text: To date, no risks from cybersecurity threats to Ellington have materially affected or are reasonably likely to materially affect the Company. Cyber criminals do, however, target us, Ellington and Ellington's employees and other third parties. Ongoing or future attacks such as these could have impacts on our or Ellington's operations. For additional information on these ongoing risks, please refer to "Part 1. Item 1A. Risk Factors—We are highly dependent on Ellington's and Longbridge's information systems and those of third-party service providers, including mortgage servicers, and system failures could significantly disrupt our business, which could materially adversely affect our business, financial condition and results of operations, and our ability to pay dividends to our stockholders." and "—Because we are highly dependent on information systems when sharing information with third party service providers, systems failures, breaches or cyber-attacks could significantly disrupt our business, which could have a material adverse effect on our results of operations and cash flows." While Ellington did experience two business email compromise incidents in recent years, neither had a material impact on our business strategy, results of operations or financial condition.

companyName: Ellington Financial Inc.

ticker: EFC


text: At the management level, our CIO, CISO, and Deputy CISO, each of whom has extensive cybersecurity knowledge and skills gained from over 28 years, 29 years, and 20 years of relevant work experience, respectively, head the Internal Cybersecurity Team that is responsible for implementing and maintaining cybersecurity and data protection practices across our business, with our CIO reporting directly to our Chief Executive Officer. Our CISO and Deputy CISO receive reports on cybersecurity threats from a number of experienced information security professionals for various parts of our business on an ongoing basis and, in conjunction with other management personnel, regularly consult on risk management measures implemented by the Company to identify and mitigate data protection and cybersecurity risks.

companyName: UNION PACIFIC CORP

ticker: UNP

secItem: Item 1C


text: The Chief Information Security Officer reports to the Chief Information Officer, has a dotted line to the Chief Executive Officer, and maintains independence in reporting on the status and impact of any information security related developments and strategic initiatives to the Audit Committee, and depending on the severity of the situation, directly to the Board of Directors. In addition to regular meetings, the Audit Committee, Chief Information Security Officer, Chief Information Officer, Chief Risk Officer and Chief Executive Officer maintain an ongoing dialogue regarding emerging or potential cybersecurity risks that we face, particularly as a financial institution. The Company's internal Risk Management Steering Committee also reports directly to the Audit Committee regarding our risk management initiatives. The Audit Committee also receives quarterly reports from the Risk Management Steering Committee, the Company's Internal Audit department, and IT department in order to say informed on all aspects of cybersecurity risk affecting the Company.

companyName: HERITAGE COMMERCE CORP

ticker: HTBK


text: we have established and maintain comprehensive incident response plans that fully address our response to a cybersecurity incident and the recovery from a cybersecurity incident, and such plans are evaluated on an regular basis;

companyName: Sky Harbour Group Corp

ticker: SKYH


text: Impact of cybersecurity risks on business strategy, results of operations or financial condition Despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors—Risks Relating to Information Technology—We have become increasingly dependent on information technology systems and infrastructure and any breakdown, interruption, breach or other compromise of our information technology systems or those of our third party service providers could subject us to liability or interrupt the operation of our business, which could have a material adverse effect on our business, financial condition, cash flows and results of operations and could cause the market value of our common shares to decline" under Item 1A of this Annual Report on Form 10-K.

companyName: Bausch & Lomb Corp

ticker: BLCO


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part I. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "Our internal computer systems, or those of our collaborators, contractors, consultants or other third parties with whom we work, may fail or suffer security breaches, which could result in a significant disruption of our product development programs and can lead to adverse consequences, including but not limited to regulatory investigations or actions; litigation; fines and penalties; reputational harm; loss of revenue or profits; loss of customers or sales; disruption of our business operations."

companyName: Milestone Pharmaceuticals Inc.

ticker: MIST


text: Cyber Expertise and Experience The Company relies on third party cybersecurity professionals to provide risk assessments to help assess cybersecurity risks.

companyName: SPINDLETOP OIL & GAS CO

ticker: SPND


text: We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. Since the beginning of the last fiscal year, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, but we face certain ongoing cybersecurity risks threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the heading "Risks Related to Employee Matters and Managing Growth."

companyName: Cogent Biosciences, Inc.

ticker: COGT


text: In addition, the Company's cyber liability insurance policy may not cover all claims made against the Company. Defending a suit, regardless of its merit, could be costly and divert management's attention from the Company's business and operations. date, Actinium has not experienced any material cybersecurity incident that affected the Company's operations or financial condition.

companyName: Actinium Pharmaceuticals, Inc.

