersecurity program. Our cybersecurity strategy focuses on implementing effective and efficient controls, technologies, and other processes to assess, identify, and manage material cybersecurity risks. Our cybersecurity program is designed to be aligned with applicable industry standards and is assessed periodically by independent third-parties. We have processes in place to assess, identify, manage, and address material cybersecurity threats and incidents. These include, among other things: annual and ongoing security awareness training for employees; mechanisms to detect and monitor unusual network activity; and containment and incident response tools. We monitor issues that are internally discovered or externally reported that may affect our business, and have processes to assess those issues for potential cybersecurity impact or risk. We also have a process in place to manage cybersecurity risks associated with third-party service providers. We impose security requirements upon our suppliers, including: maintaining an effective security management program and abiding by information handling and asset management requirements. Our Board of Directors has ultimate oversight of cybersecurity risk, which it manages as part of our enterprise risk management program. That program is utilized in making decisions with respect to company priorities, resource allocations, and oversight structures. The Board of Directors is assisted by the Audit Committee, which regularly reviews our cybersecurity program with management and reports to the Board of Directors. Cybersecurity reviews by the Audit Committee or the Board of Directors generally occur at least annually, or more frequently as determined to be necessary or advisable. Our cybersecurity program is run by the head of our information security department, who reports to our Chief Financial Officer. Our Chief Financial Officer is informed about and monitors prevention, detection, mitigation, and remediation efforts through regular communication and reporting from professionals in the information security team, who hold cybersecurity certifications such as a Certified Information Systems Security Professional, and through the use of technological tools and software and results from third party audits. We have an escalation process in place to inform senior management and the Board of Directors of material issues.

companyName: MIMEDX GROUP, INC.

ticker: MDXG


text: The ISMS consists of a set of policies and procedures that serve as a foundation for risk identification and remediation across all company assets. ZoomInfo's ISMS implementation allows for the appropriate integration of security controls into existing or newly created business processes. ZoomInfo's risk management platform is based on the ISO 31000 Risk Management Standard, and continuous risk assessment activities are conducted in partnership and coordination with risk owners in various functions.

companyName: ZoomInfo Technologies Inc.

ticker: GTM


text: As part of our ISP, we also perform cyber risk assessments on our critical and material third party vendors during onboarding, then periodically thereafter.

companyName: ALLIANCEBERNSTEIN HOLDING L.P.

ticker: AB


text: Our senior IT leadership is responsible for the day-to-day management and development of appropriate cybersecurity programs, including as may be required by applicable law or regulation. Our senior IT leadership monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents as part of the cybersecurity programs described above, works closely with the SC, and reports regular updates to the Audit Committee. Our IT team is led by our Vice President – IT, who has over 12 years of experience managing global IT operations, including strategy, applications, infrastructure, information security, support, and execution.

companyName: Nine Energy Service, Inc.


text: All employees with a company-provided email are assigned annual cyber awareness training. In addition, we perform monthly phishing simulations, with remediation training required as necessary.

companyName: PATTERSON UTI ENERGY INC

ticker: PTEN


text: Our Corporate Information Security Group is led by our Chief Information Security Officer (CISO) who is responsible for our information security strategy. This strategy includes policy management, security engineering, identity and access management, vulnerability management and cyber threat detection and response through our Security Operations Center. Our CISO has extensive information technology and program management experience as do many of our employees in our information security group. Our CISO, as well as others in our information security group, hold certifications such the Certified Information System Security Professional certification. We believe cybersecurity is a shared responsibility throughout the organization and thus we also manage cybersecurity risks, through a cross-functional committee of members of senior management known as the Enterprise Risk Steering Committee, which includes the CISO. The diversity of this group allows for identification of key enterprise risks from strategic, operational, financial, legal, information technology, and compliance perspectives. These individuals receive reporting on our cybersecurity programs and also participate in table-top exercises relating to potential security incidents. The CISO is also the primary point of contact for reporting information security incidents and for coordinating information security activities including incident response and digital forensics. Our CISO reports to our Chief Security Officer who also has extensive experience in the information security space.

companyName: Fidelity National Financial, Inc.

ticker: FNF


text: Key elements of our cybersecurity risk management program include but are not limited to the following: • risk assessments designed to help identify material risks from cybersecurity threats to our critical systems and information; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, including incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for key service providers, based on our assessment of their criticality to our operations and respective risk profile.

companyName: FRACTYL HEALTH, INC.

ticker: GUTS


text: We are committed to monitoring cybersecurity risks and are in the process of implementing enhanced monitoring systems. With the assistance of cybersecurity consultants, we are refining our cybersecurity policies and controls, including regular audits and the deployment of advanced security measures such as Multi-Factor Authentication ("MFA") and stronger email filtering protocols. In addition, we are continuing to develop incident response plans, communication protocols, and disaster recovery plans to be prepared for any potential cybersecurity incidents.

companyName: reAlpha Tech Corp.

ticker: AIRE


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, (1) cybersecurity risk is addressed as a component of our enterprise risk management program; (2) the information security function works with our leadership team to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business; (3) our CTO evaluates material risks from cybersecurity threats against our overall business objectives and reports to the Finance & Risk Committee of our Board (the "Finance and Risk Committee"), which evaluates our overall enterprise risk.

companyName: HA Sustainable Infrastructure Capital, Inc.

ticker: HASI


text: We maintain a cybersecurity program designed to protect our systems and data from information security risks, including regular oversight of our programs for security monitoring. Gen has a process for identifying and assessing material risks from cybersecurity threats on a regular basis that operates alongside our broader overall risk assessment process, covering all identified enterprise wide risks. Cybersecurity risk is reviewed quarterly with management and with the board of directors. In addition, we regularly perform evaluations (including independent third-party evaluations) of our security program and our information technology infrastructure and information security management systems. A retained independent third-party firm reviews the maturity of our information security program and the results are discussed annually in the Technology and Cybersecurity Committee of the Board. Our processes also address risk and identification of cybersecurity threat risks from our use of third-party service providers. This involves, among other things, conducting pre-engagement risk-based diligence, reviewing security and controls reports, implementing contractual security and notification provisions, and ongoing monitoring as needed.

companyName: Gen Digital Inc.

