text: We have implemented a robust cybersecurity risk governance model, including the formation of the Cybersecurity Governance Committee chaired by our CISO and composed of key leaders from stakeholder groups throughout our company including our President and Chief Operating Officer, Chief Legal Officer, Chief Compliance Officer, and the head of internal audit, along with other senior members of management. Experience of key members of the committee includes: • Our President and Chief Operating Officer, who joined the Company as Chief Operating Officer in November 2017 and has served in his current role since March 2023, has over 25 years of commercial and strategic leadership experience. He excels at identifying and mitigating operational risks, including cybersecurity threats that could disrupt critical business processes. His contributions to the Cybersecurity Governance Committee include aligning cybersecurity initiatives with broader business strategies and ensuring cybersecurity considerations are integrated into information technology infrastructure and operations. • Our Chief Legal Officer, serving since August 2015, brings extensive experience as the top legal executive across various organizations. At Invitation Homes, he oversees all legal and regulatory affairs, including direct supervision of the risk management department. His expertise includes advising on governance frameworks, supporting board oversight of cybersecurity risk management, and addressing litigation trends and risks associated with cybersecurity breaches. • Our Chief Compliance Officer, who joined the Company in July 2016 and has served in her current role since July 2024, is an experienced public company counsel with over 20 years of combined private practice and in-house experience. She provides expertise in SEC regulations and disclosure requirements, including cybersecurity-related guidance, and ensures compliance with legal standards for disclosing material cybersecurity risks and incidents. In collaboration with internal audit, she helps oversee our ERM program to align cybersecurity initiatives with broader business strategies. She also brings a thorough understanding of breach notification requirements and regulatory responses to cybersecurity incidents. • Our Vice President of Internal Audit, serving since November 2017, brings specialized expertise in identifying internal threats and potential fraud related to cybersecurity through advanced audit techniques. She is skilled in aligning cybersecurity risk assessments with our ERM framework and monitoring the implementation of cybersecurity audit recommendations to ensure their effectiveness over time.

companyName: Invitation Homes Inc.

ticker: INVH


text: We engage third-party security experts, assessors, and consultants, as appropriate, to assess our cybersecurity risk management processes; support our ongoing certification efforts; help identify areas for continued focus, improvement, and compliance; and support incident response functions, to the extent necessary, all of which support our cybersecurity program. From time to time, we conduct third-party-administered, as well as internally administered, tabletop exercises that simulate cybersecurity threats, to assess our existing cybersecurity infrastructure and incident response processes. We also periodically conduct offensive security assessments and vulnerability tests, and continuously monitor our computing environments to gain visibility into our security posture and detect vulnerabilities, abnormalities, or signs of compromise. In addition to monitoring risks from threats to our own assets, we apply third-party risk management practices that endeavor to help identify and manage supply chain and vendor risk arising from our critical suppliers and other service provider organizations. We do so in a variety of ways, such as gathering information on third parties' cybersecurity programs and controls, performing due diligence, undertaking cybersecurity reviews and/or audits, and/or mandating certain contractual requirements, such as notification of cybersecurity incidents and return or destruction of all HPE data upon termination of the relationship.

companyName: Hewlett Packard Enterprise Co

ticker: HPE

secItem: Item 1C


text: As a professional services firm that processes confidential and sensitive information, such as personal information, cybersecurity risk management is an integral part of our enterprise risk management strategy. Our cybersecurity risk management program has been designed based on industry standards, such as the National Institute of Standards and Technology Cybersecurity Framework, and provides a framework for assessing cybersecurity risk and identifying and managing cybersecurity threats and incidents, including threats and incidents associated with our use of services, applications and products provided by third-party vendors and service providers.

companyName: MARSH & MCLENNAN COMPANIES, INC.

ticker: MRSH


text: Based on the information available as of the date of this Annual Report, we believe that risks from cybersecurity threats, including as a result of previous cybersecurity incidents, have not materially affected us, including our business, strategy, results of operations or financial condition, and as of the date of this Annual Report, we are not aware of any material risks from cybersecurity threats that are reasonably likely to do so. However, we cannot eliminate all risks from cybersecurity threats or provide assurances that PAR will not be materially affected by cybersecurity risks in the future. Additional information on cybersecurity risks we face is discussed in "Item 1A. Risk Factors" which should be read in conjunction with the foregoing information.

companyName: PAR TECHNOLOGY CORP

ticker: PAR


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, cybersecurity risk is addressed as a component of our enterprise risk management program; our Chief Operating Officer and General Counsel work with management to prioritize our risk management processes and mitigate cybersecurity threats that are expected to be more likely to lead to a material impact to our business; our Chief Operating Officer and General Counsel evaluate material risks from cybersecurity threats against our overall business objectives and our Chief Operating Officer reports to the audit committee of the board of directors, which evaluates our overall enterprise risk.

companyName: Design Therapeutics, Inc.

ticker: DSGN


text: The Vice President of IT submits reports to the Audit Committee and other senior management members as appropriate. These reports provide insights into the evolving threat landscape, updates on the organization's cyber risks and threats, evaluations of the information security program, and the status of initiatives aimed at improving the information security program and its systems.

companyName: Li-Cycle Holdings Corp.


text: Our CIO has over 30 years of experience in information technology, including a deep understanding of information technology governance, regulatory compliance and familiarity with the software, tools and programs used by his security management team to identify vulnerabilities, investigate incidents and implement appropriate security measures. In addition, our security management team maintains appropriate and relevant levels of education and certifications, such as Certified Information Security Manager (CISM) and Certified Ethical Hacker (CEH). Furthermore, all employees are required to complete a biannual security awareness training course focusing on data protection, phishing prevention, and credential protection.

companyName: M/I HOMES, INC.

ticker: MHO


text: We cannot assure you that any of our new information technology systems or their required functionality will be effectively implemented, maintained or expanded as planned. If we do not successfully maintain our information technology or expand these systems as planned, our operations may be disrupted, our ability to accurately or timely report our financial results could be impaired, and deficiencies may arise in our internal control over financial reporting, which may adversely affect our ability to certify our financial results. Moreover, our proprietary information could be compromised or misappropriated, and our reputation may be adversely affected. If these systems or their functionality do not operate as we expect them to, we may be required to expend significant resources to make corrections or find alternative sources for performing these functions.

companyName: Cenntro Inc.

ticker: CENN


text: Security Risk Management and Strategy part of the Company's cybersecurity risk management program, we are focused on the following key areas: Governance:

companyName: Raphael Pharmaceutical Inc.

ticker: RAPH


text: We have established a Third Party Vendor Management program to oversee and identify material risks arising from cybersecurity threats associated with our use of third-party service providers. Our Third Party Vendor Management program includes a vendor risk assessment that is designed to ensure third parties engaged by us are monitored for suitability, sustainability, risk, performance of regulatory/contractual requirements and, upon reassessment, the continual ability to perform or outperform such evaluations. Risks associated with cybersecurity threats identified during the vendor risk assessment may be submitted to the Risk Subcommittee for evaluation and analysis. Informed by an internationally recognized information technology (IT) risk management standard and framework, we identify, analyze, evaluate, and remediate/treat information and cybersecurity related risks, and risks posed by third-party providers throughout the year in addition to the annual external audits and various client assessments we undergo.

companyName: KLDiscovery Inc.


text: Our cybersecurity team is managed by a dedicated information security team, led by our VP of IT. Our VP of IT has more than 25 years of information technology experience across various disciplines, including nearly 15 years of experience in the financial, re-manufacturing, and distribution industries. She has led our global information security organization for almost three years. In addition to her employment experience in the cybersecurity field, our VP of IT has a Bachelor's of Business Administration and Computer Information Systems, and meets regularly with other members of our executive team to provide relevant updates on our cybersecurity program.

companyName: MOTORCAR PARTS OF AMERICA INC

ticker: MPAA


text: Trimble's incident response process is based on widely accepted industry frameworks, such as the cybersecurity framework set forth by the National Institute of Standards and Technology ("NIST"). Our framework includes steps to: identify threat actors, contain the affected infrastructure, eradicate threat actor access, recover affected data or systems, and study lessons learned to help ensure any root causes are mitigated outside of the affected area.

companyName: TRIMBLE INC.

ticker: TRMB


text: Our board of directors are responsible for understanding the primary risks to our business, including the risks relating to cybersecurity. Our board of directors are informed of such risks through the audit committee on a quarterly basis.

companyName: Rithm Property Trust Inc.