ticker: ATNM


text: We have no t identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.

companyName: Viewbix Inc.

ticker: VBIX


text: Peoples has a comprehensive Enterprise Risk Management program ("ERM Program"), which includes policies and processes for assessing, identifying and managing material risks from cybersecurity threats to Peoples and its customers. Peoples' information security policy and procedures are reviewed and assessed on an annual basis and as needed throughout the year by the Risk Committee of the Board. Peoples assesses itself against the Federal Financial Institutions Examination Council's ("FFIEC") Cybersecurity Assessment Tool ("CAT") on a quarterly basis. Additional assessment of Peoples' cybersecurity capabilities is performed by consultants, and regulators annually. Identified risks resulting from these assessments are documented, rated and mitigated by Peoples Bank's Chief Information Security Officer ("CISO"), with oversight by the Risk Committee.

companyName: PEOPLES BANCORP INC

ticker: PEBO


text: Protect against any anticipated threats or hazards to the security or integrity of such information; and Protect against unauthorized access to or use of customer information that could result in substantial harm or inconvenience to any customer.

companyName: UNITED BANCORP INC /OH/

ticker: UBCP


text: Risk Identification We employ a risk-based approach for our cybersecurity program in which the level of controls are based upon asset value and organizational risk. Consequently, our cybersecurity program has a layered approach to cyber controls focused on protection of the confidentiality, integrity, and availability of sensitive data (both internal and third party). Our CISO and cybersecurity organization are actively engaged within the cybersecurity threat intelligence community in order to monitor emerging trends and developments, attack vectors, and best practices for identifying and mitigating cyber threats.

companyName: Aramark

ticker: ARMK


text: We do not believe that risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our overall business strategy, results of operations, or financial condition over the long term. See Item 1A. Risk Factors – "Data security and integrity are critically important to our business, and cybersecurity incidents, including cyberattacks, breaches of security, unauthorized access to or disclosure of confidential information, business disruption, or the perception that confidential information is not secure, could result in a material loss of business, regulatory enforcement, substantial legal liability and/or significant harm to our reputation." for more information about these and other risks related to information security.

companyName: Dun & Bradstreet Holdings, Inc.


text: In connection with the advisory agreement with a wholly-owned subsidiary of UHS, as discussed herein, we utilize certain of UHS' information technology ("IT") applications, consisting primarily of financial data applications. In addition, UHS and our third-party property managers rely extensively on IT systems to, as applicable, manage clinical and financial data, communicate with patients, tenants, payers, vendors and other third parties; and to summarize and analyze operating results. These various IT systems, and the networks and information systems of third parties that we, UHS and our third-party property managers rely on, are subject to damage or interruption from power outages, facility damage, computer and telecommunications failures, computer viruses, security breaches including credit card or personally identifiable information breaches, vandalism, theft, natural disasters, catastrophic events, human error and potential cyber threats, including malicious codes, worms, phishing attacks, denial of service attacks, ransomware and other sophisticated cyber-attacks, and our disaster recovery planning cannot account for all eventualities. These systems, in turn, interface with, and rely on, third-party systems that we do not control. Third parties to whom we outsource certain of our functions, or with whom our systems interface and who may, in some instances, store our sensitive and confidential data, are also subject to the risks outlined above and may not have or use controls effective to protect such information. An attack, breach or other system disruption affecting any of these third parties could similarly harm our business.

companyName: UNIVERSAL HEALTH REALTY INCOME TRUST

ticker: UHT


text: We face various cyber risks, including, but not limited to, risks related to unauthorized access, misuse, data theft, computer viruses, system disruptions, ransomware, malicious software and other intrusions. We utilize a multilayered, proactive approach to identify, evaluate, mitigate and prevent potential cyber and information security threats through our cybersecurity risk management program. Our cybersecurity risk management program is integrated into our broader Enterprise Risk Management ("ERM") program, which is designed to identify, assess, prioritize and mitigate risks across the organization to enhance our resilience and support the achievement of our strategic objectives. This integrated approach helps ensure that cyber risks are not viewed in isolation, but are assessed, prioritized and managed in alignment with the Company's operational, financial and strategic risks, assisting the Company in more effectively managing interdependencies among risks and enhancing risk mitigation strategies.

