text: The Company's Chief Information Officer ("CIO"), supported by the Director of IT Security and Compliance, manages cybersecurity risk. Our CIO has over 25 years of experience in information technology and six years of experience with the Company. The Company's enterprise-wide cybersecurity strategy is supported by policies, procedures, security controls and training designed to protect the Company's IT systems, operations and sensitive data. Specifically, our Cyber Incident Response Plan provides a process by which our Company is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents and includes engaging the Cybersecurity and Risk Management Committee ("CRMC"). The CRMC is a management committee established to identify, assess and manage material cybersecurity incidents, including the incident recovery process within the Company. Depending on the significance of the incident, the Cyber Incident Response Plan could include engaging affected internal and external parties, escalating the issue to executive management, notifying one or more members of our Audit Committee, maintaining communication with users and notifying law enforcement and government agencies as warranted.

companyName: ADVANCED DRAINAGE SYSTEMS, INC.

ticker: WMS


text: The CISO manages a global team of cybersecurity professionals with broad experience and expertise, including in cybersecurity threat assessments and detection, cloud security, mitigation technologies, cybersecurity training, incident response, cyber forensics, insider threats and regulatory compliance. We rely on threat intelligence as well as other information obtained from governmental, public, or private sources, including contracted external consultants. The global team includes local cyber security professionals that manage the operational technology (OT) network security of IPALCO to demonstrate compliance with the NERC-Critical Infrastructure Protection (CIP) standards and IURC regulation.

companyName: IPALCO ENTERPRISES, INC.

secItem: Item 1C


text: We identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods.

companyName: REGO PAYMENT ARCHITECTURES, INC.

ticker: RPMT


text: Management has not identified risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect U. S. Steel, including its business strategy, results of operations or financial condition. See "Item 1A. Risk Factors, A failure of our information technology infrastructure and cybersecurity threats may adversely affect our business operations." above for more information. While we continually work to safeguard the information systems we use, and the proprietary, confidential and personal information residing therein, and mitigate potential risks, there can be no assurance that such actions will be sufficient to prevent cybersecurity incidents or mitigate all potential risks to such systems, networks and data or those of our third party providers.

companyName: UNITED STATES STEEL CORP


text: Impact of Risks from Cybersecurity Threats As noted above, we and the third parties with which we do business have been, and we expect will continue to be, the target of cyber attacks and other information security threats. To date, risks from cybersecurity threats, including as a result of previous cybersecurity incidents, have not materially affected our business, including our business strategy, results of operations or financial condition. However, large-scale cyber attacks perpetrated against other companies in recent years suggest that the risk of damaging cyber attacks is increasing. As a result, we continue to invest in our cybersecurity infrastructure, including investment in prevention capabilities and response readiness.

companyName: FEDERAL NATIONAL MORTGAGE ASSOCIATION FANNIE MAE

ticker: FNMA


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the headings: "Any significant technology disruption or failure, cyberattack or data security incident could adversely affect our business, financial condition and operations." and "Our business relies on third-party cloud infrastructures, and any disruption of, or interference with, our use of cloud infrastructures could adversely affect our business, financial condition or results of operations." included as part of our risk factor disclosures in Part I, Item 1A of this Annual Report on Form 10-K.

companyName: Rent the Runway, Inc.

ticker: RENT


text: We continuously monitor emerging threats, evaluate new technologies, and refine our security practices to manage evolving risks. Through regular assessments, audits, and feedback mechanisms, we strive for continuous improvement in our Information Security Program to better protect our assets and maintain the trust of our stakeholders.

companyName: Eagle Bulk Shipping Inc.


text: The Audit Committee oversees the Company's risk management and assessment, including its mitigation strategies, and updates the entire Board on the Company's risk profile and exposures on an as needed basis. With respect to cybersecurity, the Company's Chief Technology Officer ("CTO") and Head of Information Security updates the Audit Committee on at least an annual basis on matters such as external cybersecurity threats and attack trends; updates to threat monitoring processes; the composition of the Company's information security team; cybersecurity awareness training and testing; cybersecurity strategy; cybersecurity metrics, and assessments the progress of cybersecurity programs; and the potential scope and impact of cybersecurity risks and incidents on the Company's operations and financial condition. The Audit Committee may also meet with management on an ad hoc basis to discuss and review any material cybersecurity incidents or threats.

companyName: IMAX CORP

ticker: IMAX


text: Employees and Training Employees are the first line of defense against cybersecurity measures. Each employee is responsible for protecting corporation and client information. Employees are provided training at initial onboarding and thereafter regarding information security and cybersecurity-related policies and procedures applicable to their respective roles within the company. In addition, employees are subjected to regular simulated phishing assessments, designed to sharpen threat detection and reporting capabilities. In addition to training, employees are supported with solutions designed to identify, prevent, detect, respond to, and recover from incidents. Notable technologies include firewalls, intrusion detection systems, security automation and response capabilities, multi-factor authentication, data backups to immutable storage and business continuity applications. Notable services include 24/7 security monitoring and response, continuous vulnerability scanning, third-party monitoring, and threat intelligence.

companyName: Central Plains Bancshares, Inc.

ticker: CPBI


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical comp uter networks, third-party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and trade secrets, data we may collect about trial participants in connection with clinical trials, sensitive third-party data, business plans, transactions, and financial information ("Information Systems and Data").

companyName: Structure Therapeutics Inc.

ticker: GPCR


text: The Company's board of directors, or the Board, recognizes the critical importance of maintaining the trust and confidence of our patients, investors, business partners and employees. The Board is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management, or ERM. The Company's cybersecurity policies, standards, processes and practices are fully integrated into the Company's ERM program and are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing, mitigating and remediating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Day One Biopharmaceuticals, Inc.

ticker: DAWN


text: Key elements of our cybersecurity risk management program include but are not limited to the following: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (i) our cybersecurity risk assessment processes, (ii) our security processes, and (iii) our response to cybersecurity incidents; and • cybersecurity awareness training of our employees, including senior management.

companyName: GigaCloud Technology Inc

ticker: GCT


text: The CISO who reports to the CIO has primary responsibility for assessing, monitoring, and managing our cybersecurity risks. The CIO, in turn, reports directly to our President and Chief Executive Officer. Our CISO oversees our cybersecurity governance programs, tests our compliance with standards, takes action to mitigate known risks, and leads our cybersecurity associate training program. Our CISO has over 10 years' experience leading large complex healthcare cybersecurity programs and holds Certified Information Systems Security Professional ("CISSP") and Certified Information Systems Auditor ("CISA") certifications in good standing. Our CIO is a member of our executive leadership team, having overall responsibility for all aspects of our information systems, including technology, data, and security. The focus of the CIO includes strategic use of technology to support execution on our strategic priorities and our longer-term growth plans, while also balancing risk. Our CIO has over 25 years' experience leading large complex healthcare organizations through successful transformation while developing and strengthening an effective cybersecurity program.

companyName: Brookdale Senior Living Inc.

ticker: BKD


text: The Company recognizes the significance of such risks and cybersecurity is a critical component of our overall risk management program. In order to combat against and mitigate the impact of any unauthorized access to or attack on our information systems, we have implemented policies and procedures designed to assess, identify, and manage material risks arising from cybersecurity threats. Additionally, because we rely on third parties to provide services that are integral to our operations, we have procedures in place to assess a technology provider's cybersecurity controls prior to establishing a contractual relationship and to periodically review assessments of those systems. Whenever possible, we include cybersecurity requirements in our contracts with such providers, which typically include agreed-upon security standards and protocols and our right to obtain periodic reports or assessments of such provider's compliance therewith. Embassy Bancorp, Inc.

companyName: Embassy Bancorp, Inc.

ticker: EMYB


text: We maintain comprehensive business continuity and disaster recovery plans, which we update on at least an annual basis and we test through tabletop exercises on an annual basis. We do not maintain any on-premises data or servers.

companyName: LXP Industrial Trust

ticker: LXP


text: Our management team, including TKO's Chief Information Officer and SVP, Global Privacy & Cybersecurity, is responsible for assessing and managing our material risks from cybersecurity threats. The Chief Information Officer is responsible for implementation and enforcement of written information security policies. The Chief Information Officer has designated leaders, including the SVP, Global Privacy & Cybersecurity, to be responsible for overall management of the information security management program, including developing and operating within the defined global information security controls to protect our IT systems, selecting and supervising retained cybersecurity consultants, and working with Legal, Compliance, and Human Resources personnel to develop and launch appropriate information security training of our workforce. Our management team has decades of experience leading and managing cybersecurity teams as well as professional credentials in cybersecurity and data privacy. In 2024, TKO's SVP, Global Privacy & Cybersecurity, leads a team of three dedicated privacy professionals in the Legal department.