ticker: RPT


text: Pursuant to its charter, the Audit and Finance Committee of our Board of Directors is principally responsible for oversight of managements' actions to monitor and control cybersecurity risk exposure. The CIO routinely reports to the Audit and Finance Committee on enterprise cybersecurity matters, including, as appropriate, information security strategy, policies, and procedures, status of cybersecurity initiatives, results of third party assessments, emerging cybersecurity threats and risks, steps taken to mitigate such threats and risks, and cybersecurity developments and trends. The Audit and Finance Committee reports to the full Board and, if warranted, coordinates with the Board to address material risks. In addition, two members of the Board have been delegated authority to serve as initial points of contact for the Board in the event of a severe information security incident. The full Board receives a cybersecurity briefing from the CIO annually.

companyName: ADVANCED ENERGY INDUSTRIES INC

ticker: AEIS


text: Our corporate information security management program is ISO 27001 certified, and we undergo routine audits by an independent, certified accreditation body to maintain this certification. Our program is designed to guide our practices which are based on relevant industry frameworks and laws. This program consists of policies, practices and procedures designed to manage material risks from cybersecurity threats, including training requirements, threat monitoring and detection and threat containment and risk assessments. Additionally, we leverage third-party firms to conduct routine external and internal penetration testing to emulate the common tactics and techniques of cyber threat actors and have processes to address identified vulnerabilities, although it may take time to mitigate or manage such vulnerabilities. We also have policies and procedures to oversee and identify the cybersecurity risks associated with our use of third-party service providers for both internal use and external use. These policies and procedures include onboarding risk assessments prior to engagement and, as appropriate based on identified risk, may include cybersecurity-related contractual terms and periodic risk assessments throughout the life cycle of the third-party relationship. Lastly, we maintain cybersecurity insurance coverage that we believe is appropriate for the size and complexity of our business to cover certain costs related to cybersecurity incidents. We refine our cybersecurity program by staying informed on security threats, leveraging third-party cybersecurity firms and investing in enhancements to our preventive and defensive capabilities. In addition to our policies and procedures to manage and identify cybersecurity risks, we have an incident response plan designed to analyze, contain, remediate and communicate cybersecurity matters to help ensure a timely and robust response to actual or attempted incidents. As of the date of this report, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. However, we cannot provide assurance that these threats will not result in such an impact in the future. For more information regarding risks relating to information technology and cybersecurity, see "Item 1A. Risk Factors."

companyName: CDW Corp

ticker: CDW


text: Our cybersecurity risk management program is part of our enterprise-wide risk management practices. Based on the National Institute of Standards and Technology (NIST) Cybersecurity Framework, the program utilizes policies, processes, and technologies to assess, identify, and manage the cybersecurity threats that we face. Specifically, we use these policies, processes and technologies to identify internal and external threats, establish access control, data privacy and security measures, detect unauthorized activity, and respond to and recover from incidents. For example, we leverage external experts and our internal threat and risk teams to assess potential threats, retain external consultants to conduct penetration tests and health checks on our information systems, conduct cyber security and awareness training to help team members identify and manage common categories of cybersecurity threats, utilize multiple protective and detective tools to identify active threats and have a 24/7 Security Operations Center to manage incident response.

companyName: CENTENE CORP

ticker: CNC


text: The Company engages reputable third-party auditors and security assessors to conduct various independent risk assessments on a regular basis, including cybersecurity program maturity assessments and network and systems testing to identify and address potential vulnerabilities. Following a defense-in-depth strategy, the Company leverages both in-house resources and third-party service providers to implement and maintain processes and controls to manage the identified risks.

companyName: FIRST NORTHERN COMMUNITY BANCORP

ticker: FNRN


text: As part of our overall risk management and assessment program, we design, implement, and maintain reasonable safeguards to minimize potential risks, including cybersecurity risks; reasonably address any identified gaps in existing safeguards; update existing safeguards as necessary; and monitor the effectiveness of our safeguards. We also regularly provide cybersecurity awareness training to employees at all levels and departments across the Company. The Company believes that we have allocated adequate resources to address the cybersecurity threats that may reasonably affect us.

companyName: Clarus Corp

ticker: CLAR


text: Our cybersecurity strategy and program are led by our Executive Vice President and Chief Security Officer (CSO), who reports to the CEO. Our CSO is Danny McPherson, who has over 25 years of experience in technology and cybersecurity leadership positions and has authored several security-related books and numerous patents, IP standards, and security research publications. He has served in various capacities on various technology working groups and standards setting organizations including the Internet Architecture Board and the Internet Engineering Task Force. Our CSO manages a converged security, engineering and operations organization that helps to ensure that cyber and other security priorities are appropriately integrated throughout the Company. Our Chief Information Security Officer, Chief Information Officer and the head of architecture and engineering report to our CSO. These and other experienced employees lead the teams responsible for implementing various parts of our cybersecurity program.

companyName: VERISIGN INC/CA

ticker: VRSN


text: We have also formed materiality assessment teams, which include chief information security officers, chief information officers, chief risk officers, chief accounting officers or chief financial officers, and general counsels, to help assess the materiality of certain cybersecurity incidents.

companyName: SEMPRA

ticker: SREA


text: In connection with the Closing, on September 24, 2024, our Board of Directors approved our Cybersecurity Incident Response Policy (the "Cybersecurity Policy"), We have integrated the processes as described in the Cybersecurity Policy into our overall risk management systems and processes According to the Cybersecurity Policy, we routinely assess material risks from cybersecurity threats that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein. Pursuant to the Cybersecurity Policy, we conduct periodic risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.

companyName: Foxx Development Holdings Inc.

ticker: FOXX


text: The Audit Committee oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Senior leadership, our CIO and our CISO regularly brief the Audit Committee on cybersecurity matters. In its oversight role, the Audit Committee receives reports on cybersecurity, including internal and external cybersecurity audits, on at least a quarterly basis. We have procedures led by our CISO which govern our assessment, response and notification of internal and external parties upon the occurrence of a cybersecurity incident. Depending on the nature and severity of an incident, this process provides for escalating notification to our executive team, to evaluate the overall impact and determine the appropriate or required external notifications. Based on an incident's nature and severity, the Audit Committee would be informed of an incident by our executive team.

companyName: Qorvo, Inc.

ticker: QRVO


text: Cybersecurity risk management is a part of our risk management process and is subject to oversight by our Board of Directors and management. Our Board of Directors has delegated oversight and mitigation of risks from cybersecurity threats to our Audit Committee. Our Audit Committee receives quarterly reports from either our CIO or our General Counsel concerning any significant cybersecurity threats, risks, and the tools and processes we have implemented for mitigation. Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of management including the following: • The Information Security Executive Committee consists of our General Counsel, Chief Accounting Officer, Chief Compliance Officer, CIO, and Vice Presidents of Human Resources from select business units. They are responsible for setting broad policy and communicating to the Chief Executive Officer, Chief Financial Officer, and the Board of Directors on potential material cybersecurity incidents, which may require disclosure. • The Information Security Council consists of our CIO, Chief Information Security Officer ("CISO"), in-house information security experts, and information technology experts and leaders from across the Company. The CIO leads this committee and communicates with the Information Security Executive Committee as required. • The Information Security Team consists of cybersecurity professionals primarily responsible for managing cybersecurity at Viad. This team has the primary responsibility for identifying, assessing, and managing material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware, software, and critical data. This team is led by our CIO, who has over 30 years of experience in information technology including cybersecurity oversight. This team includes the following: • The CISO is an external expert who works with the Viad Information Security team on a fractional basis, reporting directly to the CIO and reporting periodically to our Board of Directors. The CISO is an information security professional with over 20 years of experience guiding and overseeing multiple companies' development and implementation of information security strategy. • The Vice President of Global Infrastructure is an internal role directly reporting to the CIO and responsible for implementing, maintaining, and providing oversight of the IT Infrastructure and the Information Security Team. • The Security Architect is an internal role who leads the day-to-day operations of the Information Security team and oversees the individual analysts and IT experts on the team. • The Security Incident Response Team ("SIRT") is responsible for executing the IRP. The SIRT comprises individuals from multiple departments, divisions, and disciplines. Members of the SIRT are trained in incident response and reporting procedures.

companyName: Pursuit Attractions & Hospitality, Inc.

ticker: PRSU


text: All companies utilizing technology are subject to the risk of breaches of or unauthorized access to their computer systems. The Company maintains a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. The Audit Committee of our Board of Directors and our management are actively involved in the oversight of our risk management program, of which cybersecurity represents an important component. We have established policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats and incidents. Our policies, processes and procedures include, among other things, external penetration testing using an experienced third-party company conducted every three years; a cybersecurity incident response and recovery plan; periodic and ongoing security awareness training for employees; the use of several comprehensive vulnerability analysis systems to evaluate software vulnerabilities both internally and externally; and mechanisms to detect and monitor unusual network activity. The Company also requires that all third-party vendors that have access to or handle sensitive information undergo a risk-based vendor security assessment. We also maintain controls and procedures that are designed to promptly escalate certain cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can be made by management and our Board of Directors in a timely manner. There can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective.

