text: We also maintain technical errors and omissions insurance which includes a cyber incident endorsement of up to $20 million. This endorsement provides coverage for Network Security and Privacy, Privacy Regulation Proceeding, Privacy Event Expense Reimbursement, Extortion Demand Reimbursement, Data Restoration, Network Restoration, Business Interruption and System Failure. This coverage reimburses the most common costs for information security incidents, including attorney's fees, consumer notification costs, and regulatory fines.

companyName: OptimizeRx Corp

ticker: OPRX


text: Since the management of cybersecurity risks is ultimately the responsibility of the Board of Directors, it devotes significant time and attention to the oversight of cybersecurity and information security risks, and benefits from the technical expertise of its members. The Board of Directors reviews an Enterprise Risk Position report that reflects key risk measures and trends across the Company, including cybersecurity. The Board of Directors also reviews and approves the Information Security Policy annually and frequently receives presentations on and discusses cybersecurity and information security risks, industry trends and best practices.

companyName: BANK OF HAWAII CORP

ticker: BOH

secItem: Item 1C


text: While we believe we have implemented appropriate measures and controls for our business, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. To date, to our knowledge, there have been no incidents materially affecting the Company, but a material incident could result in disruption of critical IT networks and systems, impeding our operations, release of confidential information, and/or corruption of data. Such an incident could damage our reputation, brands, future sales and could expose us to potential liability.

companyName: CV Sciences, Inc.

ticker: CVSI


text: The Company also recognizes the risks associated with the use of third party providers and maintains a Third Party Management Program that is responsible for the oversight of outsourced services. This enables the Company to identify risks related to third parties through an inherent risk assessment and a due diligence review process designed to ensure third parties are in compliance with the Company's risk and information security expectations.

companyName: LAKE SHORE BANCORP, INC.


text: A periodic cyber risk assessment conducted by independent experts, which provides an external validation and benchmarking of our cybersecurity practices and performance.

companyName: STANDEX INTERNATIONAL CORP/DE/

ticker: SXI


text: Adient's Board of Directors has delegated cybersecurity risk oversight to the Audit Committee. The Chief Information Officer and information security leadership regularly update the Audit Committee regarding cybersecurity programs, risks and significant incidents. The Board of Directors receives a summary of cybersecurity matters in connection with regular reports from the Audit Committee. Cybersecurity risks are also considered by the Audit Committee and the full Board of Directors as part of the annual enterprise risk management process and the annual internal audit plan, which is reviewed and approved by the Audit Committee.

companyName: Adient plc

ticker: ADNT


text: The VP of Software Platform is informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. The VP of Software Platform reports to the audit committee about cybersecurity threat risks, among other cybersecurity related matters.

companyName: Serve Robotics Inc. /DE/

ticker: SERV


text: We have established a cybersecurity program intended to protect the confidentiality, integrity and availability of our systems, data and products in a manner consistent with industry best practices and the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. We are currently ISO 27001 certified for our surgery planning ecosystem and plan to continue to maintain this industry certification. We evaluate and monitor cybersecurity risk as part of our overall enterprise risk management framework. Our cybersecurity program includes a variety of processes to assess, identify and manage risks from cybersecurity threats arising from our own and third-party provided systems, including customized annual training requirements, simulation exercises, threat monitoring and detection tools (including those using artificial intelligence and machine learning), threat containment methods, risk assessments, third-party penetration testing and security requirements for our suppliers and other third parties. We assess third party cybersecurity controls through a cybersecurity questionnaire and include security and privacy addenda to our contracts where applicable. We maintain separation of duties between our cybersecurity organization and other IT functional areas as well as established roles that define the responsibility of the cybersecurity team within our organization.

companyName: ZIMMER BIOMET HOLDINGS, INC.

ticker: ZBH


text: We have implemented incident response processes in the event of a cybersecurity threat. Such incident responses are overseen by functional leaders and internal experts. In the event of a cybersecurity threat, security events and data incidents are evaluated, ranked by severity and prioritized for response and remediation. Incidents are evaluated to determine materiality as well as operational and business impact and reviewed for potential privacy impact. As part of the above processes, we have engaged external auditors and consultants to assess our internal cybersecurity programs and compliance with applicable practices and standards, and we are in the process of obtaining a SOC 2 Type II report.

companyName: AUDIOEYE INC

ticker: AEYE


text: Our Board of Directors has ultimate oversight of risk management and has delegated responsibility for enterprise and operational risks, including cybersecurity, to the Board's Risk and Compliance Committee. This Committee oversees Jack Henry's risk assessment and management programs and reviews risk preparedness. The Audit Committee oversees financial risks and would be informed of any material cybersecurity incident that could potentially have a material impact on our financial statements. The Chief Information Security Officer ("CISO") reports quarterly to the Risk and Compliance Committee and to the full Board of Directors on information security matters. The CISO also meets with the Risk and Compliance Committee at least annually to evaluate our overall security environment and organization.

companyName: JACK HENRY & ASSOCIATES INC

ticker: JKHY


text: In accordance with our internal policies, our Information Technology Leadership Team, Chief Legal Officer, and Vice President of Risk Management are tasked with certain oversight and management responsibilities related to the monitoring, prevention, mitigation and remediation of cybersecurity threats and incidents. These management members report to the Audit Committee, and the Audit Committee reports to the full Board of Directors, as appropriate. These reports include updates on the Company's cybersecurity risks and threats, the status of efforts to strengthen our information security systems, assessments of our cybersecurity risk management processes, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the emerging threat landscape, technological trends and information security considerations arising with respect to the Company's peers and third parties. These individuals enable the Company to implement measures that help reduce and address the cybersecurity and data protection threats the Company faces. Such measures include, but are not limited to, disaster recovery and business continuity, solution monitoring, network resiliency and simplification, sensitive data security, employee training and testing, system functionality and stability, infrastructure upgrades and more.

companyName: WillScot Holdings Corp

ticker: WSC


text: Our cybersecurity incident response processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our Vice President of IT and General Counsel, who work with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response process includes reporting to the Audit Committee of the Board of Directors for certain cybersecurity incidents.

companyName: Adverum Biotechnologies, Inc.

ticker: ADVM


text: Risks from Cybersecurity Incidents As of December 31, 2023, we have identified no security incidents or breaches that are material, or likely to be material, to our business strategy, results or financial condition. As such, we have not allocated any material capital towards addressing information security breaches in the last three years, nor have we incurred any material expenses from penalties and settlements related to a material breach during this period. The materiality of an incident is determined by a team convened for an incident, according to guidelines set forth in our incident response policy and process documentation. We believe we are adequately insured against losses related to possible information security breaches and we maintain cybersecurity insurance coverage that we believe is appropriate for the size and complexity of our business.

companyName: Sunnova Energy International Inc.

ticker: NOVAQ


text: The Company has cloud based security, and their computers and servers are fire walled. In addition, the Company does not allow virtual log-in on their computers.

companyName: CitroTech Inc.

ticker: CITR


text: Crexendo provides products and services within Software as a Service (SaaS) market segment. Specifically, the company provides hosted Unified Communication as a Service (UCaaS), where the customer base is highly sensitive towards privacy, service quality and service availability.

companyName: Crexendo, Inc.

ticker: CXDO


text: Our third line of defense is the internal audit function led by our Vice President, Internal Audit, which plays a crucial role by providing independent and objective assurances on the design and operating effectiveness of our cybersecurity risk management and internal controls through the performance of audits and reviews. Internal Audit engages external consultants and subject matter experts as appropriate to assist in the assessment of management's cybersecurity program and reports the results directly to the b oard.

companyName: NATIONAL RURAL UTILITIES COOPERATIVE FINANCE CORP /DC/

ticker: NRUC


text: As part of the proactive security measures, Crexendo deploys EDR/XDR tools across employee workstations, and mines significant events coming from critical infrastructure assets within a SIEM software. Any threat or prevention notifications are sent to IT & Security team for further analysis and additional actions are performed as deemed necessary to maintain the integrity and security of the corporate and production environments.


text: The Company has established an enterprise risk management framework that outlines the processes and procedures the Company uses to identify, assess, mitigate, and monitor the risks faced by the Company, including cybersecurity risk.

companyName: EAGLE BANCORP INC

ticker: EGBN


text: We maintain an incident response policy and program focused upon detecting, managing, documenting, and reporting incidents affecting our systems and data, including those specific to cybersecurity. In the event of a significant cybersecurity incident, we establish an incident response team ("IRT") that works in conjunction our internal crisis management team, subject matter experts, and business stakeholders to identify, contain, eradicate and, if necessary, recover from a cybersecurity incident. We have built into our incident response program, a review process that gives our disclosure committee real-time access to information to rapidly assess materiality. These efforts may include detecting, identifying, defending against, responding to and, if necessary, recovering from cybersecurity incidents. Incidents that meet certain thresholds are escalated to senior members of management, internal legal advisors, communication specialists and other key stakeholders for additional guidance and action.