ticker: GEN


text: W e have not identified risks from cybersecurity threats that have materially affected us, including our financial position, results of operations, cash flows, or reputation, although certain risks, if realized, are reasonably likely to materially affect us. For more information regarding the risks we face from cybersecurity threats and how those risks could affect us, please see Item 1A. "Risk Factors."

companyName: Holley Inc.

ticker: HLLY


text: Duke Energy's second line of defense against cybersecurity threats is the EST, which is led by the CSISO, and actively evaluates, anticipates and tests Duke Energy's cybersecurity risk level and preventive and risk mitigation controls relative to the enterprisewide risk level and controls. The EST is responsible for infrastructure defense and security controls, performing vulnerability assessments and third-party information security assessments, employee awareness and training programs and security incident management, including oversight of the remediation of cybersecurity incidents. The EST monitors cyber activity and also reports on the status of the Company's cybersecurity performance and any ongoing remediation efforts to the Company's CAO, Chief Information Officer (CIO) and CSISO. The CAO and CSISO report these cybersecurity metrics, which use a vulnerability management scoring system and closely align with the National Institute of Standards and Technology Cybersecurity Framework, to the Audit Committee at each regularly scheduled Audit Committee meeting. The EST also employs tools and oversees and challenges Duke Energy's cybersecurity and technology metrics under its Enterprise Security Risk Register to track, identify and manage risk. To this end, the EST engages outside expert firms to perform a comprehensive external penetration test each year, performs system and application penetration testing several times throughout the year, and conducts annual exercises simulating the tactics, techniques, and procedures of advanced threat actor groups to test the Company's ability to prevent penetration, detect suspicious activity and respond to these threats in a timely manner. Lessons learned inform the ongoing improvement of security preventive and mitigating controls and procedures and the results of such testing and threat actor simulations are shared with senior management and the Board of Directors. Duke Energy also has a senior management committee, the Executive Cybersecurity Oversight Governance Committee (ECOG), which governs enterprise-level cybersecurity risk tolerance.

companyName: PROGRESS ENERGY INC


text: During the last three years, we have not experienced a material security breach and, as a result, we have not incurred any material expenses from such a breach. Furthermore, during such time, we have not been penalized or paid any amount under any information security breach settlement.

companyName: MERIT MEDICAL SYSTEMS INC

ticker: MMSI


text: We maintain a cybersecurity program, which is informed by industry standards, that includes processes for identification, assessment, and management of cybersecurity risks. We conduct periodic risk assessments, including with support from external vendors, to assess our cyber program, identify potential areas of enhancement, and develop strategies for the mitigation of cyber risks. We also conduct regular security testing and have established a vulnerability management process, supported by security testing, that is designed to address the treatment of identified security risks based on severity.

companyName: 908 Devices Inc.

ticker: MASS


text: Stitch Fix views its cybersecurity strategy through a multi-pronged lens encompassing prevention, detection, and response to ensure holistic coverage of the program and our environments.

companyName: Stitch Fix, Inc.

ticker: SFIX


text: Monitor, Manage, and Safeguard Against Cybersecurity Incidents and Risks The Company's CIO, along with its director of cybersecurity and a designated security team of professionals, are responsible for assessing and managing risks as well as developing and implementing policies, procedures, and practices based on the range of threats faced by the Company. There are processes around access management, data security, encryption, asset management, secure system development, security operations, network and device security to provide safeguards from a cybersecurity incident along with continual monitoring of various threat intelligence feeds.

companyName: MDU RESOURCES GROUP INC

ticker: MDU


text: We are committed to cybersecurity and vigilantly protecting all our resources and information from unauthorized access. Our cybersecurity approach incorporates a layered portfolio of comprehensive employee training programs, multiple resources to manage and monitor the evolving threat landscape, effective Board oversight of cybersecurity risks and knowledgeable teams responsible for preventing and detecting cybersecurity risks.

companyName: W. P. Carey Inc.

ticker: WPC


text: The Company engages a national technology firm in an effort to maintain and continually update its cybersecurity posture and keep current with evolving cybersecurity risks. The IT Provider's cybersecurity program is examined on a regular basis, and new procedures and tools are adopted on an ongoing basis to address the changing cybersecurity landscape. The IT Provider's technology team tests the effectiveness of its tools with periodic exercises, including Penetration (PEN) tests. Risk is assessed to identify and manage risks that could affect its ability to provide reliable processing to the Affiliated Group. This process requires IT Provider to identify significant risks based upon the following: (a) management's internal knowledge of and perceived risks to the IT environment, (b) significant changes to the internal and the third-party vendor IT environments, (c) input received annually from its consultants and external auditors based on its auditor's review of the IT operating environment, (d) management's review of Service Organization Controls (SOC) reports received from vendors housing critical applications, (e) regulatory requirements or operating standards that may directly impact the IT environment, and (f) identification of threats and the evaluation of the probability and likelihood of threats. For any significant risks identified, IT Provider's management is responsible for implementing appropriate measures to monitor and manage these risks, including implementing or revising control procedures, conducting specific consulting projects, and updating systems and processes to ensure compliance,.

companyName: KAANAPALI LAND LLC

ticker: KANP


text: We recognize the importance of cybersecurity in safeguarding sensitive information, withstanding and recovering from adverse events, and protecting stockholders' interests. We currently manage cybersecurity risks by utilizing basic security protocols, such as network monitoring and access controls. Management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes that are designed to ensure such potential cybersecurity risks are monitored, putting in place reasonable appropriate mitigation measures and maintaining cybersecurity programs. Any significant incidents are reported to the board of directors, however the board of directors does not have a designated cybersecurity committee. During the fiscal year ended June 30, 2025, we have not identified any indication of a cybersecurity incident that would materially affect our business.

companyName: MOVING iMAGE TECHNOLOGIES INC.

ticker: MITQ


text: The program also establishes protocols for identifying and managing material risks related to cybersecurity threats associated with the Company's use of third-party service providers. The Company monitors and oversees the material risks related to vulnerabilities, threats, and incidents impacting its third-party service providers via onboarding reviews, threat intelligence reports, and annual assessments. As an example of the Company's efforts to manage third-party cybersecurity risks, when third parties are engaged to provide software-as-a-service offerings, the Company's standard licensing terms require such third parties to utilize safeguards to protect the Company's data, in compliance with applicable standards from the International Organization for Standardization (ISO) regarding security techniques, and to notify the Company within 24 hours of becoming aware of a cybersecurity incident impacting the Company's data.