companyName: IEH Corp

ticker: IEHC


text: Our Board oversees cybersecurity risk as part of its overall risk oversight function. We utilize resources from HDI to act as our information technology department (the "IT Department"), which functions as our Information Security Advisory Team. The IT Department is responsible for managing our information security program and implementing cybersecurity risk management practices.

companyName: Alzamend Neuro, Inc.

ticker: ALZN


text: Cybersecurity Controls We have implemented a modern, comprehensive set of controls that restrict access to systems using a combination of firewalls, virtual private networks, multi-factor authentication and enforced use of corporate controlled compliant devices. We make extensive use of best-in-class automated intrusion prevention, intrusion detection and response systems which constantly monitor activity, build usage patterns and respond or alert when unusual activity is detected. We have experienced staff who perform root cause analysis, respond to any immediate threat, and implement improved controls for future prevention. Our cybersecurity tools are fully integrated and collect data from various sources to build relationships and detect more complex multi-channel attack strategies. Application controls are role-based and designed to protect data confidentiality and provide overall data integrity. A risk-based approach is taken regarding third-party systems utilized in our business.

companyName: FRIEDMAN INDUSTRIES INC

ticker: FRD


text: Our information security program is managed by our dedicated Chief Technology Officer, whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. The specific experience of management who oversee cybersecurity are as follows:

companyName: William Penn Bancorporation


text: Internal Cybersecurity Team Our internal cybersecurity team, led by our IT Director, is responsible for implementing, monitoring, and maintaining cybersecurity and data protection practices across the company. The team includes IT Security staff with over 27 years of collective cybersecurity work experience and the globally recognized Certified Information Systems Security Professional (CISSP) credential. In addition to our internal cybersecurity capabilities, we regularly engage cybersecurity consultants to assess, identify, and manage cybersecurity risks.

companyName: Innovex International, Inc.

ticker: INVX


text: Company has not adopted any formal cybersecurity risk management program or formal processes for assessing, identifying, and managing material risks from cybersecurity threats. At the management level, our Chief Executive Officer and Chief Financial Officer are responsible for addressing cybersecurity incidents, while our full board of directors has oversight responsibility for the Company's overall risk management, including cybersecurity risk, and has not delegated oversight authority for cybersecurity risks to any committee. In the event a cybersecurity incident occurs, the Company's Chief Executive Officer and the Financial Officer are expected to inform our board of directors of the details of such incident as well as the measures taken in response to such incident. In fiscal year 2024 we did no t identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.

companyName: JONES SODA CO.

ticker: JSDA


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, could materially affect us, including our operations, business strategy, results of operations, or financial condition. See Risk Factors – "We store and process confidential information, including personal information of our customers and their shoppers. If we or our third-party providers fail to protect the security of this information and/or experience a data security incident, our reputation may be harmed and we may be exposed to material financial penalties and legal liability, which could materially adversely affect our business, results of operations, and financial condition."

companyName: Commerce.com, Inc.

ticker: CMRC


text: To date, we have not identified risks from cybersecurity threats or incidents, including as a result of any previous cybersecurity incidents, that have materially affected the Company or are reasonably likely to materially affect our operations, business strategy, results of operations, or financial condition. However, the sophistication of and risks from cybersecurity threats and incidents continue to increase, and there can be no assurance that our cybersecurity risk management policies and procedures will be fully implemented, complied with or successfully protect against all cybersecurity threats and incidents. For more information on how cybersecurity risk could materially affect our business strategy, results of operations, or financial condition, please refer to "Item 1A Risk Factors- Risks Related to the Revelyst Business- If Revelyst's efforts to protect the security of personal information about Revelyst's customers and consumers are unsuccessful and unauthorized access to that personal information is obtained, or Revelyst experiences a significant disruption in Revelyst's computer systems or a cybersecurity breach, such as the ransomware attack experienced by Fox Racing in April 2021 prior to being acquired by Revelyst, Revelyst could experience an adverse effect on its operations, Revelyst could be subject to costly government enforcement action and private litigation and Revelyst's reputation could suffer."

companyName: Revelyst, Inc.


text: Cybersecurity threats present a persistent and dynamic threat to our entire industry. The Company views cybersecurity risk as an enterprise-wide concern that involves people, processes and technology. Accordingly, the Board of Directors of Group, through the RMC, referenced above in ITEM 1 "Business" - Enterprise Risk Management, has ultimate responsibility for risk oversight, as described more fully in our Proxy Statement, while management is tasked with the day-to-day management of the Company's cybersecurity risks. The Company's Board has a practical understanding of information systems and technology use in our business operations and processes, as well as a recognition of the risk management aspects of cyber risks and cybersecurity. The RMC, which oversees controls for the Company's major risk exposures, has principal responsibility for oversight of cybersecurity risk.

companyName: EVEREST REINSURANCE HOLDINGS INC


text: During or at the conclusion of an assessment of a cybersecurity incident, we will respond to the incident. The response will vary based upon the severity of the incident or event. The Head of Information Technology will note the classification of the information potentially impacted, paying close attention to information classified as personally identifiable information and sensitive. The Head of Information Technology and appropriate personnel will determine whether the incident is likely to affect ongoing business operations. If such is the case (e.g., contamination is widespread across production systems), the Monroe Capital's Incident Response Plan and Business Continuity Plan shall be invoked as necessary. In determining the level of response, we have identified three criticality levels of incidents and events based upon the following criteria: • Risk to confidential data • Risk to business continuity • Risk to critical systems • Revenue impact • Client impact

companyName: Monroe Capital Income Plus Corp


text: Following these risk assessments, we redesign, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. Primary responsibility for assessing, monitoring, and managing our cybersecurity risks rests with our Vice President of Technology who reports to our Chief Executive Officer, to manage the risk assessment and mitigation process.

companyName: STANDARD PREMIUM FINANCE HOLDINGS, INC.

ticker: SPFX


text: Risks from Cybersecurity Threats We have not encountered any cybersecurity incident that had any significant impact on our operations or financial standing.

companyName: GRID DYNAMICS HOLDINGS, INC.

ticker: GDYN


text: Cyberattacks represent a potentially significant risk to the Partnership and its industry. We have implemented policies and procedures that are intended to manage and reduce this risk, including those managed by affiliates of Cheniere through our service agreements with them, as further discussed in Note 14—Related Party Transactions of our Notes to Consolidated Financial Statements.

companyName: Cheniere Energy Partners, L.P.

ticker: CQP


text: Risk Management and Strategy S&T's Information Security Program provides policies, procedures, controls and technical measures to assess, identify and manage material cybersecurity risks. The Information Security Program is a part of S&T's overall Enterprise Risk Management, or ERM Program. The Information Security Program is designed to achieve the following objectives: • protecting data through the use of automated and manual processes; • periodically assessing and updating the program to address an evolving threat environment; • maintaining a team of IT security professionals that continually monitor, detect, analyze, investigate and report cybersecurity threats; and • ensuring business continuity and disaster recovery.

companyName: S&T BANCORP INC

ticker: STBA


text: Our cybersecurity management team has primary responsibility for identifying, assessing and managing our exposure to cybersecurity threats and incidents, subject to oversight by the Audit Committee of the BOD of the processes we establish to assess, monitor and mitigate that exposure.

companyName: Nuvera Communications, Inc.

ticker: NUVR


text: CEL-SCI's board of directors is responsible for oversight over its risk management system, including review and approval of the risk management system and processes implemented by management to identify, assess, manage and mitigate cybersecurity risks. The Board is responsible for monitoring and assessing material risk exposure to cybersecurity risks, and CEL-SCI's management is responsible for the day-to-day supervision of the material risks CEL-SCI may face.

companyName: CEL SCI CORP

ticker: CVM


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Chief Financial Officer and Vice President, Associate General Counsel and Head of Compliance, with the assistance of our contracted third-party cybersecurity advisors. These management team members are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including incident response processes. As discussed above, these management team members periodically report to the Audit Committee about cybersecurity threat risks, among other cybersecurity related matters.

companyName: SELLAS Life Sciences Group, Inc.

ticker: SLS


text: ACNB engages independent third-party assessors and auditors in connection with its information security program, including to conduct external and internal penetration testing and internal vulnerability scanning, independent audits and risk assessments. Technology Services personnel perform internal security practices, including periodic internal vulnerability scanning using commercial software tools and follow-up with corrective measures as required, monitoring for unauthorized access attempts, uses dynamically updated Endpoint Detection and Response for anti-malware, and deploying dynamically updated firewalls to protect against unknown actors. Platforms are in place with the ability to automate containment without the risk of employee response delays and a third party provider performs additional external vulnerability scanning, network threat detection and automated containment, risk analysis and continuous monitoring. The Information Security Officer performs monthly phishing exercises with the reporting of results to the Information Security Committee and an annual summary of results to the Audit Committee. ACNB Bank also utilizes third-party service providers in the ordinary course of business. As part of ACNB Bank's management program, initial and ongoing information security due diligence is reviewed and assessed on ACNB Bank's service providers as appropriate, based on level of access to, storage of and processing of corporate and customer confidential information. Such due diligence may include review of service organization control reports and other independent testing, information security and incident response programs.