companyName: TKO Group Holdings, Inc.

ticker: TKO


text: The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including counterparties, service providers or other external users of our systems, as well as the systems of third parties that could adversely impact the Company's business in the event of a cybersecurity incident affecting those third-party systems.

companyName: BIMINI CAPITAL MANAGEMENT, INC.

ticker: BMNM


text: Our management team is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in the IT environment.

companyName: AMERIGUARD SECURITY SERVICES, INC.

ticker: AGSS


text: Voya's information security team is responsible for identifying, assessing, and managing cyber risk, with support from Voya's operational risk management team. Information security control tasks are performed under the direction and guidance of the CISO, who is designated under Voya's risk management principles and policies to oversee the evaluation and mitigation of information security risks. Information security management is integrated into Voya's overall risk management framework, which provides for a coordinated approach to addressing cybersecurity risk.

companyName: Voya Financial, Inc.

ticker: VOYA


text: We consider cybersecurity protection, including protection of sensitive customer, employee, and partner information, to be a priority in the Company's business, strategy, and management. Carvana's enterprise risk management program, which is designed to identify, evaluate, and respond to our high priority risks and opportunities, integrates assessment, review, identification and management of cybersecurity risks.

companyName: CARVANA CO.

ticker: CVNA


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Associate Director, Infrastructure Operations. Our President, Interim Chief Executive Officer, Chief Financial Officer and Chief Operating Officer has oversight of cybersecurity and risk management. Our Associate Director, Infrastructure Operations has high-level knowledge of cybersecurity tools and provides oversight of cybersecurity strategy and cybersecurity vendor management, and reports to our President, Interim Chief Executive Officer, Chief Financial Officer and Chief Operating Officer.

companyName: Kronos Bio, Inc.


text: These three key elements of people, process, and technology are tightly interwoven to support our aim to secure our environments and data.

companyName: PTC INC.

ticker: PTC


text: Our cybersecurity risk management program is integrated into our global enterprise risk management framework, which is designed to help identify, monitor, and mitigate key strategic risks. Our enterprise risk assessment, which includes data protection and cybersecurity, is developed annually to provide insight into the risks with the greatest potential to impact Jabil's strategy and our financial goals. Key components of our cybersecurity risk management program include the following: • Cybersecurity policies. We leverage cybersecurity industry-standard frameworks and insights from internal assessments to develop policies to guide the use of our information assets (for example, business information and information resources such as mobile phones, computers, and workstations), access to specific intellectual property or technologies, deployment of AI within the Company, and protection of personal information. The Company has also established written policies and procedures to help ensure that cybersecurity incidents are quickly assessed and addressed. • Risk assessment. The Company uses risk assessment processes to identify and prioritize cybersecurity risks, employ operational controls to mitigate risks, report incidents, and analyze trends, and employ a corrective action process to address nonconformities. Key risk indicators are used across all business functions to monitor and measure our cybersecurity risk exposure. Through this cross-functional approach, management identifies potential operational and strategic risks which could impact our strategy and financial goals. • System safeguards. We implement industry-standard technical safeguards that are designed to protect our information systems, operations, and sensitive information from cybersecurity threats. By collaborating with internal stakeholders across the company, we integrate foundational cybersecurity principles throughout our organization, including multiple layers of cybersecurity defenses and restricted access based on business need. We frequently conduct vulnerability assessments to identify new risks and periodically test the efficacy of our safeguards through both internal and external penetration tests. • Security Awareness and Training. Cybersecurity education contributes to the safety of the Company, customer data, and employee sensitive data and assets. Our employees undergo regular training on information security, cybersecurity awareness, and the protection of confidential information. This training is designed to promote an understanding of the behaviors and technical requirements needed to safeguard Company data. Additionally, we provide ongoing education to help employees recognize and report suspicious activity. In addition, higher risk employees undergo routine anti-phishing testing and training. • Assessments. We periodically assess and test our cybersecurity policies, standards, processes, and practices that are designed to address threats. This includes monthly metrics review, threat modeling, vulnerability testing, and other exercises to evaluate our cybersecurity effectiveness. We regularly engage third parties to assist with our assessments and testing. Where appropriate, we adjust our cybersecurity policies, standards, processes, and practices accordingly based on internal and external assessment and testing results.

companyName: JABIL INC

ticker: JBL


text: Our risk management program also assesses third -party risks, and we perform third -party risk management to identify and mitigate risks from third parties such as vendors, suppliers, and other business partners associated with our use of third -party service providers. Cybersecurity risks are evaluated when determining the selection and oversight of applicable third -party service providers and potential fourth -party risks when handling and/or processing our employee, business, or customer data. In addition to new vendor onboarding, we perform risk management during third -party cybersecurity incidents to identify and mitigate risks to us from third -party incidents. We also carry business interruption insurance that provides protection against potential losses arising from certain cybersecurity incidents as part of our cybersecurity risk mitigation strategy.

companyName: COVENANT LOGISTICS GROUP, INC.

ticker: CVLG


text: Cyber Risk Management and Strategy We rely on information technology in our operations, and any material failures, inadequacies, interruptions, security failures, social engineering attacks or cyber-attacks could harm our business. Management of cybersecurity risks is a component of our overall risk management strategy, which is overseen by our senior management team and our board of directors. We rely on a managed IT service provider with a longstanding relationship with the Company to help manage cybersecurity risks. Our managed IT service provider conducts testing of our controls and environment, including penetration testing, to identify and remediate cybersecurity risks.

companyName: Terreno Realty Corp

ticker: TRNO


text: The governance of Seadrill's cybersecurity program is detailed in Directives and Procedures within our Management System. These documents are regularly reviewed and outline the roles of our Cybersecurity Steering Committee, Security Operations Center, and our comprehensive Cyber Incident Response Plan. This plan specifies procedures for assessing the risk of foreseeable cyber incidents, escalating incidents to Senior Management (including necessary disclosures), and systematically responding to incidents through isolation, containment, analysis, and resolution. A structured de-escalation process follows these actions to ensure resolution and recovery. Our processes also address cybersecurity risks associated with third-party service providers, including those in our supply chain or with access to our systems or data. We evaluate key third-party providers' cybersecurity postures and may recommend specific mitigation controls. The Company works with various assessors, consultants, auditors, and other third parties on a regular basis to ensure the effectiveness of our cybersecurity measures.

companyName: Seadrill Ltd

ticker: SDRL


text: For additional information on certain risks associated with cybersecurity, please refer to "Our Business Relies on Technology, Data, Intellectual Property and Other Sensitive information That is Susceptible to Cybersecurity and Other Threats or Incidents" in Item 1A: Risk Factors.

companyName: LAM RESEARCH CORP

ticker: LRCX


text: The Company invests in information technology systems for its operations. Such investments, including the implementation of technology updates, improves the Company's customers' experience, and supports both compliance and internal controls. The Company is actively engaged in attempting to identify and manage cybersecurity risks. Protecting company data, non-public customer and employee data, and the systems that collect, process, and maintain this information is a Company priority.

companyName: Target Group Inc.

ticker: CBDY


text: Board of Directors (the "Board") recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Board is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM").

companyName: Longeveron Inc.

ticker: LGVN


text: Company's cybersecurity program is managed by the Vice President ("VP") of IS, who has been employed by the Company for 20 years and has over 35 years of total experience in information systems. The VP of IS has an extensive career in software development and infrastructure management including working with Fortune 500 companies in his prior positions. The VP of information system is a participant in the overall Company strategic process and has aligned the program to best service the strategic objectives of the business.

companyName: PERMA FIX ENVIRONMENTAL SERVICES INC

ticker: PESI


text: We have not encountered cybersecurity risks, threats or incidents that have materially affected or are reasonably likely to materially affect the Company, our business strategy, results of operations, or financial condition during the financial year ended December 31, 2024.

companyName: CHINA AUTOMOTIVE SYSTEMS INC/2


text: As noted above, we also maintain a CSC, which consists of our Group Vice President, IT and CISO, Executive Vice President, Chief Financial Officer, Senior Vice President, Chief Human Resources Officer, Senior Vice President, General Counsel, Executive Vice President, Global Operations, Senior Vice President, Chief Accounting Officer, and Vice President, Internal Audit. The CSC has the primary day to day responsibility to monitor and manage cybersecurity risks. The CSC provides oversight of cybersecurity initiatives within Lumentum and is responsible for integrating cybersecurity risk management practices with critical business processes to help ensure that cybersecurity is appropriately addressed throughout Lumentum.