companyName: APA Corp

ticker: APA


text: We assess, identify and manage material risks from cybersecurity threats under our enterprise risk assessment framework, as well as several related policies and procedures addressing areas such as threat vulnerability management, cyber risk management, data protection and classification, network security, access control, incident response, security awareness, employee training and asset management. These policies and related standards require identification of all Information Technology (IT) and Operational Technology (OT) critical systems, assets and networks, and sufficient controls for IT and OT asset inventory, including responsibilities for assets, information owners, and asset disposition processes. From a security perspective, our Information Technology and Safety teams are responsible for protecting physical processes, safety, production, efficiency, and protection of employees. Our Information Security team is directed at protecting all aspects of data and how information is stored, transmitted, processed and used in business processes.

companyName: Waste Connections, Inc.

ticker: WCN


text: The Enterprise Risk Management Committee is a board-level committee that focuses on enterprise risk which is inclusive of cybersecurity risks. Multiple directors have decades of experience, not only in the banking sector, but also have been responsible for cybersecurity and technology departments at larger organizations. The Chief Security Officer is responsible for providing the Information Security strategy and operational planning for the overall Information Security program. The Chief Security Officer has multiple decades of experience in the industry, advanced education degrees, and holds industry standard technical and security certifications. Several members of the Information Security leadership team also hold multiple security certifications that tie directly to their job responsibilities.

companyName: WESBANCO INC

ticker: WSBC


text: The Company's Board of Directors (the "Board") oversees the Company's overall risk management program, and has assigned oversight of cybersecurity risk management to its Audit Committee. The Audit Committee reviews the adequacy and effectiveness of the Company's cybersecurity policies and internal controls regarding information and cybersecurity, and together with the full Board, regularly receives reports from our management, including our Chief Information Security Officer (the "CISO") on cybersecurity matters, including, but not limited to: AI Security, Security Awareness, Internal Risk, Third-Party Risk, IR / DR Readiness, Access Control IAM/PAM, HIPAA Security Rule Compliance, Phishing, Security Monitoring, Vulnerability Management, Application Security, Governance, Data Security, and Cloud Security.

companyName: CLOVER HEALTH INVESTMENTS, CORP. /DE

ticker: CLOV


text: In the normal course of business, we may collect and store personal information and other sensitive information, including proprietary and confidential business information, trade secrets, intellectual property, patient information, sensitive third-party information and employee information. To protect this information, our existing cybersecurity policies require continuous monitoring and detection programs, network security precautions, encryption of critical data and in-depth security assessments of vendors. We maintain various protections designed to safeguard against cyberattacks, including firewalls and virus detection software. Our information technology (" IT ") team (In-house and outside consultants) s responsible for these ongoing monitoring and detection activities.

companyName: Kaya Holdings, Inc.

ticker: KAYS


text: At present the Company has minimal risk related to Cybersecurity as no operational business is conducted on the internet or available through the internet.

companyName: ADVANCED OXYGEN TECHNOLOGIES INC

ticker: AOXY


text: Management Oversight Our CIO, CISO and other senior executives who oversee the Company's enterprise IT infrastructure periodically meet in management committees to ensure that our enterprise information systems are protected from internal and external cybersecurity threats by monitoring cybersecurity controls, risk assessments and information system reports. The CIO, CISO and our management committees periodically provide cybersecurity reports about our Cybersecurity Program to senior management, the board of trustees and our board committees.

companyName: PennyMac Mortgage Investment Trust

ticker: PMT


text: Our cybersecurity incident response processes are designed to escalate certain cybersecurity events to members of management depending on the circumstances. Key members of management, including representatives from IT, operations, legal, finance, risk management and internal audit, serve on the Company's senior security incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified, and certain cybersecurity incidents are escalated to the Company's executives. In addition, the Company's incident response processes include potential reporting to the Audit Committee of our Board of Trustees for certain cybersecurity incidents.

companyName: EQUITY RESIDENTIAL

ticker: EQR


text: From time to time, management will also engage in informal discussions with members of the Audit Committee about our cybersecurity practices and risks, including informing our Audit Committee Chair in a timely manner about any cybersecurity incidents that management determines may have a significant impact on our operations or that may trigger any reporting obligations. Audit Committee will conduct an annual review of our cybersecurity measures and the effectiveness of our risk management strategies.

companyName: MICROVISION, INC.

ticker: MVIS


text: Information technology and data security, particularly cybersecurity, is a top area of focus for our Board of Directors (the Board), which considers these areas as essential for the success of our company and the broader technology industry in which we operate.

companyName: SYNOPSYS INC

ticker: SNPS


text: As of the date of this Form 10-K, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, our business strategy, results of operations, or financial condition.

companyName: Belpointe PREP, LLC

ticker: OZ


text: Apart from any incidents that require notification to the top management and the board, an end-of-the-year update is presented by Crexendo security team to the executive management and the board. The update provides an overview of organizational security stature, any experienced incidents, in-flight security/compliance projects, and opportunities for improvement.

companyName: Crexendo, Inc.

ticker: CXDO


text: Our daily operations are continuously monitored. We monitor traffic traversing our computer networks and have implemented IT controls and processes to secure our business applications and prevent unauthorized access to or the loss of sensitive data. Our controls include the use of multiple encryption layers for data in transit and at rest, multi-factor authentication, data classification, and data loss prevention. We plan to assess the adequacy of our cybersecurity IT controls through annual cybersecurity vulnerability testing.

companyName: OXBRIDGE RE HOLDINGS Ltd

ticker: OXBR


text: Noble also engages with various cyber security service providers, such as Crowdstrike, Fortinet, NTT, and Microsoft, which share applicable reports with Noble.

companyName: Noble Corp plc

ticker: NE


text: Sensitive and confidential data is a part of business. We leverage an encryption and signing policy that identifies the type of information we store and what level of encryption and signing is required for the data. This document also details the overarching requirements for encryption such as allowed cyphers, encryption methods, and key storage.

companyName: USBC, Inc.

ticker: USBC


text: Related to Cybersecurity Risks Our Senior Director of IT is responsible for the strategic leadership and direction of our cybersecurity program. The Senior Director of IT has over 15 years of experience as an information technology professional.