companyName: COMPASS MINERALS INTERNATIONAL INC

ticker: CMP


text: Signet manages cybersecurity risk using a cross-functional approach, which is overseen by the Company's Board. The Company's cyber risk management program is designed to anticipate, identify, assess, manage, mitigate, and respond to cybersecurity threats. This program is integrated within the Company's enterprise risk management processes and addresses the store and corporate information technology environments, as well as third-party vendors, software, and applications upon which we rely.

companyName: SIGNET JEWELERS LTD

ticker: SIG


text: We maintain a cyber incident response plan that is designed to provide a framework that will allow us to respond effectively to a cybersecurity incident. A cyber emergency response team, which includes members of our executive leadership team, manages this plan. This team meets periodically to discuss cybersecurity threat trends and related information. Our incident response processes are designed to escalate certain cybersecurity incidents to our cyber emergency response team and include reporting to the Audit Committee for certain cybersecurity incidents.

companyName: SMITH & WESSON BRANDS, INC.

ticker: SWBI


text: The Audit Committee of the Board oversees the Company's IT security programs, including cybersecurity, which includes review of possible external threats and potential mitigations. The Board also reviews the Company's cybersecurity program at least annually. In this review, the CIO briefs the full Board on cybersecurity and data protection matters, including analysis and review of the measures implemented by the Company to identify and mitigate cybersecurity risks. Occidental also has protocols by which material cybersecurity incidents are to be reported to the Audit Committee and/or the Board, as appropriate.

companyName: OCCIDENTAL PETROLEUM CORP /DE/

ticker: OXYWS


text: Although we have experienced non-material information security incidents from time to time in the past, in the last three years, we have not experienced any material cybersecurity incidents, nor has any incident had a material impact on our operations or financial condition. For a discussion of how risks from cybersecurity threats are reasonably likely to affect us, including our business strategy, results of operations, or financial condition, please see "If our information security measures are breached, disrupted, or fail, we may incur significant legal and financial exposure and liabilities" under the heading Part I, Item 1A "Risk Factors".

companyName: ADVANCED ENERGY INDUSTRIES INC

ticker: AEIS


text: Cybersecurity Risk Management Strategy Overview and Goal. Fannie Mae has a multilayered cybersecurity defense strategy. We take a risk-based approach that prioritizes and attempts to plan for the highest impact events first. Our cybersecurity threat operations operate with the goal of identifying, preventing, and mitigating cybersecurity threats and responding to cybersecurity incidents in accordance with incident response and recovery plans.

companyName: FEDERAL NATIONAL MORTGAGE ASSOCIATION FANNIE MAE

ticker: FNMA


text: We do not believe that risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected our business strategy, results of operations or financial condition. However, there is no guarantee that a future cybersecurity incident would not materially affect our future strategy, results or financial condition. For a more in-depth discussion of risks associated with cybersecurity and cybersecurity insurance risks, see Item 1A, "Risk Factors."

companyName: Portillo's Inc.

ticker: PTLO


text: In the last three fiscal years, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, future incidents could have a material impact on our business strategy, results of operations or financial condition. For additional discussion on risks posed by cybersecurity threats, see "Item 1A. Risk Factors - Risks Relating to Our Business and Structure. "

companyName: Prospect Floating Rate & Alternative Income Fund, Inc.


text: Our Chief Information Officer (CIO) and CISO provide cybersecurity updates to the Audit Committee three times each year and the Board at least annually. These updates cover various topics, including information relating to cybersecurity strategy, program management, and performance trends. In addition to this regular reporting, significant cybersecurity risks or threats may also be escalated on as needed basis to the Audit Committee and the Board of Directors.

companyName: SEALED AIR CORP/DE

ticker: SEE


text: The Company's CEO, CFO and General Counsel each hold undergraduate and/or graduate degrees in their respective fields, and each have significant experience managing risks at the Company and at similar companies, including risks arising from cybersecurity threats. The members of the Boards of Directors of the Company and the Bank have hundreds of combined years of experience running successful companies and managing enterprise risk. Specific cybersecurity expertise is brought to the Board from independent directors who lead or have led technology firms and, as such, have direct managerial oversight of cybersecurity risks.

companyName: Stellar Bancorp, Inc.

ticker: STEL


text: The Company manages risks from cybersecurity threats through the assessment and testing of the Company's processes and practices focused on evaluating the effectiveness of our cybersecurity measures. The Company engages a third-party independent cybersecurity company that provides security testing and monitoring, including penetration testing, auditing, and security assessment, for the Company. The results of such assessments and reviews are reported as part of the technology and cyber security update to the Company's executive leadership team and the Board, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by the assessments, audits and reviews.

companyName: MCGRATH RENTCORP

ticker: MGRC


text: Internally to manage potential cybersecurity threats, we have established an Incident Response Plan that is designed to control the workflow of a reported incident. This plan formalizes incidence response stages such that reporting, identification, scope, response, and recovery are executed in a timely manner and identifies the order and coordination of internal and external communication. In addition, the Company addresses crisis management and business continuity with respect to Information Systems to ensure reliable redundancy and recovery of backed-up databases.

companyName: NATURAL ALTERNATIVES INTERNATIONAL INC

ticker: NAII


text: The Company did not experience a material cybersecurity incident in fiscal year 2025. Any incident assessed as potentially being or becoming material will immediately be escalated for further assessment and reported to designated members of our executive leadership team and, if deemed necessary, the Board of Directors. Additionally, we plan to consult with outside counsel, as appropriate, on our materiality determinations, our disclosure requirements, and other compliance decisions. We also plan to keep our independent public accounting firm informed of such incidents, as appropriate. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. Although our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. See Item 1A. "Risk Factors" for a discussion of cybersecurity risks applicable to the Company.

companyName: REV Group, Inc.


text: Our Board considers cybersecurity risk as part of its risk oversight function and our Audit Committee is responsible for the oversight of cybersecurity and other information technology risks. The Audit Committee also oversees management's implementation of our cybersecurity policy. Management will update the Audit Committee, as necessary, regarding any material cybersecurity incidents.

companyName: Highlands REIT, Inc.


text: Management is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Fund, including through the receipt of notifications from service providers and reliance on communications with ISP personnel of the Adviser and AB.

companyName: AB Private Credit Investors Corp


text: Engagement and Continuous Improvement We periodically evaluate our cybersecurity measures through internal and external audits and assessments to ensure our cybersecurity program is at the forefront of industry best practices.

companyName: Alto Ingredients, Inc.

ticker: ALTO


text: Blackstone maintains a comprehensive cybersecurity program, including policies and procedures designed to protect its systems, operations, and the data utilized and entrusted to it, including by BREIT, from anticipated threats or hazards. Blackstone utilizes a variety of protective measures as a part of its cybersecurity program. These measures include, where appropriate, physical and digital access controls, patch management, identity verification and mobile device management software, new hire and annual employee cybersecurity awareness and best practices training programs, security baselines and tools to report anomalous activity, and monitoring of data usage, hardware and software.

companyName: Blackstone Real Estate Income Trust, Inc.

ticker: BSTT


text: As our technology-enabled background and identity verification services involve the collection and transmission of confidential and sensitive information of our clients and their users and existing and potential employees, managing cybersecurity risks is a key component of our enterprise risk management plan. We have a comprehensive risk management and governance strategy in place to assess, identify and manage cybersecurity risks to our business and our proprietary technology platform.

companyName: Sterling Check Corp.


text: Business continuity – Managed data backup utilizing best practices including cloud-based disaster recovery, Multi-vector security protection – Real-time protection against security threats across email, browsers, files, and infrastructure resources, Patch management – Patching for Windows and certain third-party application updates, Infrastructure monitoring – 24x7 monitoring, alerting and maintenance of various office and cloud systems.

companyName: MAYS J W INC

ticker: MAYS


text: We currently do not have a cybersecurity incident response plan with respect to our data and information systems. We rely on our hotel manager and their cybersecurity consultants as well as our franchisors, to maintain cybersecurity incident response plans applicable to their systems and hotel-level systems they manage on our behalf.

companyName: Sotherly Hotels Inc.

ticker: SOHOO


text: Management and Strategy have implemented and maintain various information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical computer networks, hardware, software, third-party hosted services, and data.


text: 1.Policy Framework: Our information security practices include development, implementation, and improvement of policies and procedures to safeguard information and ensure availability of critical data and systems, including our Information Security Policy, which establishes guidelines for the safe and secure use of the Company's information systems and data, and our Electronic Communication Policy, which outlines the responsibilities of those using the Company's network and IT equipment. Employees and third-party service providers are required to comply with our Information Security Policy and our Electronic Communication Policy.