companyName: Lumentum Holdings Inc.

ticker: LITE


text: We, Kronos and CompX each have a Cybersecurity Incident Disclosure and Controls Committee ("CIDAC") which is central to the response and evaluation of cybersecurity incidents. Our CIDAC is comprised of our CIO and other senior executives including our chief executive officer, chief financial officer and general counsel. Security events and data incidents are evaluated, ranked by severity and prioritized for response and remediation. The IT teams are responsible for categorizing cybersecurity incidents, and those deemed high-risk or critical are escalated to the CIDAC for review and response coordination. Incidents are evaluated to determine materiality and for operational, financial and reputational impact. Our CIDAC, as well as the Kronos and CompX CIDAC, performs simulations and tabletop exercises at a management level to evaluate our readiness and response to cybersecurity incidents. As needed, we collaborate with external cybersecurity experts and legal advisors to help ensure a robust response strategy.

companyName: VALHI INC /DE/

ticker: VHI


text: the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of the Company's security processes and controls; cybersecurity awareness training of the Company's employees, incident response personnel, and senior management;

companyName: O-I Glass, Inc. /DE/

ticker: OI


text: The Information Security Officer, under the guidance of our Chief Risk Officer and Operational Risk Manager, works collaboratively across the Company to implement a program designed to protect the Company's information systems and data from cybersecurity risks. The Information Security Officer is responsible for assessing and managing cybersecurity risks, responding to any cybersecurity incidents in accordance with the Company's Incident Response Plan and Business Continuity Plan, and reporting incidents to appropriate personnel at the Company in accordance with the Incident Response Plan. To facilitate the success of the Company's cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. The Information Technology and the Operational Risk Management teams monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents and report such threats and incidents to the Information Security Officer and Chief Information Officer and ultimately the Board Risk Oversight Committee when appropriate. The Information Security Department has over three decades of experience in managing Information Security and Cybersecurity programs at financial institutions. The Information Security Officer holds the Certified Information Security Manager Certification and is supported by additional team members with extensive backgrounds in cybersecurity and related fields.

companyName: SHORE BANCSHARES INC

ticker: SHBI


text: Our Board of Directors oversees our cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. The CISO briefs the Board of Directors on the effectiveness of our cyber risk management program periodically and as needed.

companyName: DAYTON POWER & LIGHT CO


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks, reasonably address any identified gaps in existing safeguards, and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our Chief Information Officer ("CIO") who reports to our Chief Financial Officer, to manage the risk assessment and mitigation process.

companyName: GrowGeneration Corp.

ticker: GRWG


text: Additionally, the board of directors intends to review our enterprise risk management processes and will be notified by management between management updates regarding significant new cybersecurity threats or incidents.

companyName: Envoy Medical, Inc.

ticker: COCH


text: We are committed to safeguarding our information and information systems from unauthorized access, use, disclosure, disruption, modification or destruction. Our program to protect our information assets and the management of risks to those assets supports the confidentiality, integrity, and availability of the information necessary to our long-term business success.

companyName: FLANIGANS ENTERPRISES INC

ticker: BDL


text: Triton faces risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows or reputation. Although such risks have not materially affected us to date, Triton has experienced, and will continue to experience, cyber incidents in the normal course of its business. For more information on the cybersecurity risks we face, please see "We rely on our information technology systems to conduct our business. If these systems fail to adequately perform their functions, or if we experience an interruption in our operations, our business and financial results could be adversely affected" and "Security breaches and other disruptions could compromise our information technology systems and expose us to liability, which could cause our business and reputation to suffer" under Item 1A. "Risk Factors" of this Annual Report on Form 10-K.

companyName: Triton International Ltd

ticker: TRTN-PA


text: The Cybersecurity Incident Reporting Committee was formed to assess the materiality of cybersecurity incidents from a Securities and Exchange Commission reporting standpoint. In the event this committee determines a cybersecurity incident is material, committee members, as delegated, will notify the Audit Committee. The CTO provides a quarterly cybersecurity risk update and presents an annual cybersecurity review to our Board of Directors.

companyName: ARCBEST CORP /DE/

ticker: ARCB


text: Pliant's Cybersecurity Program is integral to safeguarding our assets, maintaining stakeholder trust, and ensuring the continuity of our operations. The management of our Cybersecurity Program is entrusted to the Cybersecurity Governance Committee ("CSGC"), which includes our Chief Financial Officer, General Counsel, Head of Information Technology and Corporate Controller. The CSGC draws on more than twenty years of experience focused in the areas of corporate governance and implementation and oversight of information technology systems and processes. The Board of Directors has delegated oversight of the Company's Cybersecurity Program to the Audit Committee, who receives regular reports from the Chief Financial Officer regarding cyber risks and threats, progress of the Company's projects aimed at strengthening information security systems, assessments of the Cybersecurity Program, and insights into the evolving threat landscape. The Audit Committee provides updates about the Company's Cybersecurity Program to the Board of Directors at least annually.

companyName: PLIANT THERAPEUTICS, INC.

ticker: PLRX


text: Our risk management program is designed to identify, assess, and mitigate risks across various aspects of the Company, including financial, operational, regulatory, reputational, and legal. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential of cyber threats. Our Chief Information Officer is primarily responsible for this cybersecurity component and is a key member of Bank management, reporting directly to the Chief Operating Officer and, as discussed below, periodically to the Bank Board.

companyName: PEOPLES BANCORP OF NORTH CAROLINA INC

ticker: PEBK


text: As part of the Company's information security training program, all employees participate in various cybersecurity awareness activities, including an annual Information Security Awareness training module and monthly simulated phishing events.

companyName: Air Products & Chemicals, Inc.

ticker: APD


text: To further strengthen our cybersecurity efforts, with our subsidiary's assistance, we are establishing an "IT Steering Committee" composed of IT professionals from our subsidiary. This committee will meet quarterly to discuss cybersecurity threats, emerging attack methods, and best practices.

companyName: ALT5 Sigma Corp

ticker: ALTS


text: Although risks from cyber threats have not materially affected the Fund's business strategy, results of operations or financial condition as of December 31, 2024, Invesco continues to closely monitor cyber risk. In addition, security controls, no matter how well designed or implemented, may only mitigate and not fully eliminate risks. For more information regarding the risks we face from cybersecurity threats, please see "Due to the Increased Use of Technologies, Intentional and Unintentional Cyber Attacks Pose Operational and Information Security Risks" in Item 1A. Risk Factors.

companyName: Invesco DB Multi-Sector Commodity Trust


text: Our information security organization, led by our Chief Information Officer (our "CIO") who reports to our Chief Financial Officer (our "CFO"), is comprised of both I.T. security leadership and dedicated cybersecurity staff.

companyName: Freshpet, Inc.

ticker: FRPT


text: As noted in Item 1A. Risk Factors, FMC recognizes that the threat of cybersecurity breaches may create significant risks for the Company. Accordingly, we are committed to an ongoing and comprehensive program to protect all company data, as well as data in our supply chain, from these threats. Our cybersecurity program includes governance defined by IT policies and standards and a robust IT risk management program. FMC uses several tools and controls to manage IT risk including, but not limited to, controls for the management of privileged access, anti-malware tools, required trainings for employees including an annual training module, simulated email phishing attacks, and other email security tools to detect and prevent intrusions as well as monitor threats. FMC employees have access to formal IT policies that define and clarify expected behaviors with respect to IT resources in various areas. The Company has a Cyber Incident Response Plan, which establishes procedures to prepare for and respond to a variety of cyber incidents, and engages in response planning, simulations, trainings, tabletop exercises, and other efforts to mitigate risk and prepare for a rapid response to any incidents should they occur. FMC performs a thorough security review prior to onboarding critical third-party providers, which includes review of third-party independent assessments in the form of SOC reports prior to contracting. SOC reports are also reviewed on an annual basis once the third-party is engaged. Additionally, our contracts with third-party providers require those organizations to notify FMC of any cyber incident that occurs when our information has been impacted.

companyName: FMC CORP

ticker: FMC


text: Our Board and its committees have an active role in overseeing risk management and they have delegated to the Audit and Risk Committee oversight over our cybersecurity and data privacy risks, including oversight of management's implementation of our Cybersecurity and Privacy Programs, except to the extent direct oversight by the Board is required by the FTC Order. The Audit and Risk Committee oversees management's implementation of our Cybersecurity and Privacy Programs, except to the extent direct oversight by the Board is required by the FTC Order.

companyName: GoodRx Holdings, Inc.