companyName: Sagimet Biosciences Inc.

ticker: SGMT


text: BAM, has a board of directors that is ultimately responsible for managing and directing the affairs of the Sponsor, including maintaining oversight of risks from cybersecurity threats. Mr. Kim serves on the BAM board of directors. Ms. Dowling serves as the General Counsel and Chief Compliance Officer and is on the Executive Management Team of BAM and therefore is able to report directly to BAM's board of directors regarding cybersecurity risks to the Trust and the Sponsor.

companyName: Bitwise Ethereum ETF

ticker: ETHW


text: 8x8 recognizes that cybersecurity is critical to the trust placed in our platform by customers, partners, and other stakeholders. The Company is committed to maintaining the confidentiality, integrity, and availability of its systems and data through a comprehensive cybersecurity risk management and governance framework.

companyName: 8X8 INC /DE/

ticker: EGHT


text: Our CISO has over 20 years of experience in information security leadership roles and over 9 years as our CISO. He holds many industry certifications, including Certified Information Systems Security Professional ("CISSP"), and is an active member in professional organizations. Also, certain members of our board of directors have completed cybersecurity program trainings, or have relevant industry experience.

companyName: TE Connectivity plc

ticker: TEL


text: The CIO and CISO are required to engage the Cybersecurity Incident Review Committee ("CIRC"), a subcommittee of the DuPont Disclosure Committee, if a cyber incident has materially affected, or is reasonably likely to materially affect, the Company, including its business strategy, results of operations or financial condition. The CIRC is engaged if, in the opinion of the DCIRT, based on information then-available, a cyber incident is, or it is reasonably possible it may be, classified in one of the highest two severity categories discussed above. The CIRC includes membership representation from information technology, legal, finance, investor relations and internal audit and, if appropriate, the impacted business. The CIRC is responsible for performing a materiality assessment, activating the Crisis Management Committee ("CMC") when applicable, and overseeing the public disclosure of material cybersecurity matters, as appropriate. The CIRC coordinates with the Company's legal counsel and third parties, such as consultants and legal advisors, as needed. The CMC is a standing committee comprised of senior management and reports to the CEO. In the event the CMC is activated in relation to a cyber incident, the CEO is required by Board adopted policy to notify the Lead Director and any member of the Board of Directors identified as having cybersecurity expertise.

companyName: DuPont de Nemours, Inc.

ticker: DD


text: Please refer to "Risks Related to Cybersecurity and Technology Matters" under Item 1A, "Risk Factors" above for a discussion of the risks from cybersecurity threats and the potential impact to our strategy, results of operations and financial condition.

companyName: OLD DOMINION FREIGHT LINE, INC.

ticker: ODFL


text: We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing within these systems.

companyName: Lite Strategy, Inc.

ticker: LITS


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Chief Information Security Officer and Chief Technology Officer. Such individuals have collectively over 25 years of prior work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs and adhering to relevant compliance requirements as well as several relevant degrees and certifications, including undergraduate degrees in information systems and computer engineering, Certified Information Systems Security Professional, Global Information Assurance Certification, and Internal Security Assessor.

companyName: GREEN DOT CORP

ticker: GDOT


text: Our Vice President, IT – Technical Services reports to our Chief Technology Officer and is the head of our cybersecurity team. He is responsible for assessing and managing our cybersecurity management program, informs our Chief Technology Officer regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents, and supervises and monitors such efforts. Our Chief Technology Officer has more than 20 years of experience in cybersecurity and information systems management, and our Vice President, IT – Technical Services has nearly three decades of experience managing information systems, network infrastructure, and cybersecurity in the public and private sectors. This combined in-depth knowledge and experience has been critical in developing and implementing our cybersecurity programs. In addition to quarterly reports to the Audit Committee, as an Executive Vice President and member of the Executive Committee, our Chief Technology Officer regularly briefs the Executive Committee on the threat landscape, the Company's cybersecurity programs, and risks, so that the highest level of management is regularly informed of cybersecurity issues for decision-making and guidance.

companyName: QXO BUILDING PRODUCTS, INC.


text: One of the key functions of the Audit Committee of our Board of Directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our Audit Committee is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face.

companyName: IGM Biosciences, Inc.


text: We apply an enterprise risk management ("ERM") methodology as established and led by our executive leadership team to identify, assess and manage enterprise-level risks. Our cybersecurity risk program directly integrates and is intended to align with our governing ERM program.

companyName: Marathon Petroleum Corp

ticker: MPC


text: As part of this process, the Audit Committee receives regular updates from the Chief Information Security Officer on critical issues related to our information security risks, cybersecurity strategy, supplier risk and business continuity capabilities.

companyName: Value Exchange International, Inc.

ticker: VEII


text: We strive to integrate cybersecurity into our corporate governance, engaging with expert third parties, managing third-party risks, and ensuring that both management and the Board of Directors are actively involved in overseeing and mitigating these risks.

companyName: WORLD ACCEPTANCE CORP

ticker: WRLD


text: The Vice President, Information Technology, provides updates to the Audit and Reserves Committee on data protection and cybersecurity matters on at least a semi-annual basis, or as requested or deemed necessary. The topics covered in such reports may include an overview of our current cybersecurity risk assessment, key risk areas, any significant cyber incidents that have occurred or are reasonably likely to occur, as well as recent updates on cybersecurity trends and emerging threats. Additionally, on an annual basis, the Vice President, Information Technology, reviews with the Audit and Reserves Committee the results from tests of key cybersecurity risks and the subsequent steps taken to mitigate such risks.

companyName: Chord Energy Corp

ticker: CHRD


text: The Company has not adopted any formal cybersecurity risk management program or formal processes for assessing, identifying, and managing material risks from cybersecurity threats. The full board of directors has oversight responsibility for the Company's overall risk management, including cybersecurity risk, and has not delegated oversight authority for cybersecurity risks to any committee. In fiscal year 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.

companyName: ESG Inc.

ticker: ESGH


text: Cybersecurity Threat Disclosure To date, based upon all evaluations and assessments, including third party evaluations, we have no cybersecurity threats that have materially affected, or are reasonably likely to materially affect, our business strategy, operations or financial condition.

companyName: Anterix Inc.