companyName: Bristow Group Inc.

ticker: VTOL


text: Synopsys' cybersecurity policies and procedures are intended to align with multiple industry-recognized frameworks, including the National Institute of Standards and Technology Cyber Security Framework (NIST CSF) and the ISO/International Electrotechnical Commission (IEC) 27001 Information Security Management Framework. In addition, some Synopsys products are ISO 27001 and/or SOC2 Type 2 certified. Our internal audit department regularly assesses our conformity with these frameworks. We track our NIST CSF implementation through regular third-party maturity assessments, which provide the basis for establishing performance goals for the coming period. We also closely monitor the ever-changing landscape of related laws and regulations and regularly update our policies and processes to promote continued compliance.

companyName: SYNOPSYS INC

ticker: SNPS


text: While we have not experienced any risks from cybersecurity threats, including those resulting from previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition, there can be no guarantee that we will not be the subject of future successful attacks, threats or incidents. We also rely on information technology and third party vendors to support our operations, including our secure processing of personal, confidential, sensitive, proprietary and other types of information. Despite ongoing efforts to continue improvement of our and our vendors' ability to protect against cyber incidents, we may not be able to protect all information systems, and such incidents may lead to reputational harm, revenue and client loss, legal actions, statutory penalties, among other consequences. Additional information on cybersecurity risks we face can be found in Part I, Item 1A "Risk Factors" of this Form 10-K under the heading "Risks Related to our Business," which should be read in conjunction with the foregoing information.

companyName: Consensus Cloud Solutions, Inc.

ticker: CCSI


text: Protecting the security of our information systems is of significant importance to Flowers. We follow certain policies, protocols, and practices that address cybersecurity.

companyName: FLOWERS FOODS INC

ticker: FLO


text: The Audit Committee of the Board of Directors (the "Audit Committee") oversees the Company's assessment and management of material cybersecurity risks. The CTO reports to the Audit Committee on Mattel's cybersecurity, including material cybersecurity risks and mitigation, at least annually. The CTO reports and escalates cybersecurity incidents to management and the Audit Committee as appropriate.

companyName: MATTEL INC /DE/

ticker: MAT


text: The management team consists our Vice President and General Manager of the High Performance Products segment, which has developed cybersecuritiy software at the Company that multiple Fortune 500 companies are currently using. In addition, he has been the Chief Technical Officer and served in various roles at several cybersecuritiy companies over his 40 year career. He holds a Bachelor of Science in Business and Engineering as well as a Masters of Science in Finance. Also on the team is the Vice President of Managed services at the Technology Solutions segment, who has over twenty years of technology experience including the monitoring and management of other oganization's security systems.

companyName: CSP INC /MA/

ticker: CSPI


text: Company management is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Company management is also responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: MACROGENICS INC

ticker: MGNX


text: We are subject to and routinely face cyber-based attacks and attempts by hackers and similar unauthorized users seeking to gain access to or corrupt our information technology systems. As of December 31, 2023, we are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected us, including our business strategy, results of operations, or financial condition, or that we believe are reasonably likely to have such an effect over the long term. However, there can be no assurance that we will be able to successfully mitigate the negative impacts of cybersecurity threats in the future. Accordingly, we continue to prioritize our cybersecurity risk management despite the lack of identified material impacts to date.

companyName: FTI CONSULTING, INC

ticker: FCN


text: Our ability to effectively manage our business, coordinate the production, distribution and sale of our products and ensure the timely and accurate recording and disclosure of financial information depends significantly on the reliability and capacity of our information technology systems. While we have taken what we believe are appropriate precautions to protect our systems, and to date, we have not experienced any material adverse events related to a security breach or cyber-attack, the failure of these systems to operate effectively, the failure of our personnel to follow established procedures, problems with transitioning to upgraded or replacement systems, or a breach in security of these or otherwise could cause delays and/or interruptions in plant operations, product sales, reduced efficiency of our operations and delays in reporting our financial results.

companyName: REX AMERICAN RESOURCES Corp

ticker: REX


text: Our cybersecurity program is managed by the Company's Security and Corporate Engineering organization, which is led by our CSO, who reports directly to the CEO. Our CSO has over twenty years of experience in the security industry and has held a variety of leadership positions in cybersecurity at Capital One, including as Vice President, Divisional Chief Information Security Officer. Additionally, several of Robinhood's subsidiaries, including RHC, RHF, and RHS, have a Chief Information Security Officer, who reports to the CSO, and a Risk Operating Committee ("ROC") that manages risks, including cybersecurity risks, specific to each entity's business. Each of our Chief Information Security Officers has expertise in cybersecurity, industry and regulatory standards, risk management, and security operations. The Security organization elevates risks to the relevant ROCs where applicable. Our cybersecurity program is aligned with industry standards and best practices, such as the NIST CSF, and we engage third-party consultants annually to conduct a NIST CSF maturity assessment of our cybersecurity program.

companyName: Robinhood Markets, Inc.

ticker: HOOD


text: Our CSRO has 24 years of experience working in information technology and cybersecurity roles including software development, identity and access management projects, privilege account management and multi-factor authentication implementations. While in those roles, our CSRO has led projects and implementations for a variety of organizations that assess and create solutions for security concerns. The CSRO currently reports to the CIO.

companyName: HORTON D R INC /DE/

ticker: DHI


text: At the management level, our Vice President of Information Technology, who has extensive cybersecurity knowledge and skills gained from over 18 years of work experience at our company and elsewhere, heads the team responsible for implementing, monitoring, and maintaining information security and cybersecurity practices across our businesses and reports directly to the Chief Financial Officer.

companyName: PATTERSON UTI ENERGY INC

ticker: PTEN


text: Our board of directors and senior management recognize the critical importance of maintaining the trust and confidence of our clients, business partners and employees. Our management, led by our Chief Executive Officer, is actively involved in oversight of our risk management efforts, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM"). Our cybersecurity processes and practices are fully integrated into the Company's ERM efforts. In general, we seek to address cybersecurity risks through a cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: APPlife Digital Solutions Inc

ticker: ALDS


text: Manhattan has incorporated industry recognized cybersecurity frameworks and standards into its Cyber Program, including frameworks from the National Institute of Standards and Technology (NIST) and security control auditing protocols from the Center for Internet Security (CIS) and the International Organizations for Standardization (ISO). Recognizing that the nature of cybersecurity threats and the particular threat vectors we face continually change, we continue to invest in updating and enhancing our Cyber Program. Annually, as part of Manhattan's budgeting process, our Senior Director, Global Security, submits to our CIO their recommendations for Cyber Program enhancements, including the associated capital requests, for inclusion in the CIO's proposed IT budget. Those recommendations are then evaluated at the executive level, taking into account the projected return on investment and the anticipated enhancement of our cybersecurity risk profile.

companyName: MANHATTAN ASSOCIATES INC

ticker: MANH


text: Our programs are focused on building digital trust through sound oversight of cybersecurity and data privacy protections and the responsible use of data and technology. We operate a CWG, and we have a cross-functional approach to addressing cybersecurity-related risks through the functional compliance structures in our digital technology.

companyName: Nuvve Holding Corp.

ticker: NVVE


text: Company proactively mitigates its financial exposure to cybersecurity incidents by maintaining a cyber liability insurance policy. However, the Company's cyber liability insurance may be inadequate or may not be available in the future on acceptable terms, or at all.

companyName: Actinium Pharmaceuticals, Inc.

ticker: ATNM


text: Incident Response Plan. To ensure that information security incidents can be recovered from quickly and with the least impact to the Company and its customers, the Company maintains a structured and systematic incident response plan (the "IRP") for all information security incidents that affect any of the IT systems, network, or data of the Company, including the Company's data held, or IT services provided by third-party vendors or other service providers. The CISO is responsible for implementing and maintaining the IRP, which includes:

companyName: NB Bancorp, Inc.

ticker: NBBK


text: We continuously monitor our information systems to assess, identify, and manage risks from vulnerabilities and assess cybersecurity threats. Our process for identifying and assessing material risks from cybersecurity threats operates alongside our broader overall risk assessment process. We monitor risks through routine security assessments and implementation of enhancements to security measures used to protect our systems and data. We address system alerts on an ongoing basis. We maintain an Incident Response Plan Policy ("IRP"), which sets forth processes we will follow to address incidents as defined in the IRP, which include an actual or reasonably suspected cyber incident. Our information technology team promptly responds to system alerts and reported incidents that indicate the suspected presence of an incident and escalates in accordance with the IRP. The IRP, among other things, provides for a cross-functional team consisting of representatives from informational technology, risk management, legal, and communications, an Incident Response Team ("IRT"), that collaborates to quickly assess the impact, mitigate risks to information systems, and resolve incidents while improving information systems. Depending on the incident, we may utilize third-parties for assistance in investigating and addressing cybersecurity incidents.i We also utilize certain third-party service providers to perform a variety of critical business functions and recognize that we are exposed to cybersecurity threats associated with our use of third-party service providers. We have certain vendor management processes designed to help manage cybersecurity risks associated with our use of certain of these providers. Additionally, we strive to minimize cybersecurity risks when we first select or renew a vendor by including cybersecurity risk as part of our overall vendor evaluation and due diligence process.