companyName: ACNB CORP

ticker: ACNB


text: We face certain continuing and ongoing material risks from cybersecurity threats, which the SEC defines as any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein. See "Risk Factors—Risks Relating to Cybersecurity or Data Privacy—A breach or other compromise of our security measures or those of third parties we rely on could result in unauthorized access to personal information about our clients' customers and other individuals and other data, or disruptions to our systems or operations, which could materially and adversely impact our reputation, business, financial condition and results of operations." Otherwise, however, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.

companyName: ALKAMI TECHNOLOGY, INC.

ticker: ALKT


text: Our Incident Response Team has the primary responsibility of assessing and managing risks from cybersecurity threats and implementing the various stages of our IRP set forth above. The Incident Response Team is comprised of the following IT Systems management personnel and members of senior management: • Chief Information Officer ("CIO") – Our CIO has over forty years of information technology experience across a wide range of industry sectors including insurance, financial and life sciences and forty years in life science research and development information security. For the past four years, our CIO has had oversight of our cybersecurity strategy and building out our cybersecurity capabilities and infrastructure in response to the growing threat from potential cyber security incidents on our IT Systems. Our CIO has also led the initiative to integrate our cybersecurity management into our overall enterprise risk management strategy. Our CIO has an NACD CERT certificate in cybersecurity oversight; • Associate Director, Information Technology ("IT Security Director") – Our IT Security Director has approximately twenty years of relevant information technology experience including at least fifteen years of hands-on experience working in various cybersecurity domains, including asset and network security and architecture, identity access management, disaster recovery and business continuity. Our IT Security Director's responsibilities include serving as the lead for cybersecurity under the direction of the CIO and maturing our cybersecurity program across all cybersecurity domains, including security and risk management. Our IT Security Director is a Certified Information Systems Security Professional and has an NACD CERT certificate in cybersecurity oversight; • Senior Vice President, Chief Legal Officer – Our Chief Legal Officer oversees our enterprise risk management strategy and serves as the executive management representative on our Incident Response Team; and • Vice President, Business Continuity & Sustainable Operations ("VP Business Continuity") – Our VP Business Continuity has responsibility for overseeing our Business Continuity Plan which incorporates our IRP. Our VP Business Continuity has over 15 years leading the business continuity programs for various companies and has training on ISO 22301 (the Business Continuity ISO Standard).

companyName: HALOZYME THERAPEUTICS, INC.

ticker: HALO


text: Our Head of Global Supply Chain and IT, reporting to our Chief Executive Officer, has principal responsibility for assessing and managing cybersecurity risks and preparing updates for the Board of Directors. Our Chief Information Officer reports to our Head of Global Supply Chain and IT and is responsible for the operation of our cybersecurity program. Our Chief Information Officer is educated in business computing sciences and has over twenty years working in leadership, management, and consulting roles in digitalization, application management, and cybersecurity. Our Chief Information Officer also has experience implementing and leading global governance frameworks, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework and ISO 27001. An Advisory Board, comprised of the Chief Executive Officer, Chief Financial Officer, Head of Global Supply Chain and IT, and Chief Information Officer, meets quarterly to discuss digital initiatives and investments, inclusive of cybersecurity topics. An experienced team of IT security professionals reports to our Chief Information Officer.

companyName: METTLER TOLEDO INTERNATIONAL INC/

ticker: MTD


text: The Company aligns its cybersecurity program with the Center for Internet Security ("CIS") framework of Critical Security Controls System penetration testing is performed by rotating third-party service providers at least every 18 months.

companyName: UFP TECHNOLOGIES INC

ticker: UFPT


text: The Audit Committee of the Board of Director's has the responsibility of overseeing the Company's cybersecurity risks. The Director of Information Technology provides periodic updates to the Board of Director's regarding actions taken to mitigate the Company's exposure and protection to cybersecurity risks. Management routinely evaluates the Company's security processes, procedures, and systems to determine if enhancements are needed to reduce the possibility of a future cybersecurity event. This includes safeguards implemented by the Company, such as a multi-factor authentication process for remote access to systems; restricted firewall settings; network monitoring, email phishing tests, and enhancing the Company's backup recovery strategy, among others.

companyName: Perma-Pipe International Holdings, Inc.

ticker: PPIH


text: Risk Assessment; Third Party Assessments and Audits An information security Risk Assessment (RA) is conducted annually or following any significant changes to the operating or sensitive data environments to identify vulnerabilities and implement appropriate controls and risk mitigation strategies. These assessments can be conducted on any entity within CSPi or any external entity that has signed a Third-Party Agreement with CSPi, covering information systems, applications, servers, networks, and related processes. The IT Manager, along with the responsible department, oversees the execution, development, and implementation of remediation programs. The RA process involves assembling a team, defining the scope, identifying business and IT owners, conducting interviews, reviewing controls and incidents, developing a threat/risk matrix, and preparing an executive summary with recommendations. The Executive Team reviews and approves the recommendations, and a project is initiated to implement the necessary controls and procedures, which are tested quarterly.

companyName: CSP INC /MA/

ticker: CSPI


text: Program and Strategy Our cybersecurity risk management program (the "Cybersecurity Risk Management Program") was designed to identify, manage, mitigate, and respond to ongoing cybersecurity threats and associated risks and is responsible for their escalation to the Board of Directors when determined to be material. Currently, the Cybersecurity Risk Management Program includes cybersecurity services provided by our Former Parent through 2024 as part a transition service agreement entered in connection with the Spin. The underlying controls utilized by these programs are based on industry recognized best practices and standards for cybersecurity and information technology which include the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) and the International Organization for Standardization (ISO) 27001:2022 Information Security Management Systems Requirements The Cybersecurity Risk Management Program is administered through two primary channels: (i) Fortrea led cybersecurity services and capabilities, and (ii) trusted third-party partners delivering cybersecurity services overseen by our Cybersecurity leadership team. Both channels combined deliver the entire Cybersecurity Program, which includes key items such as:

companyName: Fortrea Holdings Inc.

ticker: FTRE


text: Risk Management Processes: Spectral conducts regular assessments of cybersecurity vulnerabilities and emerging threats across its systems and products. Our risk management approach draws on widely accepted frameworks (such as the NIST Cybersecurity Framework) to prioritize risks and guide the implementation of appropriate security measures. We engage independent security experts to perform evaluations of our cybersecurity program – including periodic third-party security audits and penetration testing – in order to test the effectiveness of our safeguards and to identify areas for improvement. Additionally, the Company maintains a third-party risk management program that assesses and monitors the cybersecurity practices of critical vendors and partners, helping ensure that our service providers uphold robust data security standards. Findings from these ongoing risk assessments and tests are used to continually enhance our internal controls and cybersecurity defenses.

companyName: SPECTRAL CAPITAL Corp

ticker: FCCN


text: Currently, our directors do not have a formal structure for overseeing cybersecurity risks. We plan to review this oversight in the near future to ensure appropriate governance is established.

companyName: SolarWindow Technologies, Inc.

ticker: WNDW


text: We use a combination of online training, including mandatory annual cybersecurity and privacy courses, educational tools, videos and other ongoing awareness initiatives, including phishing simulation exercises, throughout the year to foster a culture of security awareness and responsibility among our workforce.

companyName: Kyndryl Holdings, Inc.

ticker: KD


text: Cyber Risk Management Strategy Adtalem recognizes the importance of safeguarding sensitive information pertaining to our students, employees, institutions, and operations. Our Cyber Risk Management Framework is designed to fortify our defenses against potential cyber threats and to protect the integrity, confidentiality, and availability of critical data.

companyName: Covista Inc.

ticker: CVSA


text: Trustmark recognizes the critical importance of identifying, assessing and managing material risks from cybersecurity threats. Trustmark is committed to implementing and maintaining a comprehensive information security program to manage such risks and safeguard its systems and data.

companyName: TRUSTMARK CORP

ticker: TRMK


text: Our Board oversees our enterprise risk management program, including cybersecurity risk. The audit committee of our Board (the "Audit Committee") is responsible for oversight of our cybersecurity risk management processes, and a cross-functional cybersecurity committee (the "Cybersecurity Committee"), which is comprised of members of our management team, reports to the Audit Committee.

companyName: PROCORE TECHNOLOGIES, INC.