ticker: ATEX


text: Our Board of Directors receives an update from our SVP-IT twice per year. In addition, our Government Security Committee of the Board of Directors is responsible for reviewing Cybersecurity Posture and overall resilience of the aerospace and defense portion of the network. The Government Security Committee reviews global cybersecurity risk with the SVP-IT at least four times a year. These reviews included standard cybersecurity-related metrics as well as other detailed reviews of sensitive systems. Our SVP-IT has over 25 years of experience in IT, which include various leadership roles at other large corporations and holds an Executive Master in Cybersecurity degree from Brown University.

companyName: TTM TECHNOLOGIES INC

ticker: TTMI


text: Annual risk assessments and penetration testing are primarily performed by our internal staff, and we have not engaged any third parties in connection with such processes except that we have an external Management Information Systems consultant, or MIS consultant, who provides advices to our CEO in the review of test results. We believe these tests are useful tools for maintaining a robust cybersecurity program to protect our investors, customers, employees, vendors, and intellectual property. The results of these tests are presented annually to the CEO, with support provided by our external MIS consultant, for review to ensure compliance with cybersecurity standards.

companyName: Jerash Holdings (US), Inc.

ticker: JRSH


text: The Program leverages a blend of automated systems, manual operations, and external evaluations to proactively identify and mitigate potential cybersecurity threats. Key components of the program include Tredegar's Cybersecurity Incident Response Plan and Cyber Crisis Management Plan. These plans encompass a strategic approach that includes detection of threats, thorough analysis of cybersecurity incidents to determine whether timely notification to the Board of Directors is necessary, containment of incidents, eradication or mitigation of threats, recovery processes, and a comprehensive post-incident review.

companyName: TREDEGAR CORP

ticker: TG


text: We have a process to assess the security practices of certain third-party vendors, including through the use of vendor security questionnaires, as appropriate.

companyName: Fulcrum Therapeutics, Inc.

ticker: FULC


text: Our business heavily relies on various IT and application systems that contain proprietary and confidential information about our operations, employees, agents, claimants, customers, and their employees and property, including personally identifiable information. These systems are connected to and/or accessed from the Internet, making them susceptible to cyber-attacks. A cyber-attack on our systems, distribution partners and their key operating systems, or any other third-party partners or vendors and their key operating systems may materially affect us. Potential impacts include prolonged interruption of our business operations, reputational harm, or substantial monetary damages. For a detailed description of the risks related to cybersecurity, refer to the "Risks Related to our General Operations" section in Item 1A. "Risk Factors." of this Form 10-K.

companyName: SELECTIVE INSURANCE GROUP INC

ticker: SIGI


text: The Company's senior IT leadership, comprised of the Chief Information Officers of both AMC and Odeon, and IT cybersecurity teams have the primary responsibility for assessing, monitoring, and managing, our cybersecurity programs. The Company's senior IT leadership bring over fifty years of combined IT experience to their roles. Each member of the Company's IT cybersecurity leadership team, comprised of the AMC Sr. Director Cybersecurity and Network, the AMC Director Cybersecurity, the Odeon Group Head of Cyber, Risk and Operations and the AMC VP IT Operations, brings 20+ years of IT experience. The Company regularly invests in training on these teams, and key leadership positions hold CISSP certifications. Our senior IT leadership and IT cybersecurity team, with input as appropriate from the Security Committees, oversee our governance programs, tests our compliance with standards, remediate known risks, and direct employee training.

companyName: AMC ENTERTAINMENT HOLDINGS, INC.

ticker: AMC


text: Management oversees cybersecurity risk mitigation and reports to the board of directors any cybersecurity incidents. Further, our Audit Committee periodically discusses cybersecurity.

companyName: MANHATTAN BRIDGE CAPITAL, INC

ticker: LOAN


text: IT Director's Role • The IT Director leads the cybersecurity risk management program with over 25 years of experience in managing cybersecurity programs, auditing, and IT operations within the US mining and manufacturing sectors. They possess a bachelor's degree in computer information security and a master's degree in management information systems.

companyName: i-80 Gold Corp.

ticker: IAUX


text: The Company's Chief Information Officer ("CIO") oversees the Company's information technology programs and investments. The Company's CIO has over 20 years of information technology experience, including nine years in various information technology leadership roles. Our CIO holds a Bachelor of Science in Information Technology. The Company's ISO reports to the Chief Risk and Operations Officer and oversees the Company's information security programs. The Company's ISO possesses over 20 years of Information Security and Technology experience. The ISO holds a Bachelor of Science in Computer Systems Engineering, an MBA, and a Master of Science in Information Security and Assurance, as well as multiple industry certifications including CISSP, CISM, CISA, CRISC, CDPSE, PMP, among others.

companyName: Bankwell Financial Group, Inc.

ticker: BWFG


text: Depending on the nature and/or severity of the incident, additional stakeholders within the broader enterprise-wide management team may be included in the assessment, response, and resolution of an incident by the CCMT. The broader management team for this purpose may include, but is not limited to, executive and senior leaders in our Product, Customer, People, Information Technology, and Law functions, as well as others that may be considered necessary (collectively referred to as the "ECMT"). The ECMT provides oversight, perspective, and support from their respective areas of expertise to assist in analyzing the cybersecurity incident, materiality of the incident, and remediation considerations.

companyName: TERADATA CORP /DE/

ticker: TDC


text: Our cybersecurity program is led by our Chief Information Officer (CIO), who is responsible for identifying, assessing and managing our collective information security and technology risks. Our current CIO has served in that role since 2016 and has more than 20 years of experience in the information security and technology fields. Our CIO holds both bachelor's and master's degrees in Electrical Engineering from the Massachusetts Institute of Technology.

companyName: DARDEN RESTAURANTS INC

ticker: DRI


text: During 2024, there were no cybersecurity incidents that had a material effect on the Company. Furthermore, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us to date, including our business, business strategy, results of operations, or financial condition. For a discussion of prospective risks related to potential cybersecurity incidents, please refer to Item 1A, Risk Factors.

companyName: ITT INC.

ticker: ITT


text: In the event of an incident, we intend to follow our cybersecurity incident response plan, which outlines the steps to be followed from incident detection to mitigation, and notification. We contract with external firms that have extensive information technology and program management experience. We have implemented a governance structure and processes to assess, identify, manage, and report cybersecurity risks. As a biopharmaceutical company, we must comply with extensive regulations, including requirements imposed by the Federal Drug Administration related to adequately safeguarding patient information and reporting cybersecurity incidents to the SEC. We believe we are positioned to meet the requirements of the SEC. In addition to following SEC guidance and implementing pre-existing third party frameworks, we have developed our own practices and frameworks, which we believe enhance our ability to identify and manage cybersecurity risks. Assessing, identifying, and managing cybersecurity related risks are factored into our overall business approach. We rely heavily on our supply chain to deliver our products and services, and a cybersecurity incident at a clinical site, subcontractor, or business partner could materially adversely impact us. We require that our subcontractors report cybersecurity incidents to us so that we can assess the direct impact of the incident.

companyName: Kiromic Biopharma, Inc.