companyName: Nkarta, Inc.

ticker: NKTX


text: Our VP of IT has more than six years of experience in cybersecurity and oversees our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. Our VP of IT is primarily responsible for assessing and managing our material risks from cybersecurity threats, including monitoring and assessing strategic risk exposure.

companyName: Arq, Inc.

ticker: ARQ


text: We have established an Information Security Management System (the "ISMS"), which is integrated into our overall risk management system, to help us achieve our business goals. The ISMS defines our information security risk management approach and specifies the requirements for establishing, implementing, operating, monitoring, reviewing, maintaining and improving a risk assessment framework within the context of our overall business risks. The ISMS also specifies the requirements for implementing security controls designed to meet the needs of individual departments or parts thereof.

companyName: ProPetro Holding Corp.

ticker: PUMP


text: We also have a cybersecurity incident response plan for the CIRT to assess and manage cybersecurity incidents, which includes escalation procedures based on the nature and severity of the incident including, where appropriate, escalation to the Board.

companyName: SCANSOURCE, INC.

ticker: SCSC


text: Our Director of Information Technology has over 20 years of experience in information technology and five years of experience serving directly as a Chief Information Security Officer for other organizations.

companyName: Alto Ingredients, Inc.

ticker: ALTO


text: Our board of directors provides oversight and oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Two of our management have received training on cyber risk governance for public companies, regularly brief our board of directors on our cybersecurity and information security posture as well as cybersecurity incidents deemed to have a moderate or higher business impact, even if viewed as immaterial to us. As cyber threats evolve and become more sophisticated, we believe that the board's involvement in cybersecurity governance ensures that we are adequately focused on resources and protecting the Company's assets and reputation.

companyName: LEAFBUYER TECHNOLOGIES, INC.

ticker: LBUY


text: At the management level, our Chief Technology Officer and our Senior Vice President, Technology and Innovation, as well as our technology staff, are primarily responsible for identifying, assessing, monitoring and managing our cybersecurity. Our Chief Technology Officer reports directly to our President and Chief Executive Officer and meets at least quarterly with the Cyber Committee. Our current Chief Technology Officer has over 35 years of industry experience, including service as a Chief Technology Officer/Chief Information Officer for over seven years and extensive experience in developing and leading technology risk management programs. Our Senior Vice President, Technology and Innovation reports directly to the Chief Technology Officer and has over 32 years of industry experience with the Company. He has led the Company's cybersecurity team and overseen PCI certification for the past seven years, ensuring compliance with industry standards and strengthening the organization's security posture. Additionally, our technology staff holds multiple industry-standard security certifications, including Cisco Certified Network Associate, PCI Internal Security Assessor, and Certified Ethical Hacker.

companyName: DESTINATION XL GROUP, INC.

ticker: DXLG


text: We have developed a robust cyber crisis response plan which provides a documented framework for handling high severity security incidents and facilitates coordination across multiple parts of the company. Our incident response team constantly monitors threat intelligence feeds, handles vulnerability management and responds to incidents. In addition, we routinely perform training, simulations, and drills across company personnel.

companyName: IZEA Worldwide, Inc.

ticker: IZEA


text: Given the increasing cybersecurity threats in the healthcare industry, there can be no assurance we will not experience business interruptions; data loss, ransom, misappropriation or corruption, theft, or misuse of proprietary data, patient or other personally identifiable information; or litigation, investigation, or regulatory action related to any of those, any of which could have a material adverse effect on our patient care, ability to admit patients and to bill and collect for services provided on a timely basis, financial position, and results of operations and could harm our business reputation. Accordingly, no matter how well our program is designed or implemented, we will not be able to anticipate all security breaches, and we may not be able to implement effective preventive measures against such security breaches in a timely manner.

companyName: CareMax, Inc.


text: To establish, implement, and evaluate our risk management policies and practices with respect to cybersecurity threats, and to facilitate the communication of such matters to the Board, the TISOC, and the Audit Committee, as applicable, we have established a number of management committees, several of which include senior leaders and direct reports of the Company's President and CEO, that serve as our policymaking and management-level governing bodies with respect to our information security and data privacy programs; oversee the implementation of our information security and data privacy risk management strategy; and identify, consider, and escalate information security and data privacy issues that may arise in our business.

companyName: MARRIOTT INTERNATIONAL INC /MD/

ticker: MAR


text: Technical Safeguards. We have improved our endpoint security postures through the implementation of an Enterprise Mobile Management system, and continue to increase our investment in strengthening email, DNS, and other network security services.

companyName: Archer Aviation Inc.

ticker: ACHR


text: The Company's CDO has extensive experience in establishing and maintaining scalable and secure technology systems and is responsible for maintaining the Company's various digital platforms. Our CDO worked in various systems, information technology and digital managerial roles at a global financial and investment firm prior to joining the Company. Our CDO's technical and managerial experience is helpful for developing and executing our cybersecurity strategies. The CDO helps to oversee the Company's efforts to improve its system's capabilities, reliability, scalability and security.

companyName: Metropolitan Bank Holding Corp.

ticker: MCB


text: The Company engages third parties to assist with the monitoring components of the security infrastructure that we have deployed. As required, the Company engages consultants and third parties to assist with penetration testing, tabletop incident response exercises, or other activities necessary to comply with various standards and certifications that we require to operate as a business. The Company provides regular awareness training to our employees and consultants using our collaboration platforms, including periodic phishing tests, to help identify, avoid, and mitigate cybersecurity threats, as well as targeted security training for key departments dealing with sensitive data types. Where needed, the Company seeks appropriate certifications from vendors and contractually requires adherence to data privacy and security requirements from its vendors. Where service providers are materially utilized, the company obtains SOC1 or SOC2 reports and complies with complementary user entity controls to keep those attestations valid.

companyName: Vestis Corp

ticker: VSTS


text: We regularly engage consultants and other third parties to assist in developing, maintaining, and enhancing our cybersecurity risk assessment program. These third-party engagements supplement our internal capabilities and help ensure the robustness of our program. Examples of these engagements include penetration testing of our customer facing domains, quarterly cybersecurity briefings with outside counsel, and an annual assessment of our overall cybersecurity program. We maintain policies and procedures to identify and monitor cybersecurity risks associated with these third-party service providers, particularly those with access to customer, employee, or other sensitive data. Our selection and oversight of these providers includes diligence reviews, contractual protections, and other measures to mitigate these risks over the entire lifecycle of the relationship, including through implementation of the CIS Critical Security Controls. In addition to these prevention measures, we work proactively to detect and minimize the impact of cybersecurity incidents. We have a written incident response plan designed to ensure the appropriate internal and, if necessary, external resources are employed to promptly and effectively respond to potential breaches, minimize any related damage, and avoid disruption to our operations. We routinely test our incident response process through simulated incidents. No risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. While we have not experienced any cybersecurity incidents or threats that have materially impacted us or our business, we have encountered incidents in the past, which we have used to improve our program and defenses. Since it is possible we could experience a material cybersecurity incident in the future, we remain diligent in maintaining and continuously improving our program in an effort to prevent such incidents and, if one was to occur, to manage it effectively.

companyName: NEOGEN CORP

ticker: NEOG


text: To date, we have not experienced any material cybersecurity incidents, and there has been no known unauthorized access to our systems. Should any reportable cybersecurity incident arise, our management shall promptly report such matters to the Company's Board of Directors (the "Board")

companyName: Transportation & Logistics Systems, Inc.

ticker: TLSS


text: Security Awareness All employees are required to undertake security awareness training on a number of topics to include phishing awareness, importance of cybersecurity and proper cyber hygiene, insider threat awareness and roles and responsibilities. Our IT and security teams regularly update training modules being leveraged in order to provide timely and relevant awareness, as well as to aid in better individual engagement with the training.

companyName: Loar Holdings Inc.