companyName: COCA COLA CO

ticker: KO


text: Our management is actively involved in the oversight of our cybersecurity risk management program, We have devoted significant financial and personnel resources to implement and maintain security measures to meet regulatory requirements and customer expectations. We have incorporated cybersecurity processes to assess, identify and manage risks from cybersecurity threats into our overall risk assessment process. The Company maintains a cybersecurity program that is designed to identify, protect from, detect, respond to, and recover from cybersecurity threats and risks, and protect the confidentiality, integrity, and availability of its information systems, including the information residing on such systems. The National Institute of Standards and Technology Cybersecurity Framework helps the Company inform its cybersecurity agenda and prioritize its cybersecurity activities. The Company takes a risk-based approach to cybersecurity, which begins with the identification and evaluation of cybersecurity risks or threats that could affect the Company's operations, finances, legal or regulatory compliance, or reputation. The Company has processes in place for assessing, identifying and managing material risks from cybersecurity threats along with risk assessment procedures designed to allow such processes to remain responsive to emerging risks. Our processes include, but are not limited to, the following: • we engage third-party cybersecurity firms and tools to assist with network monitoring, endpoint protection, vulnerability assessments and penetration testing; • we engage cyber security consultants, auditors, and other third parties to assess and enhance our cybersecurity practices, such as to perform tabletop exercises and evaluate our cyber processes including an assessment of our incident response procedures. Identified risks are formally tracked until mitigated or eliminated; • we perform regular scanning of our systems to identify and resolve critical vulnerabilities; • we provide periodic training and testing, including phishing tests, to help our employees understand cybersecurity risks and their responsibility in mitigating those risks; and • we insure against potential losses from cyber incidents by maintaining cybersecurity insurance.

companyName: OPPENHEIMER HOLDINGS INC

ticker: OPY


text: Please see Item 7. "Managements's Discussion and Analysis of Financial Condition and Results of Operations - Cyber Security" for discussion regarding the cyber security policies of the Company.

companyName: Federal Realty OP LP


text: Internal Cybersecurity Team The Internal Cybersecurity Team, led by the CISO, is responsible for the implementation, monitoring, and maintenance of the cybersecurity and data protection practices across the Company. The CISO is supported by experienced information security team members, each of whom is supported by a team of trained cybersecurity professionals. The individuals who report directly to the CISO include the Director of Cyber Security, who oversees the cybersecurity engineers, security operations center, and identity & access management team, and the Privacy and Compliance Manager, who oversees the global privacy and compliance analysts. In addition to internal cybersecurity capabilities, the Company also at times engages consultants or specialists to assist with assessing, identifying, and managing cybersecurity risks.

companyName: WOLVERINE WORLD WIDE INC /DE/

ticker: WWW


text: Our board of directors and senior management recognize the critical importance of maintaining the trust and confidence of our clients, business partners and employees. Our management, led by our Chief Executive Officer and Chief Financial Officer, are actively involved in oversight of our risk management efforts, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM"). Our cybersecurity processes and practices are fully integrated into the Company's ERM efforts.

companyName: MANHATTAN BRIDGE CAPITAL, INC

ticker: LOAN


text: Our management team is responsible for assessing and managing our material risks from cybersecurity threats and for our overall cybersecurity risk management program on a day-to-day basis, and supervises both our internal cybersecurity personnel and the relationship with our retained external cybersecurity consultants. Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, including briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.

companyName: REGIONAL HEALTH PROPERTIES, INC

ticker: RHEP


text: Third-Party Relationships: Our reliance on third-party vendors and service providers exposes us to additional cybersecurity risks, and a security breach affecting these entities could impact our operations.

companyName: LEAFBUYER TECHNOLOGIES, INC.

ticker: LBUY


text: To defend, detect and respond to cybersecurity incidents, we, among other things: may conduct proactive privacy and cybersecurity reviews of systems and applications, audit applicable data, conduct employee training, monitor emerging laws and regulations related to data protection and information security and implement appropriate changes.

companyName: Innovative Payment Solutions, Inc.

ticker: IPSI


text: a cybersecurity incident response plan outlining procedures for detecting, responding to, and mitigating cybersecurity incidents; and a vendor management policy to oversee cybersecurity risks associated with service providers.

companyName: Hour Loop, Inc

ticker: HOUR


text: To our knowledge, in the last three years we have not experienced a cybersecurity incident that has had, and we are not aware of any cybersecurity incident that is reasonably likely to have, a material impact on us, our business strategy, results of operations or financial condition. However, as (i) our business involves the storage and transmission of numerous classes of sensitive and confidential information and proprietary information, including tenants' information, private information about our investors and our employees, and financial and strategic information about us and (ii) we also rely on third-party service providers that have access to such information in connection with providing necessary information technology and security and other business services to us, we face risks associated with security breaches through cyber-attacks or cyber-intrusions, malware, computer viruses, attachments to e-mails, persons inside our organization or persons with access to systems inside our organization, and other significant disruptions of our IT networks and related systems that could have a material impact on us, our business strategy, results of operations or financial condition. See "Risks Related to Our Business and Properties – Security breaches and other technology disruptions could compromise our information systems and expose us to liability, which could materially and adversely affect us" for additional information.