ticker: PCOR


text: Additional information regarding risks from cybersecurity threats is discussed in Part I, Item IA, "Risk Factors," under the heading "If our technology infrastructure is compromised, damaged or interrupted by a cybersecurity incident, data security breach or other security problems, our operating results and financial condition could be adversely affected," which should be read in conjunction with the information herein.

companyName: Avinger Inc


text: Information regarding cybersecurity risks may be elevated from senior IT leadership through a variety of different channels, including discussions between or among subsidiary and parent company management, reports to subsidiary and parent company risk committees and reports to subsidiary and parent company boards and board committees. As noted above, the Audit Committee regularly receives reports on cybersecurity matters from our and our subsidiaries' senior IT leadership.

companyName: LOEWS CORP

ticker: L


text: We partner with and build relationships with third parties who have access to our IT systems to support an overall ecosystem around cybersecurity that we believe helps reduce third party cybersecurity risk affecting our level of cybersecurity risk. We assess cybersecurity risk from our suppliers and service providers and have in place oversight processes to identify and manage such risks. Those processes are cross-functional and form part of our enterprise risk management program, and they are supported by our security, compliance and sourcing organizations. We require suppliers and service providers identified as potential cybersecurity risks to adopt security-control principles based on NIST or similar global standards, and our form contracts for them include provisions drafted to reduce the cybersecurity risk that they may pose for us. We obtain various Service Organization Control 1 and 2 reports from third parties relating to physical security, information security, account administration, transactional processing and reconciliation, client reporting and layers of electronic security controls. Notwithstanding our cybersecurity controls that cover third parties, because it is more difficult to control and mitigate risk associated with third parties than risk internal to our own organization, we believe that these relationships with third parties create additional exposure to cyber risk.

companyName: Sylvamo Corp

ticker: SLVM


text: We actively monitor and adapt to the evolving cybersecurity landscape through continuous assessment. Despite these efforts, the potential for breaches, attacks, or system failures remains a risk, which could lead to service disruptions, financial losses, legal liabilities, or reputational harm. We will continue to prioritize investments in cybersecurity to enhance our defenses and resiliency against emerging all known cases to date, the company's systems and protocols have successfully detected and mitigated these attempts with no impact on operations or data integrity.

companyName: Bubblr Inc.

ticker: BBLR


text: AGM's cybersecurity incident response plan provides for proper escalation of identified cybersecurity threats and incidents, including, as appropriate, to our management. These discussions provide a mechanism for the identification of cybersecurity threats and incidents, assessment of cybersecurity risk profile or certain newly identified risks relevant to our company, the Investment Adviser, and evaluation of the adequacy of our cybersecurity program (as coordinated through the Investment Adviser and AGM), including risk mitigation, compliance and controls.

companyName: MidCap Financial Investment Corp

ticker: MFIC


text: Senior leadership briefs the board of directors on our cybersecurity and information security posture, and our board of directors is informed of cybersecurity incidents deemed to have a high or critical business impact, even if immaterial to us.

companyName: SOCKET MOBILE, INC.

ticker: SCKT


text: Our Audit Committee receives periodic reports from our CTO and management on our cybersecurity risks and the current threat landscape trends. In addition, management will update the Board directly, as necessary, regarding cybersecurity incidents. The full Board also receives presentations on cybersecurity topics from our CTO and other security management staff as part of the Board's continuing oversight of topics that impact the Company.

companyName: Exela Technologies, Inc.

ticker: XELA


text: While processes are in place to minimize the occurrence of a successful cyberattack, we have institutionalized detailed incident response procedures to address a cyber threat that may occur despite these safeguards. The response procedures are designed to identify, analyze, isolate and contain, remediate, and, if applicable, report any such material cyber incidents that occur. We have developed a materiality assessment approach for cyber and a cyber crisis communication methodology for structured and timely notification to internal and external stakeholders. Further, we have empaneled specialized cyber partners to provide advanced investigation capabilities and response management support in case of a real cyber incident.

companyName: ExlService Holdings, Inc.

ticker: EXLS


text: We have processes in place for assessing, identifying, and managing material risks from potential unauthorized occurrences on or through our information systems that could adversely affect the confidentiality, integrity, or availability of our information systems or the information residing on those systems. These include a wide variety of mechanisms, controls, technologies, methods, systems, and other processes that are designed to prevent, detect, or mitigate data loss, theft, misuse, unauthorized access, or other security incidents or vulnerabilities affecting the data. The data includes confidential, proprietary, and business and personal information that we collect, process, store, and transmit as part of our business, including on behalf of third parties. We also use systems and processes designed to reduce the impact of a security incident at a third-party vendor or customer, including assessment and monitoring of security standards and control procedures for external suppliers and vendors, with enhanced engagement or internal controls depending on the results of the assessment.

companyName: Aterian, Inc.

ticker: ATER


text: Cybersecurity risk management is led by our Chief Information Officer (CIO) and Chief Information Security Officer (CISO), supported by our information technology and information security teams. The Bank's Chief Information Officer (CIO) provides direction and oversight for information technology and security across the Company, including existing and emerging initiatives. In this role, she leverages more than 26 years of information technology experience. The Bank's Chief Information Security Officer (CISO) has been with the Company for more than 13 years and has maintained various applicable cybersecurity and IT audit certifications. Prior to joining the Bank, he worked for a Fortune 500 company and had 15 years of information technology experience working in networking, information security and information technology auditing.

companyName: BANNER CORP

ticker: BANR


text: Security is governed by the Security Advisory team, an executive advisory committee composed of company officers, including our chief executive officer, our chief financial officer and our chief enterprise services officer, who meet regularly to evaluate ongoing security threats and incidents, to define policy and to prioritize initiatives. This advisory team is chaired by our vice president of cybersecurity and physical security, who has more than twenty years of relevant experience in the field of cyber and physical security. In his role, our vice president of cybersecurity and physical security also supervises efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, which include briefings from internal security personnel, alerts and reports produced by security tools deployed in our technology infrastructure and threat intelligence and other information obtained from governmental, public or private sources, including external cybersecurity service providers. Identified cybersecurity threats and incidents are monitored and assessed for materiality by this cross-functional Security Advisory team. This assessment includes whether our Board of Directors should be informed of a threat or incident.

companyName: ONEOK INC /NEW/

ticker: OKE


text: Board Oversight of Risks from Cybersecurity Threats The Board, in coordination with the Risk Management Committee, oversees the Company's ERM process, including the management of risks arising from cybersecurity threats. The Board and the Risk Management Committee each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. The Board and the Risk Management Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, the Board and the Risk Management Committee discuss the Company's approach to cybersecurity risk management with the Company's CISO and CIO.

companyName: EQUITY BANCSHARES INC

ticker: EQBK


text: Monitoring Cybersecurity Incidents The Security Committees are continually informed about the latest developments in cybersecurity, including potential threats and risk management techniques. The Security Committees, and in particular senior IT leadership, IT cybersecurity and internal audit members serving on the Security Committees, implement and oversee processes for the regular monitoring of our information systems. The Company follows the NIST framework to design and implement security processes, tools and procedures, and regular system audits identify and lead to remediation of potential vulnerabilities. In the event of a cybersecurity incident, senior IT leadership and the Security Committees are equipped with a well-defined incident response plan. This plan includes immediate actions to mitigate the impact, internal and external communication plans, and notification requirements.

companyName: AMC ENTERTAINMENT HOLDINGS, INC.

ticker: AMC


text: In February 2024, we chartered the Information Systems, Data and Cybersecurity Governance Committee (the "Cybersecurity Committee"), which is comprised of the Company's business unit leaders and is responsible for the management of our cyber risk exposure and monitoring the effectiveness of the cybersecurity program. The Cybersecurity Committee reports the progress of cyber risk reduction initiatives to our senior leadership and the Audit Committee on a periodic basis.

companyName: Harmony Biosciences Holdings, Inc.

ticker: HRMY


text: Audit & Risk Committee Primary oversight responsibility for information security, cybersecurity, and data privacy, including internal controls designed to identify, assess, and manage risks related to these topics Management

companyName: TARGET CORP

ticker: TGT


text: We protect our network and information assets with industry-tested security products and processes. Our information security team actively monitors our networks and systems to detect suspicious or malicious activity. We also conduct vulnerability scans to determine areas that need improvement. Our cybersecurity team maintains their current knowledge through training, obtaining professional certifications, and participating in industry groups. Our information security team expands and tests their knowledge of cyber threats through on-the-job training and periodic simulated exercises to practice responses to potential real-life threats. We also engage expert cyber consultants, as necessary and appropriate.