ticker: LOAR


text: The Board of Directors oversees the IS Program in the following ways: (a) monitors and oversees the Company's business and information technology operations necessary for its business plan, including projected growth, technology capacity, planning, operational execution, product development and management capacity, (b) reviews the Company's framework(s) to prevent, detect, and respond to cyberattacks or breaches, as well as identifying areas of concern regarding possible vulnerabilities, and reviews policies pertaining to information security and cyber threats, taking into account the potential for external threats, internal threats, and threats arising from transaction and contractual relationships with trusted third party vendors, and (c) reviews the Company's incident response, business continuity and disaster recovery planning and preparedness including processes, policies and procedures that are related to preparing for recovery or continuation of technology infrastructure which are vital to the Company. As part of the Board's oversight, the Board receives frequent reports from the CIO and ISO including the summarization of new and emerging cybersecurity threats and trends and the effectiveness of our IS Program in mitigating cybersecurity threats among other items. In the event of an information security incident, our Incident Response Plan clarifies the steps for escalation according to the severity of the event.

companyName: CSB Bancorp, Inc.

ticker: CSBB


text: With respect to management, our CIO, who reports directly to our chief executive officer, has over 20 years of experience with our company, including more than 10 years serving in technology-based leadership roles. Our VP, Infrastructure, Operations & Security, who reports directly to the CIO, serves as our ISO and has extensive cybersecurity experience gained from over 20 years serving in security-related roles for the Company. Our ISO, together with our technology management security team, is responsible for developing, maintaining and enhancing systems and processes necessary to protect confidential information from loss, theft, and unauthorized access or use. This team also monitors the systems and networks to detect unauthorized activity or access, responding to any such unauthorized attempts to mitigate loss or to ensure the cessation of all unauthorized access to data. If an incident is identified, this team reports such events to the CIO, who will then, as appropriate, advise the chief executive officer, chief legal officer and other management, as well as others, potentially including law enforcement or clients. We have also established a Risk Committee consisting of members of our finance, legal and technology management departments whose duties include assessing the materiality of any identified incidents to help ensure compliance with the SEC's cybersecurity incident disclosure rules.

companyName: FORRESTER RESEARCH, INC.

ticker: FORR


text: We have not identified risks from known cybersecurity threats, including as a result of previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its operations, business strategy, results of operations, or financial condition.

companyName: GATX CORP

ticker: GATX


text: While cybersecurity threats remain a reality for all organizations, SES is committed to proactive risk management and continuous improvement in our security posture. We believe that the processes we have established for assessing, identifying, and managing material risks from cybersecurity allow us to effectively mitigate potential impacts and protect our business, operations, and products:

companyName: SES AI Corp

ticker: SES


text: More broadly, the Audit Committee reviews our policies and practices with respect to risk assessment and risk management, including results from our overall Enterprise Risk Management ("ERM"), and discusses with management our major financial risk exposures and the steps that have been taken to monitor and control such exposures. Cybersecurity is a key piece of our overall ERM program. The Audit Committee oversees the activities of, and meets regularly with, our Chief Compliance Officer, and receives direct reports from the Chief Compliance Officer regarding the ERM structure and activities of our compliance program, including updates on training, policies, auditing and monitoring, investigations and any corrective and preventive actions. As part of the ERM program, our Chief Compliance Officer gathers information about cybersecurity risk, and that information is included in the Chief Compliance Officer's report to the Audit Committee.

companyName: GRAIL, Inc.

ticker: GRAL


text: We recognize a cybersecurity incident experienced by a supplier or joint venture partner could materially impact us. We assess third party cybersecurity controls as part of our third party IT risk due diligence and engage in cybersecurity consultant-led solution design reviews when integrating new tools or third parties. We contractually require third parties to report cybersecurity incidents to us so we can assess the impact of the incident and any necessary regulatory reporting obligations that may be required.

companyName: GOODYEAR TIRE & RUBBER CO /OH/

ticker: GT


text: Should a cybersecurity event occur, the IR Team would review and assess the incident and determine whether further escalation and regulatory reporting is required. Any incident assessed as potentially being or becoming material is immediately escalated to the Audit Committee, and meetings of the Audit Committee and/or full Board of Directors would be held, as required.

companyName: Karat Packaging Inc.

ticker: KRT


text: With respect to overseeing and identifying cybersecurity risks associated with third parties, we seek to impose certain cybersecurity requirements on critical third parties with whom we do business. The cybersecurity team performs risk assessments, due diligence checks and validation of key security controls in accordance with our cybersecurity policies and standards for third-party vendors and service providers with whom we exchange information or integrate our information systems and networks. We include cybersecurity and privacy addenda and clauses in our agreements with such third parties where applicable and seek to pass through any necessary regulatory and contractual requirements to such third parties. When we do become aware that a third-party vendor or service provider has experienced a compromise or failure, we attempt to mitigate our risk, including by terminating such third party's connection to our information systems and networks where appropriate or by exercising any applicable contractual remedies we may have, such as a right to indemnification.

companyName: Mobileye Global Inc.

ticker: MBLY


text: We appreciate the importance of preventing, assessing, identifying, and managing material risks associated with cybersecurity threats. In the ordinary course of our business, we collect and store certain confidential information about our employees, contractors, vendors, and suppliers. Consequently, we have established processes for managing material risks posed by cybersecurity threats.

companyName: Harbor Custom Development, Inc.


text: We maintain policies and procedures for the safe storage, handling, and secure disposal of customer and employee information. Each employee is expected to be responsible for the security and confidentiality of customer information, and we communicate this responsibility to employees upon hiring and regularly throughout their employment. Annually, we provide employees with mandatory security awareness training. The curriculum includes the recognition and appropriate handling of potential phishing emails, which could place sensitive customer or employee information at risk. We employ a number of technical controls to mitigate the risk of phishing emails targeting employees.

companyName: Primis Financial Corp.

ticker: FRST


text: Our objective for managing cybersecurity risk is to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse our system or information. The structure of our information security program is designed around the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, regulatory guidance, and other industry standards. In addition, we leverage certain industry and government associations, third-party benchmarking, audits, and threat intelligence fees to facilitate and promote program effectiveness. Our Computer Systems Operations Manager and Information Security Officer, who report directly to our board of directors, regularly collaborate with peer banks and industry groups to discuss cybersecurity trends and issues and identify best practices. The information security program is reviewed by such personnel with the goal of addressing changing threats and conditions.

companyName: Fifth District Bancorp, Inc.

ticker: FDSB


text: We recognize the critical importance of maintaining the trust and confidence of customers, patients, business partners and employees toward our business and are committed to protecting the confidentiality, integrity and availability of our business operations and systems. Our board of directors is actively involved in oversight of our risk management activities, and cybersecurity represents an important element of our overall approach to risk management. Our cybersecurity policies, standards, processes and practices are based on recognized frameworks established by the National Institute of Standards and Technology, or NIST and other applicable industry standards. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: DermTech, Inc.


text: Intellectual Property Theft: Unauthorized access to our proprietary information could result in intellectual property theft, impacting our competitive position in the market.

companyName: LEAFBUYER TECHNOLOGIES, INC.

ticker: LBUY


text: Our cybersecurity program is overseen by our Senior Vice President and CIO, who has nearly four decades of experience in information technology, including two decades as a CIO, having previously held CIO roles with other organizations, as well as experience in the utility sector. The CIO oversees a team dedicated to the support of cybersecurity tools and the overall cybersecurity program. The CIO reports to the Executive Vice President and CFO. The CIO provides periodic briefs regarding prevention, detection, mitigation and remediation of cybersecurity incidents, as well as risks, threats and the threat landscape to the Board and executive management, including the CEO, CFO and CAO. These briefs are used to help continuously improve our cybersecurity program and to inform risk assessments as part of the ERM program.

companyName: WISCONSIN POWER & LIGHT CO


text: In addition, updates on our cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape may also be reported to senior management and the board of directors, including the Audit Committee, by the Head of IT, as appropriate. Our senior management team and board of directors include several members with operational experience overseeing IT operations, including risk assessment and implementation of security measures. As of the date of this report, we are not aware of any material risks from cybersecurity threats, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition.

companyName: Autolus Therapeutics plc

ticker: AUTL


text: Cybersecurity threats have the potential to disrupt our day-to-day operations, compromise sensitive data, and damage our reputation. While we have not experienced any material cybersecurity incidents to date, we acknowledge the potential impact of such threats on our business strategy, operations, and financial status. Additionally, regulatory fines or legal liabilities resulting from data breaches or non-compliance with cybersecurity standards will have a significant financial impact.

companyName: Altus Power, Inc.


text: Engagement of Third-Parties Our GISO partners with third-party cybersecurity service and product vendors to provide protection of our networks, information resources, products, services and data of our customers and employees. Furthermore, our GISO engages third-party cybersecurity and data protection experts to perform assessments on the efficacy of our cybersecurity program and measures, including cybersecurity maturity assessments, audits and independent reviews of our cybersecurity control environment and operating effectiveness. Our Chief Information Security Officer reports the results of such assessments, audits and reviews to our executive team and our Audit Committee.