ticker: GDRX


text: Morgan Stanley's processes are designed to help oversee, identify, and mitigate cybersecurity risks associated with its use of third-party vendors, including those vendors relied upon by the Company. Morgan Stanley maintains a third-party risk management program that includes evaluation of, and response to, cybersecurity risks at its third-party vendors, including those vendors relied upon by the Company. Prior to engaging third-party vendors to provide services to the Firm or the Company, Morgan Stanley conducts assessments of the third-party vendors' cybersecurity program to identify the impact of their services on the cybersecurity risks to the Firm or, as relevant, the Company. Once on-boarded, third-party vendors' cybersecurity programs are subject to risk-based oversight, which may include security questionnaires, submission of independent security audit reports or a Firm audit of the third-party vendor's security program, and, with limited exceptions, third-party vendors are required to meet Morgan Stanley's minimum cybersecurity standards. Where a third-party vendor cannot meet those standards, its services, and the residual risk to the Firm, are subject to review, challenge, and escalation through Morgan Stanley's risk management processes and ERM committees, which may ultimately result in requesting increased security measures or ceasing engagement with such third-party vendor.

companyName: Morgan Stanley Direct Lending Fund

ticker: MSDL


text: Cybersecurity incident" means an unauthorized occurrence, or a series of related unauthorized occurrences, on or conducted through our information systems that jeopardizes the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: FOXO TECHNOLOGIES INC.

ticker: FOXO


text: Each operating segment oversees and manages their own risk monitoring and mitigation processes in order to ensure segment-specific risks are properly identified and addressed.

companyName: ENDI Corp.

ticker: ENDI


text: Risk Management and Strategy have established processes to assess, identify, and manage cybersecurity risks. These processes are integrated into our overall risk management program and are designed to protect our information assets from internal and external cyber threats and include: implementing physical, procedural, and technical safeguards; developing and maintaining comprehensive response plans;

companyName: Processa Pharmaceuticals, Inc.

ticker: PCSA


text: The Company is dedicated to upholding strong cybersecurity measures to protect its operations, data, and stakeholders' interests. By keeping a close eye on the cybersecurity landscape, the Company is able to adjust its strategies and governance practices to minimize risks in this rapidly changing area.

companyName: SCHOLASTIC CORP

ticker: SCHL


text: As part of our overall cybersecurity protection program, we have created a cross-functional cybersecurity team consisting of senior members of information technology, legal, accounting, internal audit and compliance teams (the "Incident Response Team") that contributes to various aspects of our approach to managing cybersecurity risks. Our senior information technology leaders who are members of the Incident Response Team have experience and domain expertise in cybersecurity, including defining and implementing security policies and tools, understanding and evaluating relevant threats to our technology infrastructure as well as developing incident response protocols and security operations workflows. We also incorporate third-party expertise in various aspects of our cybersecurity program, including in the assessment and testing of weaknesses as well as the adoption of software and other solutions to mitigate risks and identify and respond to threats. Our Incident Response Team is involved in all aspects of our program to address cybersecurity matters, including with respect to the design and management of internal controls and procedures governing these matters.

companyName: RH

ticker: RH


text: The Board is aware of the critical nature of managing risks associated with cybersecurity threats given the significance of these threats to our operational integrity and stakeholder confidence. As such, the Board engages with our management team, as necessary, for updates on our cybersecurity risk program and progress on remediation efforts.

companyName: Atlas Energy Solutions Inc.

ticker: AESI


text: Risk identification is managed through Information Technology ("IT") programs and service providers that specialize in identifying such risks, employee training, and information security policies. We utilize third-party monitoring services that monitor our vendor relationships for cybersecurity-related issues as well as a third party for vulnerability scanning and monitoring of our environments. The cybersecurity team annually conducts internal and external penetration testing with outside third-party cybersecurity experts. Employee training programs reinforce our information security policies, standards and practices, as well as the expectation that employees comply with these policies. We also train employees on how to identify potential cybersecurity risks and protect our resources and information. Training is mandatory for all relevant employees, on a periodic basis, and is supplemented by company-wide testing initiatives, including periodic phishing tests. We also require relevant employees to take periodic awareness training on data privacy, which includes information about pertinent laws, confidentiality, and security, as well as how to effectively report and respond to unauthorized access to or use of personal information Risk Management

companyName: Vista Outdoor Inc.


text: Our Cybersecurity Incident Response Plan ("Response Plan") provides a framework for responding to cybersecurity incidents. The Response Plan governs activities such as preparation, detection, coordination, eradication, recovery, and appropriate escalations to the Company's senior management, disclosure committee, Board, and relevant Board committees. The Response Plan is routinely reviewed and updated as appropriate under the leadership of our Chief Information Security Officer (CISO).

companyName: MCKESSON CORP

ticker: MCK


text: Our Board of Directors has established governance protocol over risk management, including general oversight of information technology security and cybersecurity risk. The Audit Committee is central to the Board's oversight of cybersecurity risks and is primarily responsible for this domain. The Audit Committee actively participates in discussions with management, external experts, and amongst themselves regarding cybersecurity risks. The Audit Committee is comprised of Board members with broad expertise, including technology, risk management and finance, enabling them to effectively oversee and govern cybersecurity risks. One Audit Committee member is certified under the National Association of Corporate Directors Certificate in Cyber-Risk Oversight Program.

companyName: ROCKY BRANDS, INC.

ticker: RCKY


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, like other companies in our industry, we and our third-party vendors have from time to time experienced threats and security incidents. For more information, please see the section entitled "Risk Factors."

companyName: Scholar Rock Holding Corp

ticker: SRRK


text: Several members of the Board comprise the Risk Management Committee (RMC), which is responsible, among other things, for oversight of cybersecurity risks based on the authority given by our Board of Directors. The RMC receives regular updates at least quarterly from management, including our Chief Information Officer (CIO) and our Information Security Officer (ISO) with evaluations of cyber risk, the threat environment, updates on incidents, and advancements on investments in cybersecurity risk reduction. Our CIO has been with the Company since January 2021 and has over 25 years of global experience. He has served in numerous senior leadership positions where he gained significant cybersecurity and risk management experience across multiple high-tech industries. Our ISO has been with the Company since July 2018 and similarly has over 25 years of extensive cybersecurity, risk and compliance experience including CISSP and CISM certifications.

companyName: OSI SYSTEMS INC

ticker: OSIS


text: We have made substantial investments in cybersecurity risk management, and it is an integral part of our overall enterprise risk management program. We have implemented a variety of tools and a process designed to identify, monitor, evaluate and respond to cybersecurity threats and incidents, including those associated with our use of third-party vendors and service providers. Our process consists of steps for identifying the source of a cybersecurity threat or incident, including whether such cybersecurity threat or incident is associated with a third-party vendor or service provider; implementing cybersecurity countermeasures and mitigation strategies, and informing management and our board of directors of potentially material cybersecurity threats and incidents or other significant changes in the evolving cybersecurity threat landscape. We intend to continue to make substantial investments in cybersecurity risk management to improve our tools and processes because the cybersecurity threat continues to evolve. While we continue to invest in our infrastructure environment and monitoring capability, and in due diligence with respect to the third parties with whom we interact, there can be no assurance that we can prevent, mitigate, or remediate the risk of any compromise or failure in the cybersecurity infrastructure owned or controlled by us or any third-party vendor or service providers that we use.

companyName: AstroNova, Inc.

ticker: ALOT


text: Cybersecurity threats, including any previous cybersecurity incidents, have not materially affected or are reasonably likely to affect us, including its business strategy, results of operations or financial condition.

companyName: Third Harmonic Bio, Inc.


text: We apply a risk-based approach to managing cybersecurity risks posed by third parties, including vendors, contract research organizations, service providers and other external users of the our systems. This also includes assessing and overseeing risks related to third-party systems that, if compromised, could negatively impact our business operations.

companyName: Pluri Inc.

ticker: PLUR


text: In today's digital age, the security and integrity of our information systems are of paramount importance. As a company, we understand the need to protect the confidentiality, availability and integrity of our data. This disclosure aims to provide an overview of our approach to cybersecurity and the potential risks and threats we face.

companyName: STERLING INFRASTRUCTURE, INC.

ticker: STRL


text: Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations, or financial condition, but we face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to have such an affect. See Part I, Item 1A, "Risk Factors," under the heading "Risks Related to Our Operations - Our business could be negatively impacted by security threats, including cybersecurity threats and other disruptions" for more information regarding the risks we face.

companyName: Civeo Corp

ticker: CVEO


text: We also rely on threat intelligence and other information obtained from governmental, public, or private sources, including external consultants engaged by us for strategic cyber risk management, advisory and decision making.