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and our clinical trial and related data, or Information Systems and Data.

companyName: Syndax Pharmaceuticals Inc

ticker: SNDX


text: Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public, or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our IT environment.

companyName: Traeger, Inc.

ticker: COOK


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example: professional service firms; threat intelligence service providers; cybersecurity consultants; and cybersecurity software and managed cybersecurity service providers. We use third-party service providers to perform a variety of functions throughout our business, such as application providers and public cloud providers, as well as various third-party suppliers that support our manufacturing and development processes. We use certain vendor management processes to manage cybersecurity risks associated with our use of these providers, which includes reviewing the written information security programs of certain of our vendors. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider. This can extend to contingent workers as well, who are required to complete background investigations and agree to adhere to policies, including for privacy and cybersecurity.

companyName: Rigetti Computing, Inc.

ticker: RGTI


text: As noted previously, our CISO is a member of the Council, which meets at least quarterly to provide operational direction to the ECS team considering the evolving risk landscape. The ECS team and the Council, through ongoing communication, monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents. The CISO, in consultation with the Council and other members of senior management, reports such threats and incidents to the Audit Committee, as appropriate. These reports may be included in, or in addition to, his regular quarterly reports to the Audit Committee.

companyName: ON SEMICONDUCTOR CORP

ticker: ON


text: Following a cybersecurity incident, and during its investigation and the formulation of a response, our processes also envision measures designed to contain and/or eradicate the incident and prevent further effects. Once it is determined that the incident has been resolved, we then work to establish appropriate controls (if applicable) to address similar future events and/or prevent another similar event from occurring in the future. We have experienced, and will continue to experience, cyber incidents in the normal course of business. To date, however, we have not experienced any previous cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.

companyName: UNITED COMMUNITY BANKS INC

ticker: UCB


text: Although ACNB has not, as of the date of this Annual Report on Form 10-K, experienced a cybersecurity threat or incident that materially affected its business strategy, results of operations or financial condition, there can be no guarantee that ACNB will not experience such an incident in the future or the potential impact thereof. For additional information regarding the risk ACNB faces from cybersecurity threats, please see the risk factors titled "ACNB's operations of its business, including its transactions with customers, are increasingly done via electronically, and this has increased its risks related to cybersecurity." and "ACNB's communications, information, and technology systems may experience a failure, interruption or breach in security." included in Part I. Item 1A. – Risk Factors of this report.

companyName: ACNB CORP

ticker: ACNB


text: In 2024, we did not identify any material cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. For more information about these risks, please see Part I - Item 1A. "Risk Factors - We may experience breaches of, or disruptions to, our information technology systems or those of our third-party providers, or other compromises of our data, including the improper disclosure of personal or confidential data, which may adversely affect our operations and reputation."

companyName: PARK OHIO HOLDINGS CORP

ticker: PKOH


text: The Company recognizes the importance of maintaining cybersecurity measures that are designed to safeguard our information systems and to protect the confidentiality and integrity of data gathered on our people, partners, customers, and business assets.

companyName: NCR Voyix Corp

ticker: VYX


text: Identifying, assessing, and mitigating cybersecurity and related risks are disciplines we integrate into our overall enterprise risk management ("ERM") process. To the extent our ERM process identifies any relevant heightened cybersecurity related threat, we assign risk owners to develop mitigation plans, which we then track until full execution.

companyName: ExchangeRight Income Fund


text: As technology and potential cybersecurity threats evolve, EOG intends to continue to adapt and enhance its cybersecurity controls, procedures, and protections.

companyName: EOG RESOURCES INC

ticker: EOG


text: Overseeing Third-Party Risk Because we are aware of the risks associated with third-party service providers, the Company implements processes to oversee and manage these risks. The Company utilizes software products and services to monitor and protect the Company's environment from possible third-party breaches impacting the Company's environment. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third-parties. Third-parties who have access to highly sensitive information due to services performed and data retained are subject to increased scrutiny.

companyName: AMC ENTERTAINMENT HOLDINGS, INC.


text: Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through a multi-faceted approach including third party assessments, internal IT Audit, IT security, governance, risk and compliance reviews. Our IT policies, processes and practices are based on recognized frameworks established by our external IT service provider and other applicable industry standards. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Entera Bio Ltd.

ticker: ENTXW


text: Blackstone maintains a comprehensive cybersecurity program, including policies and procedures designed to protect its systems, operations, and the data utilized and entrusted to it, including by us, from anticipated threats or hazards. Blackstone utilizes a variety of protective measures as a part of its cybersecurity program. These measures include, where appropriate, physical and digital access controls, patch management, identity verification and mobile device management software, employee cybersecurity awareness and best practices training programs, security baselines and tools to report anomalous activity, and monitoring of data usage, hardware and software.

companyName: BLACKSTONE MORTGAGE TRUST, INC.

ticker: BXMT


text: We review the ability of third-party service providers to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our Company.

companyName: ESS Tech, Inc.

ticker: GWH


text: Therefore, the Company does not consider that it faces significant cybersecurity risk and has not adopted any cybersecurity risk management program or formal processes for assessing, identifying, and managing material risks from cybersecurity threats. Our board is ultimately responsible for overseeing the Company's risk management activities in general and, as deemed necessary by our management team, will be informed of any cybersecurity threats or risks that may arise. In fiscal year 2023, the Company did not identify any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy and results of operations.