companyName: Liberty Latin America Ltd.

ticker: LILA


text: Third-parties on Risk Management the complexity and evolving nature of cybersecurity threats, Bioxytran engages external experts, including cybersecurity assessors and auditors in evaluating and testing our risk management systems. These partnerships enable us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes remain at the forefront of industry best practices. Our collaboration with these third-parties includes regular audits, threat assessments, and consultation on security enhancements.

companyName: BIOXYTRAN, INC

ticker: BIXT


text: Visa's Approach to Cybersecurity As a global company providing payment services to consumers and companies around the world, trust is an indispensable asset. A strong cybersecurity program is a key element to maintaining this trust. As a result, we consider cybersecurity risk one of our key enterprise risks and we assess, identify, and manage such risk as part of our overall enterprise risk management framework. See Item 1A for further discussion on our overall risk factors, including technology and cybersecurity risks.

companyName: VISA INC.

ticker: V


text: We have relationships with a number of third-party service providers to assist with cybersecurity event and incident identification, response, containment and remediation efforts.

companyName: MARINUS PHARMACEUTICALS, INC.


text: Management's Role in Assessing and Managing Material Risks from Cybersecurity Threats The Information Security Steering Committee ("ISSC") is a key element of our cybersecurity strategy. The ISSC is chaired by the CISO and comprises of a cross-functional group of senior leaders from various functions in the company. The ISSC aims to align our security and compliance programs with business objectives. Specifically, the ISSC (i) facilitates identification of risk-based priorities and trade-offs; (ii) aims to ensure economies of scale and consistency of information security and compliance across IT assets at the company; (iii) reviews and approves information security policies; (iv) reviews requests for policy and risk exceptions to provide a "Risk Acceptance Authorization"; and (v) serves as a communications channel and steward to cultivate a culture of trust across the enterprise.

companyName: EQUINIX INC

ticker: EQIX


text: Managing Material Risks & Integrated Overall Risk Management We have strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. Our Company's Corporate Security Handbook and Information Security Program are the guiding policies over our cybersecurity risk management. Additionally, our IT team uses industry-leading tools to help protect stakeholders against cybercriminals. We leverage the latest encryption practices and cyber technologies on our systems, devices, and third-party connections and further review vendor encryption to ensure proper information security safeguards are maintained. Our Company team members are responsible for complying with our cybersecurity standards and complete training to understand the behaviors and technical requirements necessary to keep information secure.

companyName: HERITAGE COMMERCE CORP

ticker: HTBK


text: Our goal is to protect all the assets of our clients and safeguard the proprietary and confidential information of Westwood and its employees, which is a fundamental responsibility of every Westwood employee. Westwood is responsible for distributing our policies and procedures to employees and conducting appropriate employee training to ensure employees' adherence to our policies and procedures. Repeated or serious violations of our policies by employees or independent contractors may result in disciplinary action against such persons, which may include restricted permissions or prohibitions and/or termination.

companyName: WESTWOOD HOLDINGS GROUP INC

ticker: WHG


text: The Board of Directors is responsible for providing oversight of our Framework. The Risk Committee of the Board of Directors ("Risk Committee") assists the full Board of Directors in discharging these responsibilities.

companyName: CAPITAL ONE FINANCIAL CORP

ticker: COF


text: Role of the Board The Audit Committee of our Board of Directors (the "Board") has the responsibility for the oversight of risk management, including those risks related to cybersecurity. The Board holds strategic planning sessions with senior management to discuss strategies, key challenges, risks and opportunities for mitigation. The involvement of our Board in setting our business strategy is a key part of its oversight of risk management, its assessment of management's appetite for risk, and its determination of what constitutes an appropriate level of risk for us. Our senior management attends meetings of our Board and its committees on a quarterly basis, and management communicates with the Board and its members regularly between Board meetings as otherwise needed and are available to address any questions or concerns raised by our Board on risk management and any other matters.

companyName: NATURAL ALTERNATIVES INTERNATIONAL INC

ticker: NAII


text: Our Senior Vice President and Chief Information Officer and our Vice President, Global Cybersecurity, update the Audit Committee regularly regarding the status of ongoing cybersecurity initiatives and strategies and incident reports. They also present information to the Audit Committee regarding management's cybersecurity risk and maturity assessments, including changes to our cybersecurity roadmap as a result of these assessments. This briefing is also posted to the full Board, which also receives quarterly updates through the Audit Committee. In accordance with the Company's policies and incident response plans, based on the severity of the incident, the Audit Committee is notified and briefed. The Board and executive management participate in cybersecurity training and conduct tabletop exercises on a periodic basis.

companyName: ACCO BRANDS Corp

ticker: ACCO


text: Physical Safeguards: We deploy physical safeguards such as facility access control via keycard access and security cameras. In addition, workstation and device security is controlled with proper logging and identity access controls to protect our physical assets.

companyName: VERACYTE, INC.

ticker: VCYT


text: Cybersecurity incident policies: We have cybersecurity incident policies, an incident response plan and a dedicated team to respond to cybersecurity incidents, including experienced counsel. When a cybersecurity incident occurs or we identify a vulnerability, the dedicated team is responsible for leading the initial assessment of priority and severity, including external experts that may also be engaged as appropriate. NeurAxis' response to incidents depends on the severity level and seeks to improve its cybersecurity incident response plan. NeurAxis, through experienced cybersecurity and HIPAA/HITECH counsel, has developed a security manual and a privacy policy.

companyName: Neuraxis, INC

ticker: NRXS


text: Our cybersecurity governance program is informed by the National Institute of Standards and Technology ("NIST") Cybersecurity Framework and measured by the Maturity and Risk Assessment Ratings associated with the NIST Cybersecurity Framework and the Capability Maturity Model Integration. In addition, our cybersecurity risk management program includes processes to assess cybersecurity risks related to third-party vendors and suppliers.

companyName: MAMMOTH ENERGY SERVICES, INC.

ticker: TUSK


text: from Cybersecurity Threats As of the date of this Annual Report, we are not aware of any previous cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations and financial condition. We acknowledge that cybersecurity threats are continually evolving, and the possibility of future cybersecurity incidents, material or otherwise, remains. Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cybersecurity incident will not occur. While we devote resources to our security measures designed to protect our systems and information, no security measure is infallible. For more information about the cybersecurity risks we face, refer to "Item 1A. Risk Factors" in this Annual Report.

companyName: INFINITY NATURAL RESOURCES, INC.

ticker: INR


text: The Adviser closely collaborates with J.P. Morgan to understand the full spectrum of cybersecurity risks in the operating environment, enhance defenses and improve resiliency. J.P. Morgan actively participates in discussions and simulations of cybersecurity risks internally and administers ongoing initiatives to educate its employees on cybersecurity risks.

companyName: J.P. Morgan Real Estate Income Trust, Inc.


text: As of the date of this report, we have not experienced any known cybersecurity incidents, or a series of related incidents, that have materially affected or are reasonably likely to affect us, including our business strategy, results of operations or financial condition. For an additional description of these cybersecurity risks and potential related impacts on us, see "Risk Factors" in Part I, Item 1A of this Form 10-K.

companyName: Lantheus Holdings, Inc.

ticker: LNTH


text: Murphy considers its protection from cybersecurity threats to be a core component of its overall enterprise risk management system. Murphy's cybersecurity risk management framework consists of cyber readiness, cybersecurity governance, and risk management strategy. The cybersecurity risk management framework is incorporated into the overall enterprise risk management process through policies, procedures, periodic simulations, and constant monitoring of the cybersecurity environment for new and emerging threats. The Company also requires employees to receive regular cybersecurity training and education to mitigate cybersecurity risks. To remain informed of the cybersecurity landscape, the Company collaborates with peers, third party advisors, industry groups and policymakers.

companyName: MURPHY OIL CORP

ticker: MUR


text: We describe whether and how risks from cybersecurity threats have materially affected or are reasonably likely to materially affect us, our business strategy, results of operations, or financial condition under the headings "We may be the victim of business disruptions and security breaches, including cyber-attacks, which could lead to liability or could damage our reputation and financial results" and "We may be subject to information technology failures that could damage our reputation, business operations and financial condition" included as part of our risk factors disclosures in Item 1A. Risk Factors of this Annual Report on Form 10-K.

companyName: SILICON LABORATORIES INC.

ticker: SLAB


text: Engaging Third Parties for Risk Management We recognize the complexity and evolving nature of cybersecurity threats, which is why we engage a range of external experts, including cybersecurity consultants, in evaluating and testing our risk management systems. Our IT security team partners with third-parties to perform annual penetration testing, vulnerability scanning, and monitoring of any potentially suspicious activity across the Company.


text: The VP of Global Technology, working together with a team of cybersecurity professionals and third-party consultants, monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents, and reports such threats and incidents to the senior leadership team when appropriate.