companyName: Protara Therapeutics, Inc.

ticker: TARA


text: Our cybersecurity risk management team, in conjunction with various information technology, internal audit, legal and compliance personnel, has primary responsibility for our overall cybersecurity risk management program.

companyName: Associated Capital Group, Inc.

ticker: ACGP


text: Our management team, including our Chief Technology Officer ("CTO") and Senior Director of Information Security, are responsible for assessing and managing our material risks from cybersecurity threats, and our Chief Financial Officer and General Counsel are responsible for associated materiality assessments. Our CTO and cybersecurity team have primary responsibility for our overall cybersecurity risk management program and supervise both our internal cybersecurity personnel and our retained external cybersecurity consultants. Their experience includes decades spent managing the security programs of publicly traded corporations, formal cybersecurity education programs from accredited academic institutions, and numerous security certifications such as CISSP, CCSP, CySA+ and AWS Architect & Security Specializations.

companyName: Warby Parker Inc.

ticker: WRBY


text: Risks from Cybersecurity Threats As of the date of this report, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition; however, see Item IA. Risk Factors in Part I of this Annual Report on Form 10-K for a discussion of effects that a cybersecurity threat or incident could have on our business strategy, results of operations or financial condition. We also maintain an incident response plan to respond to any cybersecurity incident. This plan outlines the steps we will take to respond to an incident, including identifying and containing the incident, eradicating the threat, recovering our systems and communicating with relevant stakeholders.

companyName: Frontdoor, Inc.

ticker: FTDR


text: Certain members of our management team are responsible for hiring appropriate employees and consultants, helping to integrate cybersecurity risk considerations into our overall risk management strategy, communicating key priorities to relevant personnel, approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: BOSTON OMAHA Corp

ticker: BOC


text: Cybersecurity Incidents As previously disclosed in Item 2. Management's Discussion and Analysis of Financial Condition and Results of Operations— Macroeconomic, Industry and Regulatory Trends — Cybersecurity Event in our Form 10-Q for the quarter ended June 30, 2023, Jackson determined that its information at one of our third-party vendors, Pension Benefit Information, LLC ("PBI"), was impacted by a cybersecurity breach involving Progress Software Corporation's MOVEit Transfer software. The PBI service helps Jackson to identify possible beneficiaries for death benefits. According to PBI, an unknown actor exploited a MOVEit software flaw to access PBI's systems and download certain data. Our assessment indicated that personally identifiable information relating to approximately 850,000 of Jackson's customers was obtained by that unknown actor from PBI's systems. PBI informed Jackson that it rectified the MOVEit vulnerability.

companyName: Jackson Financial Inc.

ticker: JXN


text: Preparation and Prevention We utilize a variety of tools, processes, software, and hardware that are managed and monitored by our IT resources including third-party vendors, as applicable, to prevent and prepare for cybersecurity threats. We conduct regular internal and external security audits and vulnerability assessments to reduce the risk of a cybersecurity incident and we implement business continuity, contingency, and recovery plans to mitigate the impact of an incident. As part of these efforts, we engage a third party to conduct periodic penetration testing and an external review of our vulnerabilities. We continue to strengthen access management mechanisms including broad adoption of multi-factor authentication, geolocation-based blocking, and network segmentation. To support our preparedness, we perform tabletop exercises at least once a year to test our CSIRP.

companyName: Brixmor Property Group Inc.

ticker: BRX


text: Board and Management's Role and Expertise and Oversight of Risk Management and Strategy Our information technology ("IT") department, which maintains our cybersecurity function, is led by our SVP, Chief Information Officer ("CIO"), who reports directly to our Chief Executive Officer, and has over 25 years of broad IT and digital transformation experience leading large technology organizations and product teams with expertise in IT organizational leadership, network and cloud infrastructure, and enterprise engineering and technology. Our VP, Chief Information Security Officer ("CISO") reports directly to the CIO, and is responsible for managing our risks from cybersecurity threats, protecting and defending our networks and systems, and overseeing our Information Security Office. Our CISO has over 20 years of experience leading cybersecurity and information security departments and manages a team of professionals who have broad industry experience and expertise, including disaster recovery, IT risk management, detection and mitigation technologies, incident response, threat management, and regulatory compliance, and who hold industry recognized certifications, such as the Certified Information Systems Security Professional and Certified Risk and Information Systems Control.

companyName: BRIGHT HORIZONS FAMILY SOLUTIONS INC.

ticker: BFAM


text: Management's Roles and Responsibilities In collaboration with the ERM team and the Audit Committee, the Company's Information Security Team, overseen by the CISO, is responsible for assessing and managing cybersecurity risks including the prevention, mitigation, detection, and remediation of cybersecurity incidents. The Information Security Team is comprised of various Technology groups with the knowledge and expertise needed to execute the technical aspect of the Incident Response Plan. This team is led by the CISO and other technical leaders with significant experience in the information security field. The CISO has over 19 years of experience serving as a CISO and in other security leadership positions in the information security and cybersecurity fields, including roles as VP of Enterprise Technology, VP of Information Security, Director of Infrastructure and Cybersecurity, Director of Information Security, and Manager of Information Security. In addition to his work experience, the CISO holds a certification as a Certified Information System Security Professional (CISSP). The CISO works closely with other management positions, including the Chief Accounting Officer, Chief Information Officer, Chief Audit Officer, General Counsel, and VP of Investor Relations through the Cybersecurity Incident Committee in order to ensure that the Company has effective communication and understanding of its cybersecurity risk management.

companyName: ModivCare Inc

ticker: MODVQ


text: We have an Information Technology Policy that sets parameters for the use, privacy, security, retention, and disposal of our information and other assets. We also have an Incident Response Policy which sets forth the steps for assessment, containment, and disclosure of cybersecurity threats. These policies were prepared using relevant guidance and technology standards and are reviewed periodically.

companyName: Lineage Cell Therapeutics, Inc.

ticker: LCTX


text: In the event of a material cybersecurity incident or investigation, management will, in compliance with escalation protocols in place, promptly report to the Audit Committee and the Board, as appropriate, in accordance with the Company's incident response plan, and other policies and determine the timing of action, and necessary response.

companyName: Quipt Home Medical Corp.

ticker: QIPT


text: Our CISO is primarily responsible for the assessment and management of the Company's material cybersecurity risks and the related cybersecurity risk management policies and procedures. Our CISO oversees our cybersecurity risk management and information security programs and provides quarterly status reports to the Audit Committee. Our CISO possesses over 25 years of experience in various technology and cybersecurity operations, holds the following certifications from ISC2, Information Systems Security Management Professional (ISSMP), Certified Information Systems Security Professional (CISSP), Certified Cloud Security Professional (CCSP), Certified in Governance, Risk and Compliance (CGRC) as well as ISACA certifications of Certified Information Security Manager (CISM) and Certified in Risk and Information Systems Control (CRISC). Other key members of management assist our CISO in the oversight of cybersecurity risk management.

companyName: Maiden Holdings, Ltd.

ticker: MHLA


text: Depending on their nature, incidents may also be reported to the Risk Committee (as defined below) or the board of directors of 26North, as well as to our Chief Compliance Officer, the Audit Committee of our Board of Directors and to our full Board of Directors, if appropriate.

companyName: 26North BDC, Inc.


text: Our cybersecurity risk management program includes, among other key features: • regular cybersecurity risk assessments; • detection and reporting of any cybersecurity events; • independent strategy consultation on enhancement items and processes for cybersecurity tabletop exercises; • robust information security training program that includes annual information security training for all associates, as well as additional role-specific information security training; and • cyber incident response plan that provides controls and procedures for timely and accurate reporting of any material cybersecurity incident to executive leadership and our board of directors.

companyName: Invitation Homes Inc.

ticker: INVH


text: Communication, Coordination and Disclosure: The Company promotes awareness and surveillance over cybersecurity risk at all levels of the organization, including staff, senior management and the Board.

companyName: Farmland Partners Inc.

ticker: FPI


text: Risk Management and Strategy Assessing, identifying, and managing cybersecurity related risks are integrated into our overall Enterprise Risk framework, of which one of the objectives is to ensure the confidentiality, integrity, and availability of our information sets through the maintenance of a comprehensive information security program. The program ensures regulatory compliance in alignment with Federal Financial Institutions Examination Council, the Sarbanes-Oxley Act of 2002, and the Gramm-Leach-Bliley Act. One of the key aspects of this program is a risk assessment that is used to identify industry and company-specific risks, measure control effectiveness, identify any gaps that need to be addressed, and linking our controls with applicable policies, standards and guidelines to ensure that responsible parties are aware of their obligations with respect to this program.