companyName: Broadstone Net Lease, Inc.

ticker: BNL


text: As one of the critical elements of our overall ERM approach, our cybersecurity program includes a focus on the following key areas: • Governance. As discussed further below, the Board's oversight of cybersecurity risk management is supported by the Enterprise Risk Committee of the Board (the "ERC"), which regularly interacts with the Company's ERM function, Corporate Information Security Officer, Business Continuity Director and other key members of management. The activities of the ERC include a quarterly review of our cybersecurity risk profile, and the ERC provides a report of its activities at each meeting of the full Board. • Technical Safeguards. We deploy technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including authentication and access, firewalls, intrusion prevention and detection systems, anti-malware functionality and data protection controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. • Third-Party Risk Management. We have designed and maintain a comprehensive, risk-based program in accordance with applicable regulatory standards for identifying and overseeing cybersecurity risks, among others, presented by third parties with whom we engage for the conduct of our business, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Education and Awareness. We provide regular, mandatory training for our employees regarding cybersecurity threats as a means to equip them with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices. • Incident Response Plan. In addition, we maintain a comprehensive incident response plan that provides a documented framework for responding to actual or potential cybersecurity incidents, including timely notification to appropriate management committees and, as appropriate, the ERC. The incident response plan is overseen by our Business Continuity Director, who reports directly to our Chief Information Officer, and coordinated across multiple parts of the Company, with key members of management included in the implementation and execution of the plan. The incident response plan is updated as appropriate and evaluated at least annually.

companyName: Ameris Bancorp

ticker: ABCB


text: Our cybersecurity program is overseen by a full-time security team led by our Chief Information Security Officer ("CISO"), reporting directly to our Chief Information Officer ("CIO"). Our CISO has over 20 years of experience in the field of cybersecurity, including prevention, detection, mitigation, and remediation of cybersecurity incidents. Our CIO has over 18 years of experience as a Chief Information Officer, over 35 years of experience in the field of information technology and oversees the cybersecurity function.

companyName: Moelis & Co

ticker: MC


text: The Company regularly assesses risks from cybersecurity threats, monitors its information systems for potential vulnerabilities, and tests those systems pursuant to the Company's cybersecurity policies, standards, processes, and practices, which are integrated into the Company's overall risk management program. We have adopted aspects of the ISO 27002, NIST SP 800-37 Rev. 2, and NIST Cybersecurity frameworks, to which risk management in relation to our information systems is aligned. We categorize our information systems as either critical or secondary, depending on business value and/or risk of financial or compliance impact of cybersecurity incidents. Our information security team uses a multifaceted approach to assess, identify, and manage material risks to the Company from cybersecurity threats, including testing of the effectiveness of our cybersecurity incident prevention and response systems; conducting routine vulnerability scanning of information systems assets; network/endpoint detection and response coupled with anomaly identification enhanced logging capabilities powered by artificial intelligence software; discovery through collaboration with the Company's internal audit team; monitoring of threat intelligence feeds provided by industry associations/groups, service providers, and federal/state authorities; and professional service engagements, such as retaining the services of an external 24/7 security operations center and partnering with third parties in testing our information systems for vulnerabilities from external, internal, and social engineering perspectives and assessing the effectiveness of our cybersecurity controls.

companyName: CREDIT ACCEPTANCE CORP

ticker: CACC


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including If our internal information systems, those of third parties with whom we work, or our data are or were compromised, we could experience adverse consequences including, but not limited to, regulatory investigations or actions, litigation, fines/penalties, disruptions of our business operations, reputational harm, and loss of revenue or profits.

companyName: Quince Therapeutics, Inc.

ticker: QNCX


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing Company's cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats.

companyName: Vor Biopharma Inc.

ticker: VOR


text: Our ERM program is led by our Chief Risk Officer, who reports to our Chief Executive Officer. Our Cyber program is led by our Chief Cybersecurity and Technology Risk Officer, who reports to our Chief Technology Officer. Our C&E program is led by our Chief Ethics and Compliance Officer, who reports to our Chief Legal Officer. The collective relevant cybersecurity experience and expertise of the persons holding the positions of Chief Risk Officer, Chief Cybersecurity and Technology Risk Officer, and Chief Ethics and Compliance Officer is over 75 years, and includes multiple information security and privacy professional certifications, and various pan-industry leadership roles related to cybersecurity and data risks.