companyName: Champion Homes, Inc.

ticker: SKY


text: The Board of Directors is acutely aware of the critical nature of managing risks associated with cybersecurity threats. The Board has established robust oversight mechanisms to ensure effective governance in managing risks associated with cybersecurity threats because we recognize the significance of these threats to our operational integrity and stakeholder confidence.

companyName: CATALYST PHARMACEUTICALS, INC.

ticker: CPRX


text: Our cybersecurity risk management processes, which are discussed in greater detail above, are led by our CISO, who has over 20 years of work experience relating to cybersecurity, including at major financial institutions and consulting firms, involving the management of information security and the development of cybersecurity strategy, as well as relevant degrees and certifications, including holding a Bachelor of Science degree in Electrical and Computer Engineering. Our CISO oversees a team of approximately 50 professionals charged with the on-going management of our cybersecurity risk and strategy. These employees are informed about, and monitor the prevention, mitigation, detection, and remediation of, cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our ITROC, incident response plan and other processes. Our cybersecurity team includes managers that have expertise with cybersecurity, as demonstrated by prior work experience, possession of a cybersecurity certification or degrees or other cybersecurity experience. As detailed above, these members of management and management-level committees report to the Audit Committee about cybersecurity threat risks, among other cybersecurity-related matters, at least quarterly.

companyName: MSCI Inc.

ticker: MSCI


text: Our board of directors considers cybersecurity risk part of its risk oversight function and has delegated to the Audit Committee of our board of directors oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program. The relevant members of management regularly update the Audit Committee with respect to cybersecurity risk, also on an ad-hoc basis as necessary, regarding any material cybersecurity incidents and any incidents with lesser impact potential. The Audit Committee periodically reports to the full board of directors regarding its activities, including those related to cybersecurity.

companyName: KalVista Pharmaceuticals, Inc.

ticker: KALV


text: Our cybersecurity framework is designed to protect our customers, employees, investors, and our intellectual property. Before purchasing third-party technology or other solutions that could expose the Company's assets and electronic information, our Information Security and Information Technology teams complete security reviews on the vendors. We also conduct ongoing reviews of cybersecurity risks associated with our third-party service providers. As part of the Company's Vendor Management Program, annual reviews are conducted for certain third-party vendors. Members of our Information Security team work with our Vendor Management team to review System and Organization Controls ("SOC") 1 or SOC 2 reports. In the event a third-party vendor is unable to provide either a SOC 1 or SOC 2 report, this group conducts additional reviews to assess the cybersecurity preparedness of the specific vendor. This assessment of the risks associated with the use of third-party service providers is part of our overall vendor management and cybersecurity risk management framework.

companyName: BROOKLINE BANCORP INC


text: Our Director of IT Governance and Response, who manages our cybersecurity program, is currently on leave and expects to retire from the Company in January 2025. During this time and until we appoint a new Director of IT Governance and Response, our Vice President - Information Technology ("VP-IT"), who has extensive cybersecurity knowledge and skills gained from 25 years of information technology work experience at the Company and elsewhere, has assumed responsibilities for this role with the assistance of a third party security leadership service. The VP-IT reports directly to our Senior Vice President of Information Technology and Engineering, who provides oversight of cybersecurity risk and mitigation strategies.

companyName: Helmerich & Payne, Inc.

ticker: HP


text: While our ISP works to create a hardened information technology systems environment, our Adviser and Administrator also regularly trains employees working on our behalf on the evolving threats and educates them on cybersecurity risks to provide an additional protection barrier through end-user knowledge. Whether it is communicating information about the latest cybersecurity threats, assessing employees' awareness through mock fraud exercises, social engineering and phishing campaigns, or providing access to a library of educational material about past and newly-evolving cybersecurity attacks, our Adviser and Administrator work in concert with the ISP on our behalf to keep employees servicing us informed so as to provide an additional protection barrier through end-user knowledge.

companyName: GLADSTONE LAND Corp

ticker: LAND


text: We collect and analyze information about cybersecurity risks as part of our risk management program and monitor and discuss public alerts, threat levels, trends and remediation. All employees receive periodic cybersecurity training designed to educate concerning the recognition of cybersecurity threats.

companyName: Airspan Networks Holdings Inc.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: cybersecurity-related policies and procedures (including incident response plans and policies, a vulnerability management policy, disaster recovery/business continuity plans), incident detection and response, periodic risk assessments, implementation of security standards/certifications, encryption of data, network security and system monitoring controls (including technology solutions such as antivirus, firewalls and monitoring tools), awareness training for all employees, security measures, asset management, tracking and disposal, penetration testing, cybersecurity insurance coverage, and a dedicated cybersecurity staff.

companyName: Nuvation Bio Inc.

ticker: NUVB


text: For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to "Item 1A. Risk Factors" in this Annual Report on Form 10-K.

companyName: ALX ONCOLOGY HOLDINGS INC

ticker: ALXO


text: We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations, or financial condition.

companyName: Inozyme Pharma, Inc.


text: Collaborative Approach: Our cybersecurity risk management efforts include the implementation of a comprehensive, cross-functional approach to identify, prevent and mitigate cybersecurity threats and incidents. We have various tools in place that allow us to monitor and address threats and incidents that have the potential to materially affect our business strategy, financial condition, and results of operations, which allows us to determine the materiality of and ensure timely public disclosure of any such threat or incident, as appropriate.

companyName: WillScot Holdings Corp

ticker: WSC


text: Cyber Risk Management The Company recognizes the increasing significance of cybersecurity threats in today's digital landscape and has implemented a cyber risk management program to identify, assess, manage, mitigate and respond to cybersecurity threats. This program is integrated within the Company's enterprise risk management program. Our approach is designed to safeguard sensitive information, protect critical assets and maintain the integrity of our operations.

companyName: DNOW Inc.

ticker: DNOW


text: In managing cybersecurity risks, we adhere to a structured framework that outlines the roles and responsibilities of management positions and committees.

companyName: OS Therapies Inc

ticker: OSTX


text: Our Board considers cybersecurity risk as part of its risk oversight function and established a dedicated Cybersecurity Committee of the Board in July 2024 to oversee cybersecurity risks, including management's implementation of our cybersecurity risk management program.

companyName: Amplitude, Inc.

ticker: AMPL


text: We engage assessors, consultants and other third parties in connection with our risk assessment processes. These service providers review our cybersecurity policies, procedures and safeguards and provide feedback to increase the effectiveness of our cybersecurity controls.

companyName: HAWAIIAN HOLDINGS INC


text: During the period covered by this report, we have not experienced any cybersecurity incidents that have had a material effect on our financial condition or results of operations. We assess the materiality of any cybersecurity incident from several perspectives including, but not limited to, our ability to continue to service our members and protect private information, lost revenue, disruption of business operation, increased operating costs, litigation, and reputational harm.

companyName: Federal Home Loan Bank of Indianapolis


text: We have developed processes to identify and oversee risks from cybersecurity threats associated with our third-party service providers, which includes the information security team assisting with and assessing cybersecurity robustness during vendor onboarding as well as risk-based monitoring of vendors on an ongoing basis.

companyName: GRAHAM CORP

ticker: GHM


text: Our CISO is primarily responsible for assessing and managing our risks from cybersecurity threats. Our CISO manages a team of cybersecurity professionals with broad experience and expertise, including in cybersecurity strategy and operations, incident response, cybersecurity education and awareness, threat management, insider threats and regulatory compliance. Our CISO has over 25 years of experience in technology, with more than 15 years in information security, holding multiple roles including five years as a CISO for a health insurance company. Our CISO reports on cybersecurity risk management and other matters to our CIO, who in turn reports to our Chief Executive Officer. Along with our CISO our security, privacy, audit, risk and compliance council ("SPARC Council"), which is a collection of stakeholders from various functions including cybersecurity, legal, IT, engineering, finance, procurement and audit, oversees our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. Our CISO and our SPARC Council review the results of assessments, including security simulations and tabletop exercises, and discuss and recommend improvements to our policies and processes. In addition to the general reporting structure applicable to our CISO, the other members of the SPARC Council report on those activities through the reporting lines applicable to them, as needed.

companyName: Dolby Laboratories, Inc.

ticker: DLB


text: Interim Chief Executive/Chief Financial Officer is primarily responsible to assess and manage our material risks from cybersecurity threats with assistance from third-party service providers.

companyName: Hepion Pharmaceuticals, Inc.