companyName: RED RIVER BANCSHARES INC

ticker: RRBI


text: Operational Risk Management and Strategy Identifying, assessing and managing material risks from cybersecurity threats is a core component of our overall operational risk management. The Company's Information Security team is the primary group responsible for cybersecurity and consists of four divisions with specific mandates: • The security engineering division, which leads our "security by design" efforts to help ensure cybersecurity considerations are taken into account in our applications, cloud architecture and infrastructure; • The governance, risk and compliance division, which includes responsibility for developing cybersecurity-related policies and procedures, training and supplier security review; • The cybersecurity response and investigations ("CSRI") division; and • The identity access management division, which is responsible for managing access to our data and technology infrastructure.

companyName: LINCOLN NATIONAL CORP

ticker: LNC


text: We employ a dedicated cybersecurity team. In coordination with our Chief Information Officer, the team assesses and manages cybersecurity threat risks with a focus on identity verification, system access and security, and governance, risk, and compliance. Our Chief Information Officer has extensive information technology and strategic leadership experience, including modernizing and securing business applications and technology stacks. Our director of cybersecurity is a certified information systems security professional with broad experience in cybersecurity, much of which was gained working for the U.S. military. Various members of the cybersecurity team hold industry certifications. The Chief Information Officer regularly shares cybersecurity developments and concerns with the Chief Executive Officer and with other executive officers as concerns arise that impact their areas.

companyName: WERNER ENTERPRISES INC

ticker: WERN


text: The Board of Directors is responsible for overseeing the assessment and management of enterprise-level risks that may impact U. S. Steel. The Audit Committee has primary responsibility for overseeing risk management, including oversight of risks from cybersecurity threats. Management, including the CIO and CISO, reports on cybersecurity matters regularly to the Board, primarily through the Audit Committee, including an annual report regarding specific risks and mitigation efforts within U. S. Steel and a 5-year cybersecurity threat assessment conducted by third party experts. Management provides benchmarking information and updates on key operational and compliance metrics to the Board. In addition, cybersecurity training is provided to the full Board of Directors, including training by third party experts, to educate directors on the current cybersecurity threat environment and measures companies can take to mitigate risk and impact of cyberattacks. As described above, management is actively involved in assessing and managing U. S. Steel's material cybersecurity risks. The CIO and the CISO primarily lead these efforts. The CIO is responsible for the oversight of U. S. Steel's entire global IT operation, including the cybersecurity program, and holds a Bachelor of Science in electrical engineering technology from Purdue University and a Master of Business Administration from Wayne State University. The CISO reports directly to the CIO and has responsibility for leadership of U. S. Steel's global cybersecurity program. She holds a bachelor's degree in Information Systems Management, a master's degree in Internet Information Systems, and a doctorate in Instructional Management and Leadership. The CISO also completed the Chief Information Security Officer Certificate program at Carnegie Mellon University, where she now serves as a coach for the program, and holds a Certified Information Systems Security Professional (CISSP) certification. She is an active member of the Greater Pittsburgh CISO Group and the Steel City OTSEC Information Sharing Group, and serves on the Editorial Review Board for two peer-reviewed journals (International Journal of Cyber Research and International Journal of Information and Communication Technology Education).

companyName: UNITED STATES STEEL CORP


text: Oversight of Third-Party Service Providers. The Company also uses third-party service providers to support its operations and many of its technology initiatives. The Company evaluates third-party service providers from a cybersecurity risk perspective, which may include an assessment of that service provider's cybersecurity posture or a recommendation of specific mitigation controls. Following an evaluation, the Company determines and prioritizes service provider risk based on potential threat impact and likelihood, and such risk determinations drive the level of due diligence and ongoing compliance monitoring required for each service provider.

companyName: SOUTHWEST AIRLINES CO

ticker: LUV


text: Our Board monitors cybersecurity risk as part of Great Elm's overall risk management program. Our Board has delegated the primary responsibility for oversight and review of guidelines and policies with respect to risk assessment and risk management to the Audit Committee, which includes oversight of risks related to cybersecurity threats. The Audit Committee and the Board, as appropriate, are informed about risks related to cybersecurity threats through periodic reports from GECM's Chief Operating Officer. Such reporting includes updates on GECM's cybersecurity program, the external threat environment, and GECM's programs to address and mitigate the risks associated with the evolving cybersecurity threat environment. These reports also include updates on GECM's preparedness, prevention, detection, responsiveness and recovery with respect to cyber incidents, where applicable.

companyName: Great Elm Group, Inc.

ticker: GEG


text: We have strategically integrated cybersecurity risk management into our broader enterprise risk management function to promote a company-wide culture of cybersecurity risk management. Our board of directors has general oversight responsibility for our enterprise risk management function, which includes specific areas of focus including competitive, economic, operational, financial (accounting, credit, liquidity and tax), legal, compliance, information technology security programs (including cybersecurity), ESG/corporate social responsibility, political and reputational risks. Our board of directors has delegated oversight of certain of these areas to the committees of our board of directors, including delegating the oversight of our information technology security programs (including cybersecurity) to the risk committee of our board of directors (the " Risk Committee "). We believe this division of risk management-related roles to the committees of our board of directors fosters an atmosphere of significant involvement in the oversight of risk at the board level and complements our risk management policies. The oversight responsibility of our board of directors is facilitated by a management report process that is designed to provide both visibility and transparency to our board of directors about the identification, assessment and management of critical risks and management's risk mitigation strategies.

companyName: Ryman Hospitality Properties, Inc.

ticker: RHP


text: The Board of Directors of the Company oversees the management of risks from cybersecurity threats through its review of quarterly reports from the CISO on the status of the Company's cybersecurity preparedness; updates on information systems; and any cybersecurity threats of which management Ambac Financial Group, Inc has become aware. In addition the Board receives periodic cybersecurity awareness training.

companyName: OCTAVE SPECIALTY GROUP INC

ticker: OSG


text: The Technology Committee is informed of cyber threats and risks through multiple mechanisms. PNC's Chief Information Security Officer presents quarterly to the Technology Committee on such topics as threat intelligence and assessment reports, incident and event reporting from other institutions, governance and regulatory exam statuses, and the status of other key program deliverables, among other content.

companyName: PNC FINANCIAL SERVICES GROUP, INC.

ticker: PNC


text: We believe we have allocated adequate resources related to our cybersecurity risk management processes and have designated our Chief Information Officer with the responsibility of managing the cybersecurity risk assessment and mitigation process with the oversight of the Chief Financial Officer responsible for the consolidated financial statements for the year ended November 30, 2024. As part of our overall risk management program, we provide cybersecurity training to employees in high-risk.

companyName: CRYO CELL INTERNATIONAL INC

ticker: CCEL


text: As discussed in more detail below under the heading "Governance," our Board's oversight of cybersecurity risk management is supported by the Audit Committee of the Board, which regularly reviews operational risks. Our Senior Director, IT Application & Compliance and Interim Head of Information Technology ("HIT"), together with our Head of Information Security ("HIS"), and other members of our management team meet regularly to review current cybersecurity risks. The HIT and management team representatives also meet with the Audit Committee at least on a quarterly basis to discuss and review our cybersecurity program and risk landscape.

companyName: Vir Biotechnology, Inc.

ticker: VIR


text: Security Awareness Program to Train and Test Personnel. We operate a security awareness program that includes regular, mandatory trainings for relevant personnel on data protection and malware detection, policy and process awareness, periodic phishing simulations and other kinds of preparedness testing.

companyName: EASTMAN KODAK CO

ticker: KODK


text: Our senior vice president, chief information officer, vice president, chief information security officer (CISO), and vice president, chief product security officer have each served in various roles in IT and information security for over 20 years. These individuals' knowledge and experience along with the culture and talent of the corporate IT security team organization are instrumental in developing and executing our cybersecurity strategies. The CISO meets with senior leadership to review and discuss the cybersecurity program, including emerging cybersecurity risks, threats and industry trends.

companyName: THERMO FISHER SCIENTIFIC INC.

ticker: TMO


text: Forward-Looking Statements While CETI implements strong cybersecurity measures, no system is completely immune to threats. The Company remains vigilant in strengthening its security post.

companyName: Cyber Enviro-Tech, Inc.

ticker: CETI


text: Service Providers Like many companies, the company relies on third-party vendor solutions to support its operations. Many of these vendors, especially in the financial services industry, have access to sensitive and proprietary information. In order to mitigate the operational, informational and other risks associated with the use of vendors, the company maintains a Vendor Management Program, which is implemented through a Vendor Management Program Policy and includes an onboarding process and periodic reviews of vendors with access to sensitive data. The Vendor Management Program is audited as part of IT audits.

companyName: Central Plains Bancshares, Inc.