companyName: Constellation Acquisition Corp I

ticker: CSTAF


text: However, we do depend on the digital technologies of third parties, including information systems, infrastructure and cloud applications and services, any sophisticated and deliberate attacks on, or security breaches in, systems or infrastructure or the cloud that we utilize, including those of third parties, could lead to corruption or misappropriation of our assets, proprietary information and sensitive or confidential data. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose. We have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. In the event of a cybersecurity incident impacting us, the management team will report to the board of directors and provide updates on the management team's incident response plan for addressing and mitigating any risks associated with such an incident. As an early-stage company without significant investments in data security protection, we may not be sufficiently protected against such occurrences. We also lack sufficient resources to adequately protect against, or to investigate and remediate any vulnerability to, cyber incidents. It is possible that any of these occurrences, or a combination of them, could have material adverse consequences on our business and lead to financial loss.

companyName: ASPAC III Acquisition Corp.

ticker: ASPC


text: The Audit Committee receives regular reports from management on our cybersecurity risks. Additionally, management updates the Audit Committee as necessary, regarding any cybersecurity incidents. The Audit Committee reports to the full Board regarding the Audit Committee's areas of oversight, including those related to cybersecurity. The full Board also receives briefings from management on our cybersecurity risk management program periodically. Additionally, our Board receives presentations on cybersecurity topics from our IT management team or external experts as part of the Board's ongoing education.

companyName: Northwest Natural Holding Co

ticker: NWN


text: We face risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows or reputation. We acknowledge that the risk of cyber incident is prevalent in the current threat landscape and that a future cyber incident may occur in the normal course of its business. T o date, we have not had a cybersecurity incident. We proactively seek to detect and investigate unauthorized attempts and attacks against our IT assets, data, and services, and to prevent their occurrence and recurrence where practicable through changes or updates to internal processes and tools and changes or updates to service delivery;

companyName: RenX Enterprises Corp.

ticker: RENX


text: The Company engages in the periodic assessment and testing of the Company's policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. The Company regularly engages third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Audit Committee and the Board, and the Company endeavors to adjust its cybersecurity policies, standards, processes and practices based on the information provided by these assessments, audits and reviews.

companyName: AGILITI, INC. \DE


text: Together with the MSP, we will engage in the periodic assessment and testing of our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts will include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. The MSP regularly assesses our cybersecurity measures, including information security maturity, and regularly reviews our information security control environment and operating effectiveness. The results of such assessments, audits and reviews will be reported to the Audit Committee and the Board, and we will adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.

companyName: CTO Realty Growth, Inc.

ticker: CTO


text: Our Chief Information Security Officer ("CISO") leads a dedicated cybersecurity team responsible for policy, governance, vulnerability management, architecture and incident response. Our team monitors and tests our cybersecurity policies and procedures through methods such as periodic reviews, targeted assessments and tabletop exercises. All personnel with access to UNFI systems are made aware of our cybersecurity policies and procedures upon hire and through periodic refresher trainings. Such policies and procedures cover areas such as identity and access management, vendor management, data governance and protection, vulnerability management, incident response, recovery, communications and cybersecurity hygiene.

companyName: UNITED NATURAL FOODS INC

ticker: UNFI


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF), AI Risk Management Framework (AI RMF) and other industry practices and standards. This does not mean that we meet any particular technical standards, specifications, or requirements, but only that we use the NIST CSF, AI RMF, and other industry practices and standards as guides to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: ADVANCED MICRO DEVICES INC

ticker: AMD


text: Governance of Cybersecurity Risks The Audit Committee of the Board has the primary responsibility for oversight, review and discussion with management of the Company's information technology, data security, business continuity, artificial intelligence and cybersecurity-related risk exposures and threats; the potential impact of those risk exposures and threats on the Company's business, operations and reputation; and the processes management has established to assess, manage, monitor and mitigate such risk exposures and threats. The Company's Chief Executive Officer, President, and Chief Financial Officer are responsible for assessing and managing cybersecurity risks. The Company's management periodically reports on cybersecurity issues and presents information to our Audit Committee as well as our full Board, as appropriate, on cybersecurity matters.

companyName: SANUWAVE Health, Inc.

ticker: SNWV


text: The Program is monitored each year through various internal and external audits, as well as OCC regulatory exams. Vulnerability and penetration testing are also conducted at least annually by an independent third party to supplement the vulnerability and patching program routinely performed by internal staff. Third-party vendors supplement the Company's internal patching program as necessary. The Company also utilizes a third-party "SOC as a Service" to monitor extended detection and response logs and network traffic.

companyName: Investar Holding Corp

ticker: ISTR


text: We track and log security incidents across our company and our customers to remediate and resolve any such incidents. Significant incidents, if any, shall be reviewed by chief executive officer and chief operating officer, with the assistance from our information technology department, to assess and determine its materiality or potentiality of becoming material. Our senior management makes the final materiality determinations and disclosure and other compliance decisions.

companyName: Lakeside Holding Ltd

ticker: LSH


text: Risk is an inherent component of the Company's strategic activities and operating environment. The ability to effectively identify, assess, measure, respond, monitor, and report on risks is critical to the achievement of the Company's mission and strategic objectives. Cybersecurity risk, including the risk of managing cybersecurity threats, is a key risk integrated into our enterprise risk management ("ERM") program and processes. In addition to cybersecurity risk being included in our annual enterprise risk assessment process, other cybersecurity-related risk assessments, such as threat and vulnerability assessments, are performed regularly. Cybersecurity risk is also considered in the Company's annual fraud risk assessment.

companyName: NeueHealth, Inc.

ticker: NEUE


text: On a periodic basis, the CISO provides reports and presentations to the Board, Audit Committee, and Rocket Senior Leadership, including the Rocket Risk Council. These CISO updates include recent industry developments, evolving standards, vulnerability assessments and technological trends. During 2023, the CISO updates included information regarding areas of increasing cybersecurity threats, the ongoing enhancements to our information security framework, processes to mitigate threats, and the results of a simulated cybersecurity incident tabletop exercise.

companyName: Rocket Companies, Inc.

ticker: RKT


text: The Board also receives briefings from management on our risk management program, which includes our cybersecurity risk management. Presentations on cybersecurity topics are made as appropriate by our Chief Executive Officer.