companyName: Dun & Bradstreet Holdings, Inc.


text: Our Audit & Risk Committee receives quarterly or, if needed, more frequent reports on cybersecurity and information security matters from our Chief Information Security Officer, or CISO, and his team. The CISO has more than 25 years of experience in information technology and information security, particularly in the financial services industry, and our InfoSec organization has seasoned members with expertise in application security; governance and compliance; program and vulnerability management; security engineering; security operations security assurance; and threat intelligence and security architecture.

companyName: NASDAQ, INC.

ticker: NDAQ


text: We periodically assess and test our cybersecurity policies and practices. These efforts include tabletop exercises, vulnerability and penetration tests, and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We also engage third parties to assess our cybersecurity measures.

companyName: ON24 INC.

ticker: ONTF


text: At the management level, our Corporate Information Technology Director, who has extensive cybersecurity knowledge and skills gained from over 30 years of work experience at our company and elsewhere, heads the team responsible for implementing, monitoring, and maintaining information security and cybersecurity practices across our businesses and reports directly to the Chief Financial Officer.

companyName: ADAMS RESOURCES & ENERGY, INC.


text: The board of directors receives periodic reports, summaries or presentations from the CISO concerning the Company's significant cybersecurity threats and risks, as well as the processes the Company has implemented to address them.

companyName: Veritone, Inc.

ticker: VERI


text: Users are provided with access consistent with the principle of least privilege, which requires that users be given no more access than necessary to complete their job functions. To keep our network secure, we have multifactor authentication (MFA) for all users, a password change policy, separation of duties in accounting systems, controlled access to network drives, endpoint protection, email security, mobile device management, device encryption, and ongoing active monitoring of threats.

companyName: Kinetik Holdings Inc.

ticker: KNTK


text: Board & Management Cybersecurity Risk Oversight We incorporate all of the Company's cybersecurity processes and assessments into our overall enterprise risk program. This allows us to develop a complete consolidated view of our risk factors across our cybersecurity, information technology, and business functions. As part of the Company's enterprise risk program, the Information Risk Committee ("IRC") is responsible for developing and coordinating the Company's cybersecurity policy and strategy, and for managing the prevention, detection, mitigation and remediation of cybersecurity incidents. The IRC is chaired by the Chief Information Security Officer ("CISO") and the Senior Vice President – Legal ("SVP – Legal)" responsible for Privacy and Compliance Issues, with the Chief Financial Officer and Head of Strategy, Chief Commercial Officer, and the General Counsel and Chief Compliance Officer as members. The IRC meets regularly to review operations of the Company's cybersecurity programs and processes, and to discuss emerging legal, technical, or other risks. The Audit Committee of the Board is the Board-level committee with oversight of privacy and security matters. The IRC updates the Audit Committee quarterly to provide risk updates and general education on privacy and information risk trends. The Board is made aware promptly of any cybersecurity incidents that are deemed critical or that could potentially have an impact on the business. The Board also receives periodic privacy and security awareness training from third-party subject matter experts.

companyName: WYNDHAM HOTELS & RESORTS, INC.

ticker: WH


text: As part of our cybersecurity risk management process, we contractually require third-party service providers to implement and maintain key security measures in connection with their work with us when appropriate that is consistent with applicable laws. Additionally, our third-party service providers are to promptly report any breach of their security measures or systems that may affect our Company. Our security and compliance professionals track and log privacy and security incidents across our vendors and other third-party service providers to remediate and resolve any such incidents. Significant incidents associated with our vendors and service providers are reviewed regularly to determine whether further escalation is appropriate. Any incident assessed as potentially being or potentially becoming material is immediately escalated for further assessment, and then reported to designated members of our senior management.

companyName: Digital Turbine, Inc.

ticker: APPS


text: Our policies, procedures and processes are aligned with our technical tools, which include security monitoring and alerting, cybersecurity incident identification and remediation, and other technologies to ensure the security of our systems and information. We also have implemented certain physical safeguards, such as restricted access to areas containing critical IT and operational technology equipment, to mitigate risks to our physical environment.

companyName: Valaris Ltd

ticker: VAL


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats posed to the Company are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, the Company has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition.

companyName: Commonwealth Credit Partners BDC I, Inc.


text: The Senior Director of Information Security and IT Compliance and the Senior Vice President of Information Technology report to our Chief Technology Officer, who is responsible for overseeing the information security program. The Senior Director of Information Security and IT Compliance is a Certified Information Systems Security Professional with over 20 years of experience in cybersecurity, including continuous cybersecurity threat and risk monitoring. Team members who support our information security program have relevant educational and industry experience; these include but are not limited to: offensive security, advanced incident response, and advanced detection development. The teams provide regular reports to senior management and other relevant teams on various cybersecurity threats, assessments, and findings.