ticker: CPBI


text: Executive leadership is responsible for management of the cybersecurity program. The IT Security Director supervises daily operations of the cybersecurity program and reports directly to the Chief Risk Officer ("CRO"). The CRO chairs the Information Security Sub-Committee ("Sub-Committee"), a management committee that meets at least monthly to receive regular updates on the status of the cybersecurity risk management program and strategic cyber initiatives. The Sub-Committee's actions and activities are reviewed by the ISSC at least quarterly. The Company has a management level Change Control Board ("CCB") which is responsible for reviewing and approving actions of the vulnerability management team, changes to hardware/software including the introduction of new hardware/software, and changes to firewall rulesets. The IT Security Director serves as a voting member of the CCB. Additionally, the Company has a Cyber Incident Response Team ("CIRT") which includes key members of management including the CRO and IT Security Director. The CIRT manages significant cyber-specific events with escalation up to executive leadership and the Board.

companyName: FIRST COMMUNITY BANKSHARES INC /VA/

ticker: FCBC


text: FHLBank Topeka recognizes the critical importance of maintaining the trust and confidence of our members, business partners, employees and other stakeholders. We have implemented processes for assessing, identifying, and managing material risks from cybersecurity threats or incidents that may directly or indirectly impact our business strategy, results of operations, or financial condition.

companyName: Federal Home Loan Bank of Topeka


text: Management's Role Managing Risk The COO and the CEO play a pivotal role in informing the Audit Committee on cybersecurity risks. The COO was Castellum's Vice President of Technology and Deployment before becoming COO in September of 2024, and is a certified CMMC Professional. They provide comprehensive briefings to the Audit Committee on an at least an annual basis. These briefings encompass a broad range of topics, including: Current cybersecurity landscape and emerging threats; Status of ongoing cybersecurity initiatives and strategies; Incident reports and learnings from any cybersecurity events; and Compliance with regulatory requirements and industry standards.

companyName: Castellum, Inc.

ticker: CTM


text: As one of the critical elements of the Company's overall risk management, our cybersecurity program is focused on the following key areas:

companyName: NexPoint Residential Trust, Inc.

ticker: NXRT


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a global incident response plan.

companyName: Callaway Golf Co

ticker: CALY


text: We regularly conduct Cyber Incident Response Plan (the "Incident Response Plan") tabletop exercises, including simulations of malware and ransomware attacks. Our IT environment and cybersecurity-related controls are reviewed by our internal audit function and external third parties. We sponsor third-party assessments, including cyber risk reviews and penetration testing, to evaluate our cybersecurity program independently.

companyName: Covista Inc.

ticker: CVSA


text: To date, we have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or that we believe are reasonably likely to materially affect our business strategy, results of operations, or financial condition. We cannot, however, eliminate all risks from cybersecurity threats or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, see the disclosure in Item 1A. Risk Factors under "Operational Risks—We are subject to risks relating to our information technology systems, and any technology disruption or cybersecurity incident could negatively affect our operations."

companyName: CF Industries Holdings, Inc.

ticker: CF


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, personal information, and Personal Health Information ("PHI") (collectively, "Information Systems and Data").

companyName: Personalis, Inc.

ticker: PSNL


text: We have not experienced any cybersecurity incidents to date that have materially affected, or are reasonably likely to materially affect, the Company's business strategy, results of operations, or financial condition. However, cybersecurity threats are constantly evolving, and we may not be successful in preventing or mitigating a cybersecurity incident despite our efforts to protect against such risks. A successful cyberattack could lead to theft of sensitive information, ransomware, destruction of data, or other issues causing financial, legal, or reputational damage. These events are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, should they occur.

companyName: Ramaco Resources, Inc.

ticker: METC


text: The Audit Committee receives quarterly reports from management on our cybersecurity risks. In addition, management will update the Audit Committee, as necessary, regarding cybersecurity incidents, that we may experience.

companyName: Shake Shack Inc.

ticker: SHAK


text: Third-parties on Risk Management the complexity and evolving nature of cybersecurity threats, SideChannel, Inc. has relationships with a range of external experts, including cybersecurity assessors, consultants, and auditors in evaluating and testing our risk management systems. These partnerships enable us to leverage specialized knowledge and insights as needed, to ensure our cybersecurity strategies and processes remain at the forefront of industry best practices. Our collaboration with these third-parties may include audits, threat assessments, and consultation on security enhancements.

companyName: SideChannel, Inc.

ticker: SDCH


text: Our cybersecurity incident response and vulnerability management processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances. Management, including the Chief Technology Officer and Chief Financial Officer and Treasurer, serves on the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response processes include reporting to the Audit Committee for certain cybersecurity incidents. The Audit Committee holds quarterly meetings and receives periodic reports from management, including from our Chief Technology Officer and Chief Financial Officer and Treasurer, concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them.

companyName: ALEXANDRIA REAL ESTATE EQUITIES, INC.

ticker: ARE


text: The Committee reports to the full board of directors regarding its activities, including those related to cybersecurity. The board of directors also receives periodic briefings from management on our cybersecurity program. The board members receive presentations on cybersecurity topics from our Chief Information Officer, internal security staff or external experts as part of the board of directors' continuing education on topics that impact public companies.

companyName: ARDELYX, INC.

ticker: ARDX


text: Further, we have processes in place to evaluate potential risks from cybersecurity threats associated with our use of third-party service providers that will have access to our data, including a review process for such providers' cybersecurity practices, risk assessments, contractual requirement, and system monitoring.

companyName: NORTHERN MINERALS & EXPLORATION LTD.

ticker: NMEX


text: The Bank engages trusted third parties to audit and examine its processes, review the security of its network infrastructure, and assist the Bank in designing and implementing robust cybersecurity systems. These trusted third parties help the Bank improve and test its cybersecurity readiness. The Bank engages third party vendors to monitor and test its network infrastructure. These third-party vendors take an active role in ensuring that the Bank's systems are protected by testing, reviewing and advising the Bank to strengthen cybersecurity controls when necessary.

companyName: Catalyst Bancorp, Inc.

ticker: CLST


text: We have established processes to ensure that management is informed about and monitors cybersecurity incident prevention, detection, mitigation, and remediation. These processes include regular reporting, escalation, and communication protocols, as well as periodic reviews and audits of the security and privacy program.

companyName: Simulations Plus, Inc.

ticker: SLP


text: Our business operations depend on the availability, integrity and secure processing, storage, and transmission of confidential and sensitive information, including personal information, digitally and through interconnected systems, including those of our vendors, service providers and other third parties on which we rely. Consequently, we maintain a formal information security program, including physical, technical and administrative safeguards, to prevent and mitigate the risks posed by cybersecurity threats and incidents and to identify, analyze, address, mitigate and remediate those incidents that do occur. As part of our program: a.we regularly review and update at least annually our standard policies and procedures related to information technology and analyze those policies against the standards and controls that we believe are most relevant to our Company set by organizations such as the National Institute of Standards and Technology cybersecurity framework and the International Organization for Standardization ("ISO");

companyName: TAKE TWO INTERACTIVE SOFTWARE INC

ticker: TTWO


text: The Company's Chief Information Security Officer (CISO) is responsible for developing and managing the Company's cybersecurity program and reporting on cybersecurity matters to management, the Audit Committee and the Company's Board of Directors. The CISO has over twenty years of cybersecurity and technology experience, originating with cryptography and security experience as a military officer and progressing through senior management roles at prominent global audit and technology consulting corporations. The CISO is supervised by the Company's Chief Information Officer.

companyName: Vestis Corp

ticker: VSTS


text: Additionally, our CIO leads an incident response team ("IRT"), charged with the on-going management of our cybersecurity program. This team is responsible for the prevention, mitigation, detection and remediation of cybersecurity risks and incidents affecting our operations pursuant to our incident response procedures. The IRT is composed of information security professionals, who collectively bring decades of relevant information security and cybersecurity experience to their roles.

companyName: STANDARD MOTOR PRODUCTS, INC.

ticker: SMP


text: We also recognize that third-parties that provide information systems we use can be subject to cybersecurity incidents that could impact us. To mitigate third party risk, we maintain a Vendor Integrity Code, which is designed to require our third-party vendors to comply with our requirements for maintenance of passwords, as well as other confidentiality, security, and privacy procedures. Third-party IT vendors are also subject to additional diligence such as questionnaires, inquiries, and review of System and Organization Controls (SOC) 1 and 2 reports, when relevant.

companyName: American Homes 4 Rent

ticker: AMH


text: Oversight of Cyber Security Risks by our Board of Directors The Board of Directors provides oversight on cyber security matters, including risks associated with cyber security threats. The Board of Directors receives periodic updates from the Company's Chief Compliance Officer and the Heads of Technology of Investcorp Group regarding the overall state of the Adviser's cyber security program, information on the current threat landscape, and risks from cyber security threats and cyber security incidents impacting the Company.

companyName: Investcorp Credit Management BDC, Inc.

ticker: ICMB


text: We employ external independent experts to review and test the effectiveness of our cybersecurity processes, and protection and detection mechanisms. The findings are reviewed by management and approved changes are prioritized and implemented.