companyName: BANK OF HAWAII CORP

ticker: BOH


text: The Company, its management and its Board understand the critical importance of cybersecurity in maintaining the trust, confidence and support of customers, employees, and other stakeholders. The Company, as a supplier of products of critical digital infrastructure technologies to our customers, is reliant on technology and information systems that may comprise part of the products we sell or the services that we provide. As a worldwide business, we have also become increasingly dependent on digital technologies, including information systems, infrastructure and cloud applications and services, to operate our businesses, process and record financial and operating data (including processing customer orders, shipping products, billing our customers, and tracking inventory), communicate with our employees and business partners, and perform other activities related to our businesses. Our evolution into smart products, Internet of Things, business-to-consumer, and e-commerce subjects us to increased cyber and technology risks. The secure operation of our information technology systems and networks and ensuring that we have skilled personnel to assist in ensuring their continued security is critical to our business operations and strategy.

companyName: Vertiv Holdings Co

ticker: VRT


text: To stay ahead of potential cybersecurity challenges, the Company has established a formal process. This process is activated whenever the FFIEC CAT or the ISSC identifies changes in inherent risks. In response, the Company proactively updates its cybersecurity objectives, policies, and tactical goals. This ensures that the Company's cybersecurity strategy remains responsive, continuously adapting to emerging threats and evolving industry standards.

companyName: Sound Financial Bancorp, Inc.

ticker: SFBC


text: In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. In June 2022, ETI experienced a previously disclosed network security incident which had material adverse impact and required ETI to, among other things, limit access to its applications and services by its employees and customers. In response, ETI incurred considerable costs to restore the security of its internal systems and networks and adopted various enhancements. If we were to experience a material cybersecurity incident in the future, such incident may have a material effect, including on our business strategy, operating results or financial condition. Please refer to " Item 1A. Risk Factors " for further information about the material risks associated with various cybersecurity threats.

companyName: XBP Global Holdings, Inc.

ticker: XBP


text: Any material cybersecurity incidents. In addition to these scheduled meetings, the Technology Committee, the CISO, the CDO, the CRO, and other members of management maintain ongoing dialogues with respect to emerging or potential cybersecurity threats. The Technology Committee also receives reports and updates from management regarding significant cybersecurity developments so that the Board of Directors can be promptly notified, as and when appropriate, of any threats or incidents as well as management's proposed responses.

companyName: Metropolitan Bank Holding Corp.

ticker: MCB


text: We rely on the integrity and availability of our information technology ("IT") systems, as well as those of certain third-party service providers, to support our operations and safeguard sensitive information. These systems may store or process confidential business data, intellectual property, financial records, and personal information.

companyName: NightFood Holdings, Inc.

ticker: NGTF


text: Processes for assessing, identifying, and managing material risks from cybersecurity threats Morgan Stanley's Cybersecurity Program takes into account industry best practices and addresses risks from cybersecurity threats to the Firm's network, infrastructure, computing environment, and the third-parties Morgan Stanley relies on, including third parties relied on by the Company. Morgan Stanley periodically assesses the design of its cybersecurity controls against the Cyber Risk Institute Cyber Profile, which is based on the National Institute of Standards and Technology Cybersecurity ("NIST") Framework for Improving Critical Infrastructure Cybersecurity, as well as against global cybersecurity regulations, and develops improvements to those controls in response to those assessments. Morgan Stanley's Cybersecurity Program also includes cybersecurity and information security policies, procedures, and technologies that are designed to address regulatory requirements and protect Morgan Stanley's clients', employees' and own data, and the data of the Company and its officers and stockholders, against unauthorized disclosure, modification, and misuse. These policies, procedures, and technologies cover a broad range of areas, including: identification of internal and external threats, access control, data security, protective controls, detection of malicious or unauthorized activity, incident response, and recovery planning.

companyName: Morgan Stanley Direct Lending Fund

ticker: MSDL


text: Our cybersecurity program is overseen by our Executive team comprising of the Executive Vice President and the Chief Financial Officer. An experienced information technology personnel identifying, assessing, monitoring, managing and communicating the Company's cybersecurity risks. In the event of a cybersecurity threat, the IT personnel assesses the threat and determines the course of action to eliminate the threat. Depending on the circumstances, such threat is communicated to the executive team and if warranted to the Audit Committee for further action.

companyName: Envirotech Vehicles, Inc.

ticker: EVTV


text: Key elements of our cybersecurity risk management program include but are not limited to the following: • risk assessments are performed and designed to help identify material risks from cybersecurity threats to our critical systems and information; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers or third party software, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, including incident response personnel; • an incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party vendor risk management process for key service providers based on the security teams assessment of their criticality to our operations and respective risk profile.

companyName: Ceribell, Inc.

ticker: CBLL


text: Role of management Our Chief Information Security Officer is responsible for the day-to-day management of our cybersecurity risks. To ensure robust oversight, we have established a Security Council comprising senior leaders, including our Chief Executive Officer, Chief Operating Officer, Chief Information Security Officer, Chief Financial Officer, General Counsel and Chief Privacy Officer. The Security Counsel meets on at least a quarterly basis to review cybersecurity and information security matters. The Security Council has primary management oversight responsibility for assessing and managing risks related to information security, fraud, vendor oversight, data protection and privacy, and cybersecurity.

companyName: SIRIUS XM HOLDINGS INC.

ticker: SIRI


text: The shared services cybersecurity program is managed by a team of full-time Energy Transfer employees, overseen by its Chief Information Officer, that are tasked with conducting day-to-day information technology ("IT") operations (collectively, the "Energy Transfer IT team"). This program includes processes that are modeled after the National Institute of Standards and Technology's Cybersecurity Framework and focuses on using business drivers to guide cybersecurity activities. In creating and implementing this cybersecurity program, the Energy Transfer IT team engages with the guidance of the Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), Transportation Security Administration (TSA) and the U.S. Coast Guard (USCG). The shared services cybersecurity program seeks to use a defense-in-depth approach for cybersecurity management, layers of technology, policies and training at all levels of the enterprise designed to keep our assets secure and operational. It uses various processes as part of its efforts to maintain the confidentiality, integrity and availability of our systems, including security threat intelligence, incident response, identity and access management, supply-chain security assessments, endpoint extended detection and response protection, network segmentation, data encryption, event monitoring and a Security Operations Center (SOC).

companyName: USA Compression Partners, LP

ticker: USAC


text: The cybersecurity risk assessment process is part of the Company's overall risk management process. Our cybersecurity partner helps us prioritize actions to improve compliance with CIS Critical Security Controls and assists with those actions. The Company also utilizes other third-party consultants and services in our process of assessing and managing cybersecurity risk for a diverse perspective of our cybersecurity practices and posture. To mitigate the risk of cybersecurity threats related to the use of third-party service providers, the Company obtains and reviews SOC reports from third parties when available, to provide assurance that the third-party has appropriate controls in place and has not identified any significant cyber issues. The Company does not believe that any risks from cybersecurity threats have materially affected or are reasonably likely to affect our business strategy, results of operations, or financial condition. See Item 1A "Risk Factors" for a summary of certain cybersecurity risks.

companyName: UFP TECHNOLOGIES INC

ticker: UFPT


text: The Sr. Director, IT holds a chief information security officer certification from Heinze College at Carnegie Mellon and has over 15 years of cybersecurity experience. The Company has not experienced a material information security breach in the last three years. The Company has not experienced a material third-party information security breach.

companyName: WABASH NATIONAL Corp

ticker: WNC


text: Risk Management, Strategy, and Governance A dedicated, outsourced Chief Information Officer, in collaboration with outside cybersecurity partners, is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. Qualified third-party service providers are tasked with developing, implementing, and executing that strategy. These third parties play a key role in our cybersecurity risk assessment and management processes as we rely on their cybersecurity experience and expertise to assess, identify, and manage emerging trends and risks from cybersecurity threats on an ongoing basis.

companyName: Laird Superfood, Inc.

ticker: LSF


text: Our Board considers cybersecurity risk as a part of its overall risk oversight function. Our Board receives reports from our VP of IT at least bi-annually, and on an as-needed basis, on cybersecurity risks and actions taken to mitigate those risks. These reports include updates on our cybersecurity risks, the emerging threat environment, and the status of projects designed to enhance our information security systems and programs.

companyName: Natural Grocers by Vitamin Cottage, Inc.