companyName: WideOpenWest, Inc.

ticker: WOW


text: The following sets forth information regarding our cybersecurity strategy, risk management program and approach to governance as it relates to cybersecurity risks. For additional information on the impact of cybersecurity risks on our business, please refer to Part I, Item 1A. Risk Factors, of this Form 10-K, under the heading "Cybersecurity and Data Risks."

companyName: Surgery Partners, Inc.

ticker: SGRY


text: The CISO reports on the status of the ISP including relevant risks, cybersecurity threats, program updates, and program reporting to the CRC and the ROC no less than four times per year. Any material cybersecurity information, including strategic program development, is reported by the CISO to appropriate management and Board representatives to ensure timely awareness and escalation as necessary. Should there be a cybersecurity incident, we have a formal Incident Response plan including escalation processes designed to keep relevant management and committees informed of the mitigation and remediation efforts. The identification of incidents may come through internal monitoring and detection resources, external threat intelligence, third-party risk management efforts or various other event escalation methods. We leverage a Managed Security Services Provider ("MSSP") for supplemental expertise and resources with the management and enhancement of critical threat monitoring solutions. The MSSP also provides industry-leading Security Operations Center services that serve as a critical source for event and incident detection.

companyName: FINANCIAL INSTITUTIONS INC

ticker: FISI


text: The Company maintains robust processes for assessing, identifying, and managing material risks from cybersecurity threats. We are subject to federal and state laws and regulations governing privacy, security, and breaches of patient information and the conduct of certain electronic health care transactions, including, the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") and other health information privacy and security requirements. We rely on information technology networks and systems to process and store electronic information. We collect and store sensitive data, including personal identifiable information on our information technology networks. As we collect and manage large quantities of data, it is possible that hardware failures or errors in our systems could result in data loss or corruption or cause the information that we collect to be incomplete or contain inaccuracies that our partners regard as significant. Increased global cybersecurity vulnerabilities, threats, computer viruses, ransomware and phishing attacks, and more sophisticated and targeted cyber-related attacks, as well as cybersecurity failures resulting from human error and technological errors, pose a risk to the security of the Company's systems and networks and the confidentiality, availability, and integrity of data on these products, systems, and networks. We have implemented security measures designed to prevent disruptions and shutdowns of our information technology networks due to attacks by hackers or breaches due to malfeasance by contractors, employees and others who have access to our networks and systems. We expect to continue to invest in long-term solutions to protect against cybersecurity risks and threats. Except as otherwise provided herein, this Item 1C reflects the Company's cybersecurity policies and procedures as of December 31, 2023.

companyName: MSP Recovery, Inc.

ticker: MSPR


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors along with the audit committee is responsible for overseeing Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.

companyName: Cardlytics, Inc.

ticker: CDLX


text: 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors - Risks Relation to our Business, Strategy, and Industry" in Report.

companyName: Massimo Group

ticker: MAMO


text: The firm's senior executive team, inclusive of the CEO, CFO, COOs, CAO and CLO, are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan.

companyName: Marcus & Millichap, Inc.

ticker: MMI


text: Our Board of Directors is responsible for risk management oversight and has delegated to our Audit Committee oversight responsibility for reviewing the effectiveness of our governance and management of cybersecurity risks. The Audit Committee regularly reviews our policies and practices with respect to risk management, including cybersecurity risks, and reports to the full Board of Directors based on these reviews. The Audit Committee also receives a report containing information security risk posture details, remediation plan execution progress and pertinent threat intelligence updates from the Chief Security Officer ("CSO") on a quarterly basis. At least annually, but more frequently as necessary, threats from cybersecurity risks and our action plans relating to those risks also are considered by the full Board during meeting discussions of enterprise risks. Members of management, including the Chief Executive Officer, Chief Financial Officer and Chief Legal Officer may also report directly to the Board of Directors on significant risk management issues, including cybersecurity threats and incidents.

companyName: SILICON LABORATORIES INC.

ticker: SLAB


text: Although we have been subject to breaches of our information technology systems, including breaches of the information technology systems of third-party service providers, the impact of such attacks has not been material to our business strategy, operations or results of operations, financial position, or cash flows through December 31, 2024. We do not believe that cybersecurity threats resulting from any previous cybersecurity incidents of which we are aware are reasonably likely to materially affect the Company. For additional information on the risks we face from cybersecurity threats, please refer to Part I, Item 1A, "Risk Factors" of this Form 10-K.