companyName: International Seaways, Inc.

ticker: INSW


text: In addition, the Company uses several internal training methods, through annual mandatory courses on security and privacy for all employees, as well as multiple simulated phishing attacks and regularly providing information security awareness materials throughout the year. The Company also maintains cybersecurity insurance.

companyName: EAST WEST BANCORP INC

ticker: EWBC


text: We have developed a Testing, Training, & Exercise (TT&E) program in accordance with NIST Special Publication 800-84, in which all members of the IRT are required to participate, to sustain and refine our ability to handle computer security incidents in accordance with best practices. The TT&E program includes testing of procedures, systems, and plans, training for the IRT, and tabletop exercises. We also conduct required periodic phishing simulation tests for all employees.

companyName: UNITED THERAPEUTICS Corp

ticker: UTHR


text: A team of IT Specialists (including a Cybersecurity Analyst) at our Company is tasked with monitoring cybersecurity and operational risks associated with information security and system disruption. This team employs measures aimed at protecting against, detecting, and responding to cybersecurity threats, and has implemented processes and procedures in line with our information security management system to bolster and advance resilient programs. This encompasses:

companyName: WEYCO GROUP INC

ticker: WEYS


text: We have an incident response and escalation process that is designed to detect cyber incidents and react in an appropriate manner to reduce any related damage.

companyName: Rumble Inc.

ticker: RUM


text: At IGC, we are committed to maintaining the confidentiality, integrity, and availability of our information systems and data. As part of this commitment, we have implemented a comprehensive cybersecurity program to protect against unauthorized access, use, disclosure, modification, or destruction of our information assets. We are committed to ensuring the security and protection of our company's information assets and the personal information of our employees, customers, and stakeholders.

companyName: IGC Pharma, Inc.

ticker: IGC


text: We also engage third-party services from time-to-time to conduct evaluations of our security controls, including the IRP, whether through business continuity testing, or consulting on best practices to address new challenges and risks.

companyName: ContextLogic Inc.


text: Our Audit Committee oversees Celcuity's management of risks arising from cybersecurity threats. Our CEO delivers periodic briefings to the Board and Audit Committee on material cybersecurity risks that are pertinent to our business operations. Additionally, we have processes to promptly notify the Audit Committee and Board of a significant cybersecurity incident and to inform the Audit Committee and Board of remediation progress, as appropriate.

companyName: Celcuity Inc.

ticker: CELC


text: Coherent has instituted a robust Cybersecurity Incident Response Plan (the CIRP), which provides a framework for responding to cybersecurity incidents at escalating severity levels. The CIRP sets out a coordinated approach to discovering, investigating, containing, tracking, mitigating, and remediating cybersecurity incidents, including a framework for elevating and reporting findings and keeping senior management and other key stakeholders informed and involved, based on assessments regarding the scope or significance of incidents. The CIRP is implemented by the Coherent Cyber Incident Response Team (CIRT), which is headed by the Global Head of Cybersecurity, and includes as members the head of the CMT, the Chief Legal Officer, the Cybersecurity Team, and select members of the ERM team.

companyName: COHERENT CORP.

ticker: COHR


text: Information technology is important to our business operations and we are committed to protecting the privacy, security, and integrity of our data, as well as our employee, customer, and vendor data. Accordingly, we have established processes, procedures, and controls to identify, manage, assess, and mitigate material risks from cybersecurity threats, as well as identify, contain, and respond to cybersecurity incidents. These processes include, but are not limited to, monitoring and updating of our information technology and infrastructure to prevent, detect, address, and mitigate risks associated with unauthorized access, misuse, computer viruses, and other events that could have a security impact. Additionally, to protect and secure sensitive data, we employ multi-factor authentication, a suite of security tools, systems monitoring and alerting, audit logs, and controls across our major systems, devices, and business processes. We engage with external experts to evaluate and test our cybersecurity risk preparedness. Regular exams and threat and security assessments with these third parties ensure that our cybersecurity strategies align with industry best practices. To manage cybersecurity risks associated with third-party service providers, we impose security requirements upon our suppliers, including maintaining an effective security management program and notifying us in the event of any known or suspected cyber incident. We also conduct company-wide security awareness training periodically to provide employees the opportunity to gain an understanding of the various forms of cybersecurity incidents and enable our employees to handle and report the majority of suspicious activities or threats. We currently maintain a cyber insurance policy that provides coverage for security breaches; however, such insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyber-attacks, or other related breaches.

companyName: AEye, Inc.

ticker: LIDR


text: Despite our careful planning, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While the Company maintains cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. See Item 1A. "Risk Factors" for a discussion of cybersecurity risks.

companyName: Altair Engineering Inc.


text: Key elements of our cybersecurity governance program includes but are not limited to the following: • Processes to assess cybersecurity risk, designed to help identify material risks from cybersecurity threats to critical systems and information; • a security team principally responsible for coordinating and managing (1) cybersecurity risk evaluation processes, (2) implementation of cybersecurity controls, and (3) response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of the organization's cybersecurity processes; • cybersecurity awareness training of employees, including incident response personnel including third party providers, and senior management; • a cybersecurity incident response plan which includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for key service providers based on our assessment of their criticality to our operations and respective risk profile.

companyName: Gossamer Bio, Inc.

ticker: GOSS


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This does not mean that we meet any technical standards, specifications, or requirements, but only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: TSS, Inc.

ticker: TSSI


text: In the last two fiscal years, we have not identified cybersecurity threats that have materially affected, or are reasonably likely to materially affect, our business, results of operations, or financial condition. Although we proactively attempt to prevent all threats, we are unable to eliminate all risk from cybersecurity threats or provide assurance that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see Item 1A. Risk Factors "Our business and operations would suffer in the event of computer system failures".

companyName: Checkpoint Therapeutics, Inc.


text: Please see Item 1A. Risk Factors – Operational Risks – "A significant cybersecurity incident or other disruption to our technology infrastructure could disrupt our business operations" for our disclosures regarding the most pertinent risks we may experience from cybersecurity threats.

companyName: NORFOLK SOUTHERN CORP

ticker: NSC


text: In parallel with our Code of Conduct, we have created and posted publicly, and incorporate into vendor contracting, our security standards for our contractors, subcontractors and other vendors and suppliers, which holds the third parties with which we do business to equivalent data and privacy standards as the Company, as applicable. We request Attestations of Compliance with such standards and execute HIPAA-compliant Business Associate Agreements in these contexts as appropriate.

companyName: Veradigm Inc.


text: We have data and cybersecurity protection and control policies to facilitate a secure environment for sensitive information and to ensure the availability of critical data and systems. The information security management system supporting our online learning platform has been independently certified to the International Organization for Standardization ("ISO") / International Electrotechnical Commission 27001:2013 standard. This standard is designed to promote risk management, cyber-resilience, and operational excellence with respect to an information security management system. Our online learning platform undergoes regular internal security testing, and we engage third-party providers to perform penetration and vulnerability tests. We have annual independent third-party audits conducted on system security and availability, such as Systems and Organization Controls 2 Type 2 ("SOC 2") audit reports and ISO 27001 certification. Certain highly sensitive information, such as personally identifiable information ("PII") about our learners in our online learning platform, is encrypted at rest and in transit using industry standards. We also require employees and contractors to undergo information security awareness training. In addition, to mitigate the financial impact of cybersecurity incidents, we maintain insurance to help cover losses resulting from such potential incidents.

companyName: Coursera, Inc.

ticker: COUR


text: We have developed a formal Incident Response Plan focused on: 1) preparation, 2) detection and analysis, including determination of materiality, 3) containment, eradication, and recovery, and 4) post-incident analysis. We maintain and enforce Company level information system security policies that include possible disciplinary actions for violations.

companyName: HIBBETT INC


text: With oversight from the CTO, the CISO is responsible for assessing and managing cybersecurity risks. With over 30 years of IT management experience, the CISO has over 15 years experience in developing, leading and managing cybersecurity programs. The CISO holds Bachelor's degree in Management Science and Computer Systems along with a Certification in Cybersecurity Oversight through the National Association of Corporate Directors ("NACD") and the Software Engineering Institute of Carnegie Mellon University.

companyName: Vital Energy, Inc.

ticker: VTLE


text: we believe that our third-party vendors and service providers have their own respective cybersecurity protocols which our management believes to be adequate for protecting any of the Company's data that might be in their possession from time to time; however, having such protocols is not necessarily a condition for us using or not using the services of any such vendors or providers.

companyName: Microbot Medical Inc.

ticker: MBOT


text: See Item 1A Risk Factors for discussion of material risks faced by the Company, including risks related to cybersecurity and IT.

companyName: Cannae Holdings, Inc.

ticker: CNNE