companyName: CHARLES & COLVARD LTD


text: All companies utilizing technology are subject to threats of breaches of their cybersecurity programs. In addition, as a financial services company, we are subject to extensive regulatory compliance requirements, including those established by the Federal Reserve, FDIC, RI Division of Banking and Connecticut Department of Banking. To mitigate the threat to our business and address regulatory requirements, we take a comprehensive approach to cybersecurity risk management and have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. As described in more detail below, we have established policies, standards, processes, and practices for assessing, identifying, and managing material risks from cybersecurity threats. We devote significant financial and personnel resources to implement and maintain security measures to meet regulatory requirements and customer expectations, and we intend to continue to make significant investments to maintain the security of our data and cybersecurity infrastructure. There can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective. Although our "Risk Factors" in Item 1A include further detail about the material cybersecurity risks we face, we believe that risks from prior cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations, or financial condition.

companyName: WASHINGTON TRUST BANCORP INC

ticker: WASH


text: As discussed above, the Security and Compliance team takes a lead role in helping to ensure that we maintain comprehensive technologies and programs to ensure our systems are effective and prepared for cybersecurity risks. This team is supported by our Zumiez North America Cybersecurity Team, which consists of the Security and Compliance Program Manager, the Director of Infrastructure IT, the Vice President of IT, the Chief Financial Officer and the Chief Legal Officer. Additional support and guidance are provided by the Zumiez North America IT Steering Committee, which consists of the Chief Financial Officer, Chief Legal Officer, the Executive Vice President of North American Consumer Teams, the Vice President of IT, the Director of Infrastructure IT and the Senior Program Manager of Digital Commerce. Together, the Zumiez North America Cybersecurity Team and the Zumiez North America IT Steering Committee provide guidance and oversight to the Security and Compliance Team in alignment with the company's overall risk management and oversight framework.

companyName: Zumiez Inc

ticker: ZUMZ


text: The Company has designed and assess its cybersecurity program based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF") and the guidance of banking and other regulatory agencies. The Company's information security team has primary responsibility for overall cybersecurity risk management program. The Company's cybersecurity professionals are led by the Information Security Officer, who has over 23 years of experience in the information technology field, including over 3 years of experience focusing solely on the cybersecurity space. The Information Security Officer has Security+ and Network+ certifications and is currently working on obtaining CISSP. The Company's cybersecurity risk management is integrated as part of its overall risk management program, and the Company's Chief Risk Officer and Information Security Officer, in conjunction with Chief Information Officer, work together to develop and maintain the cybersecurity program. In addition to its own employees, the Company engages third party service providers to provide security products and services as needed, using their expertise to evaluate and enhance its cybersecurity program and to inform employees regarding evolving threats, risks and defensive measures. Generally, these third party service providers are managed by the Information Security Officer and Chief Information Officer.

companyName: PCB BANCORP

ticker: PCB


text: The Chief Information Officer ("CIO") is a peer to the CSO, also reporting to the CFO. The CIO and his team are responsible for executing cybersecurity risk mitigation plans. Zebra's current CIO was appointed to the role in March 2022 and has nearly 20 years of experience in managing IT functions.

companyName: ZEBRA TECHNOLOGIES CORP

ticker: ZBRA


text: The Company has implemented internal incident response procedures to address potential cyber incidents. These procedures are designed to analyze, contain, and remediate any cyber incidents that may circumvent existing safeguards. The incident response procedures encompass a systematic approach to evaluate the materiality of incidents, execute appropriate containment and remediation measures, and evaluate internal (including the Board) and external communication and disclosure protocols. The Company also maintains data backup procedures in the event of a cybersecurity incident and for a business continuity plan in the event of business interruption. Examples of our backup procedures include regularly scheduled backups for various systems, critical system log files, and applications backup.

companyName: AMERICOLD REALTY TRUST

ticker: COLD


text: We have an employee security awareness training program that is designed to raise awareness of cybersecurity threats across functions, as well as to encourage consideration of cybersecurity risks across our company. As part of this employee training program, we periodically conduct phishing simulations designed to raise employee awareness of such risks.

companyName: ImageneBio, Inc.

ticker: IMA


text: the use of external service providers, where appropriate, to assess, test, or otherwise assist with aspects of our security controls; cybersecurity awareness training for our employees, incident response personnel, and senior management; assessment of material cybersecurity risks posed by third-party service providers, including risks to employee, customer and financial information; a cybersecurity incident response protocol that includes procedures for responding to cybersecurity incidents; and business continuity plans.

companyName: Azenta, Inc.

ticker: AZTA


text: Farmer Mac has implemented a variety of processes, technologies, and controls to aid in its efforts to identify, assess, and manage cybersecurity risks. Farmer Mac's approach includes: • an enterprise risk management program that includes an annual cybersecurity risk assessment and management and is periodically refreshed; • security reviews designed to identify risks from many new features, software, and vendors, including a security operations center to monitor our systems; • a team of trained and experienced security professionals to investigate and remediate cybersecurity incidents; • regular cybersecurity training for all employees and network users to raise and maintain awareness of cybersecurity risks and best practices; • a vulnerability management program designed to identify vulnerabilities in the systems and software Farmer Mac uses; • regular cybersecurity testing, including third-party penetration testing on a periodic basis to allow security researchers to help identify vulnerabilities in Farmer Mac's systems before they mature into real-world cybersecurity threats; • a third-party service provider risk management program designed to identify and mitigate risks associated with third-party vendors and business partners, which includes pre-engagement diligence, risk assessments, contractual security and notification provisions, and ongoing monitoring, as appropriate; • a threat intelligence program designed to model and research potential cybersecurity threat actors to identify vulnerabilities and anticipate attack vectors before they are exploited; • cybersecurity controls designed to segment access to systems and to limit access to sensitive data, which controls are tested and updated regularly; • patch management controls aimed at reducing system vulnerabilities; and • a generative artificial intelligence policy that describes how users may utilize generative artificial intelligence tools in alignment with Farmer Mac's values, ethical standards, and legal requirements, while also safeguarding sensitive information. These processes vary in maturity across the business, and Farmer Mac works continually to improve them.

companyName: FEDERAL AGRICULTURAL MORTGAGE CORP

ticker: AGM


text: a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and a third-party risk management process for service providers, suppliers, and vendors. In the last three fiscal years, the Company has not experienced any material cybersecurity incidents.

companyName: VICTORY CLEAN ENERGY, INC.

ticker: VYEY