companyName: HUMANA INC

ticker: HUM


text: The CISO also oversees the Company's management of third-party service providers. The Company has engaged a third-party managed detection and response company to monitor the security of its information systems, including intrusion detection, and to provide timely alerts if a cybersecurity event occurs. The Company also has engaged a third-party digital forensics and incident response consultant on retainer.

companyName: MOHAWK INDUSTRIES INC

ticker: MHK


text: Monitoring and Incident Response - The Company's cybersecurity program protects against threats through use of the following measures: identifying critical assets and high-risk threats; implementing cybersecurity detection, controls and remediation practices; implementing a third-party risk management program to evaluate our critical partners' cyber posture; and evaluating our program effectiveness by performing internal and external assessments. The Company engages a third-party service provider to perform annual internal and external penetration testing under NIST special paper (SP) 800-171 requirements to identify potential gaps that require remediation. In addition, the Company utilizes several industry-standard software applications to monitor for cybersecurity threats and alert our Director of Corporate Security and IT administration of any incidents that require escalation to the SVP of IT & SCM and the Audit Committee. Threats and incidents identified are immediately investigated by the IT administration team and appropriate action is taken to mitigate the impact to the Company.

companyName: SkyWater Technology, Inc

ticker: SKYT


text: For the 2023 period, we reported no material cybersecurity incidents affecting the confidentiality, integrity, or availability of data or systems. We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For further information, please see our risk factors titled "Our reputation and business may be harmed and we may be subject to legal claims if there is disruption to our information technology systems or loss, unlawful disclosure or misappropriation of, or unsanctioned access to, our customers', crewmembers', business partners' or our own information or other breaches of our information security" and "Data security compliance requirements could increase our costs, and any significant data breach could disrupt our operations and harm our reputation, business, results of operations and financial condition."

companyName: JETBLUE AIRWAYS CORP

ticker: JBLU


text: Cybersecurity Threat Disclosure We are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company's business, results of operations, or financial condition. In the event of a future cybersecurity incident, the Company has procedures in place to identify whether the incident or associated cybersecurity risks have materially affected or are reasonably likely to materially affect the Company, to ensure that disclosures are made where required under applicable law or regulation. For further discussion of cybersecurity risks, please see Item 1A, "Risk Factors".

companyName: Telesis Bio Inc.


text: We maintain an incident response plan with a cross-functional team comprised of members of the information technology department, senior management and other appropriate individuals. The team is responsible for assessing and managing the cybersecurity incident response process and taking necessary corrective actions to mitigate and/or eliminate any issues. In connection with our new digital asset treasury strategy, we intend to appoint a Chief Information Security Officer in Fiscal 2026.

companyName: Forward Industries, Inc.

ticker: FWDI


text: As of the date of this report, no cybersecurity incidents have had a material adverse effect on our business, financial condition, or results of operations. However, we recognize that no system is immune to breaches. While we maintain cyber insurance coverage for specific risks, such as ransomware attacks and business interruption, the costs of certain incidents could exceed policy limits. We continue to invest in advanced technologies, such as AI-driven threat detection, to strengthen our defenses against evolving threats.

companyName: Sprouts Farmers Market, Inc.

ticker: SFM


text: The CISO maintains and periodically updates a Cybersecurity Incident Response Plan which is a guide to respond effectively and efficiently to cybersecurity incidents in a coordinated manner in the interest of minimizing the risk of harm to our customers, operations, partners, employees and third parties, consistent with our legal obligations. As of the date of this report, we do not believe that risks from cybersecurity threats have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. However, we recognize the ever-evolving cyber risk landscape and cannot provide any assurances that we will not be subject to a material cybersecurity incident in the future. For a description of risks related to our information technology systems, including cybersecurity threats, see Item 1A, "Risk Factors."

companyName: CNH Industrial N.V.

ticker: CNH


text: Our policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats are integrated into our overall risk management program and are based on frameworks established by the International Organization for Standardization ("ISO") and other applicable industry standards. Our cybersecurity policies, standards, processes and practices are regularly assessed by consultants and external auditors. These assessments include a variety of activities, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. Cybersecurity processes are adjusted based on the information provided from these assessments. We have also obtained industry certifications and attestations that demonstrate our dedication to protecting the data our users entrust to us, including Tinder obtaining certification for its Information Security Management System (ISMS) under the ISO/IEC 27001:2022 standard.

companyName: Match Group, Inc.