ticker: NGVC


text: Our cybersecurity risk management program includes the following: • An ongoing process of identifying, evaluating and addressing our cybersecurity threats; • A security team responsible for managing our cybersecurity risk, assessment processes, security controls and responses for security breaches and cyberattacks • The use of external service providers, where appropriate, to assess, perform tabletop exercises, or otherwise assist with aspects of our security controls designed to anticipate cyberattacks and respond to breaches. Procedures include annual internal vulnerability scans and external penetration tests; • Regular cybersecurity awareness training for all employees to provide a better understanding of the issues and risks related to cybersecurity and data privacy. We realize that cybersecurity is not just the job of the IT security team; the Company and all employees play a critical role in managing the risk; • Phishing and other exercises performed by our IT department periodically throughout the year to test our systems and reinforce the training provided to all personnel • A cybersecurity incident response plan managed by our VP of IT/CISO, which includes procedures for responding to cybersecurity incidents and is designed to protect and preserve the confidentiality, integrity and continued availability of information possessed by the Company • A third-party cybersecurity risk management process for service providers, suppliers and vendors performed throughout the year.

companyName: Prestige Consumer Healthcare Inc.

ticker: PBH


text: The Company's Co-Chief Information Officers are the members of the Company's management principally responsible for overseeing the Company's cybersecurity risk management program, in partnership with other business leaders across the Company. The Co-Chief Information Officers work in coordination with the other members of the IRT, which includes our Co-Chief Information Officers, our Chief Operating Officer, and their designees. The Company's Co-Chief Information Officers have each served in various roles in information technology and information security for over 30 years, including in leadership positions with both small and large companies. The Co-Chief Information Security Officers each have extensive knowledge in technology and cybersecurity. The Company's President and interim Chief Financial Officer, Chief Operating Officer, and Chief Compliance Officer each hold undergraduate, and, in some cases, graduate, degrees in their respective fields, and each have over 20 years of experience with managing risks at the Company and in environments similar to the Company's, including risks arising from cybersecurity threats.

companyName: TriLinc Global Impact Fund LLC

ticker: TRLC


text: A key part of our strategy for managing risks from cybersecurity threats is the ongoing assessment and testing of our processes and practices through auditing, assessments, tabletop exercises, threat modeling, penetration and vulnerability testing and other assessments and exercises focused on evaluating the effectiveness of our cybersecurity measures. We regularly engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Audit Committee and the Board, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by the assessments, audits and reviews.

companyName: U.S. SILICA HOLDINGS, INC.


text: Cybersecurity Risks. We have not experienced any material cybersecurity incidents in the past fiscal year. We face risks from cybersecurity threats that, if realized, may materially affect our business strategy, results of operations or financial condition. Despite our efforts, we cannot provide full assurance that our cybersecurity risk management processes will be fully implemented, complied with or effective in preventing or mitigating future cybersecurity risks. We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or, if realized, are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, in Part I, Item 1A. "Risk Factors".

companyName: HOME DEPOT, INC.

ticker: HD


text: Our Chief Financial Officer and Senior Director, Information Technology oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The processes by which o ur Chief Financial Officer and Senior Director, Information Technology are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents include company incident management and data protection policies, and applicable cybersecurity incident response playbooks.

companyName: Whitehawk Therapeutics, Inc.

ticker: WHWK


text: Strategy and Program We identify and assess material risks from cybersecurity threats predominantly through the work of our Information Security ("InfoSec") team as part of our enterprise risk management ("ERM") process. Our ERM process is designed to identify and evaluate the full range of significant risks to Comtech. As part of our ERM program, our functional and operations departments identify and manage enterprise risks on an annual cycle. The process consists of structured reviews, discussions, and mitigation planning, and includes risks identified by our cybersecurity functions.

companyName: COMTECH TELECOMMUNICATIONS CORP /DE/

ticker: CMTL


text: Monitor Cybersecurity Incidents The IT Steering Committee, which is a subcommittee of the ERMC, established the Information Technology and Information Security Working Group (the "IT/IS Working Group"), which is comprised of the CDO, the Head of Information Technology Infrastructure, the CISO, the Information Security Officer, the Information Security Assurance Program Manager and certain other members of the Company's information technology engineering staff. The mission of the IT/IS Working Group is to foster the sharing of information among departments regarding existing and emerging threats and risks related to cybersecurity and related compliance issues in order to better integrate cybersecurity risk management and increase awareness of cybersecurity threats throughout the Company. This group meets on a weekly basis to discuss, among other things, vulnerability management, threat and risk analysis and the status of our continued enhancements to the Company's information security infrastructure that are intended to further manage and mitigate future risks.

companyName: Metropolitan Bank Holding Corp.


text: We also have processes in place to oversee and identify material risks from cybersecurity threats associated with our use of third-party service providers. These processes include a review of vendors against cybersecurity-focused criteria through our vendor due diligence process, as well as a policy which mandates the inclusion of certain security-related clauses and provisions in our contracts with vendors and suppliers. We also conduct ongoing monitoring and assurance processes, including assessments, to ensure compliance with applicable security-related contractual provisions and other requirements.

companyName: StoneX Group Inc.

ticker: SNEX


text: Our program to manage and mitigate cybersecurity risks involves actively monitoring our systems for potential threats, including frequent reviews of threat-intelligence feeds, proactive security assessments, use of third-party software tools, and regular penetration tests to identify potential weaknesses. Our incident response plans are integral to our overall crisis management framework. In the event of a cybersecurity incident, our team follows an incident response plan that includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.

companyName: Snap One Holdings Corp.


text: The Audit Committee is central to the Board's oversight of cybersecurity risks and has been delegated responsibility for assessing and managing such risks. The Audit Committee members have diverse expertise in risk management, technology and finance, equipping them to oversee cybersecurity risks effectively.

companyName: ZimVie Inc.


text: ZIONS BANCORPORATION, NATIONAL ASSOCIATION AND SUBSIDIARIES Cybersecurity risk is overseen by the Board and the Bank's multiple lines of defense, including front-line bankers, operations teams, Enterprise Risk Management ("ERM"), and internal audit. Information security risk is managed in accordance with an established ERM framework, which includes elements such as key risk indicators, enterprise standards, controls, and self-assessments that comply with established ERM policies. These elements are regularly assessed, measured, and reported to Board-level and Bank senior management-level risk committees, and those committees review such reports.

companyName: ZIONS BANCORPORATION, NATIONAL ASSOCIATION /UT/

ticker: ZION


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also regularly receives briefings from management on our cyber risk management program, as well as presentations on cybersecurity topics from our Vice President of Technology Support, internal security staff, or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: PACS Group, Inc.

ticker: PACS


text: Recognizing the complexity and evolving nature of cybersecurity threats, the Company also engages with a range of external experts, including cybersecurity assessors, consultants, and auditors in evaluating and testing its risk management systems. These partnerships enable the Company to leverage specialized knowledge and insights, ensuring its cybersecurity strategies and processes remain at the forefront of industry best practices. The Company's collaboration with these third parties includes regular audits, testing, threat assessments and consultation on security enhancements.

companyName: FirstCash Holdings, Inc.

ticker: FCFS


text: These measures include system monitoring, employee cybersecurity awareness practices, and engagement of external information technology consultants, assessors, or service providers, as deemed necessary, to review and enhance security controls.

companyName: Hartford Creative Group, Inc.

ticker: HFUS


text: Okta's board oversees Okta's enterprise risk management program, of which cybersecurity is a critical component. To facilitate the board's supervision of cybersecurity matters, the board formed a cybersecurity risk committee. Among other responsibilities, the cybersecurity risk committee oversees Okta's cybersecurity program.

companyName: Okta, Inc.

ticker: OKTA


text: Our Chief Information Officer, who has information technology, engineering, product and security knowledge, experience and skills gained over a decade of experience leading product and engineering organizations, and certain members of his team as well as outside advisors who have cybersecurity experience are responsible for implementing and maintaining cybersecurity and data protection practices at the Company and reporting on cybersecurity matters to the relevant members of management. This team is supported, from time to time, by third-party consultants and service providers with specific areas of cybersecurity expertise. Management is responsible for identifying, assessing and managing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures, and maintaining cybersecurity policies and procedures. Management also regularly communicates cybersecurity risks and activities with other members of management and, as appropriate, to our Board or relevant members or committees thereof, including the Audit Committee.

companyName: Rush Street Interactive, Inc.