ticker: HEPA


text: As of December 31, 2023, we have not identified any risks from cybersecurity threats (including any previous cybersecurity incidents) that have materially affected or are reasonably likely to materially affect the Company's business strategy, financial condition or results of operations. For further details on cybersecurity risks, please refer to the Risk Factors discussion in Item 1A of this Report, including the discussion under the heading "Any significant disruption in or unauthorized access to our computer systems or those of third parties that we utilize in our operations, including those relating to cybersecurity or arising from cyber-attacks, could result in a loss or degradation of service, unauthorized disclosure of data, or theft or tampering of intellectual property, any of which could materially adversely impact our business."

companyName: Rocket Lab Corp

ticker: RKLB


text: Technology and cybersecurity risks at BlackRock are also overseen by the TRCC, a dedicated management risk governance committee and sub-committee of the firmwide ERC. The chair of the TRCC is appointed by the head of Enterprise Risk Management at the Company and its members include the CISO as well as a broad range of senior business stakeholders across BlackRock. The TRCC is responsible for oversight of BlackRock's technology and cybersecurity risk management practices and helps ensure that technology and cybersecurity risks remain within firmwide risk tolerances and technology and cybersecurity risk issues are escalated as appropriate to the ERC and other committees. The TRCC also reviews any relevant technology and cybersecurity risk related issues and helps ensure that they are appropriately escalated, reported, and remediated.

companyName: BlackRock Finance, Inc.


text: Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program. Management regularly reports on our cybersecurity risks to the Audit Committee. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as incidents with lesser impact potential.

companyName: Bridge Investment Group Holdings Inc.


text: Our Board of Directors oversees management's enterprise risk management process, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Senior leadership, including our Chief Information Officer (CIO), regularly briefs the Board of Directors on our cybersecurity and information security, and we have processes by which certain cybersecurity incidents are escalated to the Board of Directors.

companyName: NPK International Inc.

ticker: NPKI


text: Our cybersecurity risk management program includes a number of components, including information security program assessments and continuous monitoring of critical risks from cybersecurity threats using automated tools. We periodically engage third parties to conduct risk assessments on our systems, including penetration testing and other vulnerability analyses. For example, in 2023 we engaged several third parties to assist with implementing processes regarding endpoint detection and response, logging and monitoring, multi-factor authentication, business continuity and disaster recovery, and internet proxies. Additionally, we have implemented an employee education program whereby employees are able to attend cybersecurity awareness training during the onboarding process.

companyName: PLUG POWER INC

ticker: PLUG


text: Any actual or suspected security incident is reported to the CISO. Cybersecurity incidents are evaluated under the Integrated Incident Response Program and flow to the Enterprise Response Team according to clearly defined escalation criteria.

companyName: E.W. SCRIPPS Co

ticker: SSP


text: Information security is an important part of the Company's culture and foundational to its management. This philosophy is emphasized throughout the organization by the Board of Directors, senior leadership, and team members to help promote a Company-wide culture of cybersecurity risk management.

companyName: FOOT LOCKER, INC.


text: Risk management, including risks related to cybersecurity is also incorporated into the review and approval process for our project management organization ("PMO").

companyName: Cornerstone Building Brands, Inc.


text: Our enterprise risk management program includes management of material risks from cybersecurity threats alongside other Company risks as part of our overall risk assessment process. In 2023, our Internal Audit team completed an Enterprise Risk Assessment to identify and prioritize the most critical risks that could impact our ability to achieve our business priorities and make risk-informed strategic decisions. With management's input, our Board and Internal Audit team have identified cybersecurity as one of the risks that merits the highest level of prioritization. Informed by this designation, our Internal Audit team tracks cybersecurity key indicators and engages in discussions on the status, priorities and impact of cybersecurity risk response plans; reports key information to management throughout the year to inform decision making; and reports to the Audit Committee on a quarterly basis and to the full Board on the results and progress of the risk mitigation process.

companyName: TheRealReal, Inc.

ticker: REAL


text: Enterprise Risk Management Framework and Governance The Cybersecurity Program is integrated with our and our Manager's enterprise risk management framework and is primarily managed by the CIO, the CISO, and other information security personnel and consultants, and is overseen by risk management, internal audit, senior management and our board of trustees to ensure the confidentiality, integrity and the availability of the Company's enterprise information systems, data and business operations. The Cybersecurity Program utilizes specialized third-party cybersecurity service providers to periodically perform penetration testing across certain internet-facing and business critical applications as well as external and internal network penetration tests.

companyName: PennyMac Mortgage Investment Trust

ticker: PMT


text: The Audit Committee reports to the full Board annually regarding cybersecurity. The full Board also receives annual briefings from the CIO and the VP of Information Security on cybersecurity, or from external experts on cybersecurity as part of the Board's continuing education on topics that impact public companies.

companyName: WATTS WATER TECHNOLOGIES INC

ticker: WTS


text: As part of our overall risk management system and processes, we assess, identify and manage material risks from cybersecurity threats through our Enterprise Risk Management (ERM) process. For a description of cybersecurity risks relevant to our business, see Item 1A, "Risk Factors."

companyName: PHINIA INC.

ticker: PHIN


text: In the event of a suspected incident, we intend to follow our incident response plan, which outlines the steps to be followed from incident detection to mitigation, recovery and notification, including notifying the CIO/CISO and functional areas (e.g. legal) as appropriate. The CIO/CISO will make any required communications to the Chief Executive Officer (CEO) and other senior leadership, with the CIO/CISO making any required communications to the Board and Audit Committee. Our CEO, Chief Financial Officer, General Counsel and CIO/CISO are responsible for assessing such incidents for materiality, ensuring that any required notification, disclosure or communication occurs and determining, among other things, whether any prohibition on the trading of our common stock by insiders should be imposed prior to the disclosure of information about a material cybersecurity event.

companyName: METHODE ELECTRONICS INC

ticker: MEI


text: Information Security Certifications and Audits We maintain certification for compliance with ISO 27001:2022 as assessed by an independent third-party auditor. We also engage an independent accounting firm to perform assessments of our procedures and controls as part of our annual Systems and Organization Controls (SOC) 1 and SOC 2 audits.

companyName: Paylocity Holding Corp

ticker: PCTY


text: Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include: briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our IT environment.

companyName: KALTURA INC

ticker: KLTR


text: We are a blank check company with no business operations. Since our Initial Public Offering, our sole business activity has been identifying and evaluating suitable target businesses for a business combination. Therefore, we do not consider that we face significant cybersecurity risk. Nevertheless, we employ various procedures designed to identify, protect, detect and respond to and manage reasonably foreseeable cybersecurity risks and threats given our limited operations. These include, but are not limited to, internal reporting, monitoring and detection tools and anti-virus software. We also periodically assess risks from cybersecurity and technology threats and monitor our information systems for potential vulnerabilities, including those that could arise from internal sources and external sources such as third-party service providers we do business with.

companyName: Bowen Acquisition Corp


text: We regularly assess risks from cybersecurity and technology threats and monitor our information systems for potential vulnerabilities. We and certain third parties conduct regular reviews and tests of our information security program and also leverage, among other things, audits, tabletop exercises, penetration and vulnerability testing, red team exercises, simulations and other exercises to evaluate the effectiveness of our information security program and improve our security measures and planning. In addition, we evaluate third-party risks and perform third-party risk management to assess, identify and mitigate risks from third parties such as vendors, suppliers and other business partners.

companyName: Hughes Satellite Systems Corp


text: The Company performs cybersecurity due diligence and monitoring of third-party vendors, which includes a security questionnaire to identify the cybersecurity controls and protections maintained by a third party. Lasty, the Company requires that all employees participate in monthly training videos that are geared toward identifying potential cybersecurity threats.

companyName: ICC Holdings, Inc.


text: The Audit Committee generally receives quarterly cybersecurity and information systems infrastructure reports from either our Chief Information Officer (CIO) or our head of Global Cybersecurity and Compliance (Head of Cybersecurity), who reports to our CIO, and who oversees a global team responsible for our cybersecurity infrastructure. These reports cover various cybersecurity and information technology matters, including material risks and threat trends, mitigation strategies, security incidents, the status of information technology and cybersecurity priorities and initiatives and other related matters of importance. The Audit Committee provides periodic updates on these topics to the full Board as necessary. In addition to the above, the Audit Committee, typically in the presence of the full Board, will review the results of the independent cyber-maturity evaluations described above, and from time to time participates in table top exercises or other cybersecurity training programs.

companyName: Capri Holdings Ltd

ticker: CPRI


text: The Board of Directors also considers cybersecurity topics on an ad hoc basis where appropriate, including for purposes of receiving briefings on developments in cybersecurity or cybersecurity incidents and assessing and managing potentially material risks arising from cybersecurity threats. There are two committees comprised of Company leadership, including the enterprise risk management steering committee, which meets monthly, and the Xerox Holdings management audit committee, which meets at least quarterly, to discuss the current operational and security compliance metrics, cybersecurity incidents, and risks.

companyName: XEROX CORP