ticker: RSI


text: Cyber threats are considered one of the most significant risks facing financial institutions. Since our company is externally managed, we rely upon the operational and investment risk oversight functions of our Adviser and its affiliates. To mitigate risk from cyber threats, our Adviser has a designated Global Chief Security Officer ("GCSO") who leads the global security department that is responsible for identifying, assessing, and managing cybersecurity threats. The GCSO has experience in the public and private sectors, specializing in security, investigations, and incident response. The global security department oversees the following groups across Invesco: Information Security, Global Privacy, Business Continuity & Crisis Management, Resilience, and Corporate Security. This converged security structure supports a more comprehensive, holistic approach to keeping our and Invesco clients, employees, and critical assets safe, upholding privacy rights, while enabling a secure and resilient business.

companyName: Invesco Commercial Real Estate Finance Trust, Inc.


text: Cyber security is also a responsibility of all LiveRamp employees. All employees must undergo annual security awareness training, which covers topics including, but not limited to, phishing, incident reporting, insider threat, and LiveRamp's Security and Acceptable Use policies.

companyName: LiveRamp Holdings, Inc.

ticker: RAMP


text: The Company is not aware of any cybersecurity threats or incidents to date that have materially affected its strategy, results of operations, or financial condition. However, the scope and impact of any future cybersecurity incident cannot be predicted with certainty. More information on how material cybersecurity attacks may impact the Company's business is provided in "Item 1A. Risk Factors ".

companyName: IMAX CORP

ticker: IMAX


text: Our CISO is responsible for updating the Audit Committee on cybersecurity risks and the processes and procedures that Company management has put in place to seek to mitigate these risks. At least twice each year, our CISO provides updates to the Audit Committee on cybersecurity risks, incidents and incident resolution. The Audit Committee also discusses at least annually with the CISO regarding the status of the Company's IT policies, procedures, disaster recovery plans and other security issues. In addition, reports describing known cybersecurity threats are delivered to our executive leadership team on a monthly basis and general updates relating to our cybersecurity systems are delivered to our executive leadership team on a bi-monthly basis. Monthly cybersecurity reviews are also undertaken with our IT leadership team to discuss actionable cybersecurity issues. In addition to our scheduled meetings, the Audit Committee, CISO and other senior members of management maintain an ongoing and active dialogue regarding emerging or potential cybersecurity risks. The Audit Committee actively participates in strategic decisions related to cybersecurity, offering oversight and approval for major initiatives. This involvement ensures that cybersecurity considerations are integrated into the broader strategic objectives of the Company. This oversight review by our Audit Committee helps in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with the overall risk management framework. In addition, we require all Company associates to complete mandatory cybersecurity awareness and information handling training at the time of hiring and on an annual basis.

companyName: Integer Holdings Corp

ticker: ITGR


text: Peoples also has a third-party risk management program pursuant to which Peoples performs annual reviews of third-party vendors as to their cybersecurity and business continuity capabilities to ensure they meet the stated requirements and the risk appetite of Peoples as documented in Peoples' information security policy. Vendors not meeting Peoples' risk requirements are notified of necessary improvements and, if the vendors cannot mitigate the identified risks, Peoples looks to identify alternative vendors. Documentation of performance of the third-party risk assessments is retained and acknowledged by appropriate Risk and Information Security employees of Peoples.

companyName: PEOPLES BANCORP INC

ticker: PEBO


text: Our efforts focus on protecting and enhancing the security of our information systems, software, networks, and other assets, whether commercial products or custom solutions. Our cybersecurity program focuses on protecting and enhancing the security of our information systems, software, networks, and other assets, whether commercial products or custom solutions. These efforts are under continuous review for improvement within the changing threat landscape and are designed to protect against, and mitigate the effects of, cybersecurity incidents that could result in unauthorized access to confidential, sensitive, or personal information of associates or customers or proprietary company information and potentially disrupt or impede our operations or otherwise cause harm to the Company, our customers, suppliers, dealers, or other key stakeholders.

companyName: AMERICAS CARMART INC

ticker: CRMT


text: We use specialized IT tools and services, including with the support of third -party service providers, to understand, manage, mitigate and continually remediate identified threats. The Company logs identified cybersecurity threats and tracks corresponding risk management activities. Identified cybersecurity threats are discussed with management for resolution planning and escalation. Testing of our security controls in connection with the auditing of our financial systems is completed annually.

companyName: OCULUS INC.

ticker: OVTZ


text: Cyber Governance Cybersecurity holds a pivotal role in our comprehensive risk management processes and is a key focus for both our Board and management. Our management has primary responsibility for identifying, assessing, and managing our exposure to cybersecurity threats and incidents. However, the Board, led by members of the Risk Committee, oversees the enterprise risk management process, specifically addressing material risks stemming from cybersecurity threats.

companyName: MEDICAL PROPERTIES TRUST INC

ticker: MPT


text: Key components of our cybersecurity risk management program include: • risk assessments designed to help identify cybersecurity risks to our critical systems, information, and services. • a security team principally responsible for managing (1) our cybersecurity policies & risk assessment processes, (2) our security controls & testing, (3) identifying vulnerabilities and managing remediation, and (4) our cybersecurity monitoring & incident response. • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes. • managing a cybersecurity awareness and training program that covers employees and contractors who access internal systems. • a cybersecurity incident response plan that includes procedures for responding to various types of cybersecurity incidents and tested through periodic tabletop exercises. • a third-party security risk assessment team, which is involved with identifying, assessing, and controlling risks that occur due to interactions with third parties including vendors and procurement. • a cyber risk assessment process to assist in assessing the security posture of third parties. • restricted physical access to critical areas, servers, and network equipment. • business continuity and disaster response plans.

companyName: AXIS CAPITAL HOLDINGS LTD

ticker: AXS


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Chief Financial Officer in conjunction with our General Counsel and our Head of Information Technology and report to our Audit Committee. In addition, we maintain an Information Technology Steering Committee, which is comprised of several senior members of the Company. Our Chief Financial Officer has over 10 years of experience in leading Information Technology departments at various companies. Our General Counsel has over 10 years of experience related to general legal matters, including in the capacity of understanding and guiding companies on Information Technology matters and the related risks. Our Head of Information Technology has over 30 years of relevant experience, including managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs. These management team members are informed about and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan.

companyName: Quantum-Si Inc

ticker: QSI


text: The Audit Committee is central to the Board's oversight of cybersecurity risks and bears the primary responsibility for this domain. The Audit Committee is composed of board members with depth of experience in enterprise risk management, compliance, corporate governance, technology, finance, and the unique characteristics and vulnerabilities of the oil and gas industry, equipping them to oversee cybersecurity risks effectively.

companyName: Atlas Energy Solutions Inc.

ticker: AESI


text: The CISO has primary responsibility for assessing and responding to material risks from cybersecurity threats. The current CISO is an experienced Information Security and Information Technology officer with 21 years of experience in Information Security and Information Technology and a master's degree in business administration. The CISO is also a Certified Information Systems Security Professional ("CISSP"), which is an industry recognized certification that recognizes cybersecurity professionals with the knowledge, skills and abilities to lead an organization's information security program. On a quarterly basis, the CISO updates the Risk Committee on the state of cybersecurity and potential risks to Peoples' to be considered by the Risk Committee.


text: The Company, under the oversight of the audit committee of the board of directors, has implemented and maintains an enterprise risk management program that includes a cybersecurity risk management program designed to identify, assess, and mitigate critical risks from cybersecurity threats.

companyName: Vigil Neuroscience, Inc.


text: We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. Our Board of Directors has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate those risks. We provide our Board of Directors with periodic updates on cybersecurity and information technology matters and related risk exposures from management.

companyName: Mobiquity Technologies, Inc.

ticker: MOBQ


text: We are continuously working to ensure that we satisfy generally applicable industry standards for the assessment, identification, and management of risks from cybersecurity threats that may pose a risk to our information technology systems, including from third parties with whom we work with.

companyName: Viewbix Inc.

ticker: VBIX


text: The company evaluates and oversees cybersecurity risks presented by third parties, including vendors, and service providers, and the systems of third parties that could impact our business. We seek vendor partners who are reliable, reputable and maintain cybersecurity programs. We also rely on contractual terms for indemnification and to ensure vendors and service providers employ industry best practices to protect confidential information.

companyName: MANITOWOC CO INC

ticker: MTW


text: The Company's Board of Directors (the "Board") recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Board is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM"). The Company's cybersecurity policies, standards, processes, and practices are aligned with the National Institute of Standards and Technology Cybersecurity Framework and are fully integrated into the Company's ERM program. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: WABASH NATIONAL Corp

ticker: WNC


text: An incident response plan outlining specific procedures for managing cybersecurity incidents; and A thorough third-party risk management process to evaluate and manage risks associated with service providers, suppliers, and vendors.

companyName: GridAI Technologies Corp.

ticker: GRDX