ticker: MTCH


text: Security Policies and Procedures: We have established information security policies and procedures that govern the use, protection, and handling of sensitive information. These policies cover areas such as data encryption, access controls, password management, incident response, and employee training.

companyName: GT Biopharma, Inc.

ticker: GTBP


text: the deployment of third-party cyber-security experts to perform penetration testing on our internal and external networks and systems in an effort to identify potential vulnerabilities.

companyName: FUEL TECH, INC.

ticker: FTEK


text: Our IT Management team reports annually to the Risk Committee regarding the overall status of the Information Security Program. This reporting encompasses various aspects, such as risk assessment, risk management and control decisions, service provider arrangements, results of independent testing, cybersecurity incidents or violations and Management's responses, and recommendations for changes to the Information Security Program. Quarterly status updates are also provided to the Risk Committee.

companyName: BANNER CORP

ticker: BANR


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See Item 1A. Risk Factors "Cyber-attacks targeting systems and infrastructure used by the gas and oil industry and related regulations may adversely impact our operations and, if we or our third-party providers are unable to obtain and maintain adequate protection for our key systems and data, our business may be harmed."

companyName: EXPAND ENERGY Corp

ticker: EXE


text: As part of our overall Enterprise Risk Management strategy, we maintain a robust Information Technology and Security Management Program ("ITSM"), which includes processes to assess, identify, monitor and manage cybersecurity risks. The program includes provisions for annual cybersecurity risk assessments, ongoing monitoring and testing, as well as annual training for employees, executives, and Board Members. We use the Federal Financial Institutions Examination Council's ("FFIEC") cybersecurity assessment tool to identify risks and ascertain cybersecurity preparedness and the National Institute of Standards and Technology's ("NIST") Cybersecurity Framework to benchmark our internal policies and procedures against best practices. We engage consultants and auditors to assist in the completion of our annual risk assessment and review of controls related to the ITSM.

companyName: Provident Bancorp, Inc. /MD/


text: We acknowledge that there are risks associated with third-party service providers that have access to our systems and data, we have implemented processes to oversee and manage these risks. We oversee and identify material risks from cybersecurity threats associated with the use of third-party service providers by reviewing service organization controls reports for key outsourced systems. We also conduct security assessments of certain third-party providers before engagement and monitor such providers to confirm compliance with industry accepted cybersecurity standards and practices. This approach is designed to reduce risks related to data breaches, operational disruptions, or other security incidents originating from third-parties.

companyName: BrightView Holdings, Inc.

ticker: BV


text: As discussed in this Annual Report on Form 10-K, the changes in our business and operations that will occur in connection with our review of strategic alternatives may impact our cybersecurity program in the future. As such, the following section describes the Company's cyber risk management and strategy, and governance related to cybersecurity risks, for the fiscal year that ended December 31, 2024. For more information regarding the changes to our business and operations and associated risks, please see (i) Item 1 – Business, (ii) Item 1A – Risk Factors, and (iii) Item 7 – Management's Discussion and Analysis of Financial Condition and Results of Operations in this Annual Report on Form 10-K.

companyName: Kalaris Therapeutics, Inc.

ticker: KLRS


text: Incident Response Plan We have adopted an Incident Response Plan to provide a formal framework for responding to security incidents. The overall purpose of the framework is to provide procedures designed to protect and preserve the availability, integrity and confidentiality of the Company's information and network assets, regardless of format. The plan was designed with the objective of performing timely investigations and assessments of the severity of the incidents (including the sensitivity of the information compromised), taking all appropriate measures to contain and control damage to customers resulting from the incident, returning to normal operating conditions as quickly as possible, and taking appropriate steps to comply with our legal and regulatory obligations, including our disclosure obligations under the securities laws.

companyName: Evercore Inc.

ticker: EVR


text: At the management level, our COO and CFO are responsible for leading our cybersecurity risk management program and enterprise cybersecurity matters. The COO and CFO monitor the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents. For potentially material cybersecurity threats and incidents, we escalate these to the CEO, and would raise such threats and incidents to our Audit Committee Chair and, as appropriate, to our Board as they arise.

companyName: PHOENIX MOTOR INC.

ticker: PEVM


text: While the Company has experienced, and expects to continue to experience, cyber threats, no material security breaches of third-party information have occurred. Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company, including its business strategy, results of operations or financial condition. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A "Risk Factors" under the heading "General," which should be read in conjunction with the foregoing information.

companyName: BADGER METER INC

ticker: BMI


text: To operate our business, we utilize third-party service providers to perform various functions, such as outsourced business-critical functions, professional services, SaaS platforms, managed services, cloud-based infrastructure, content delivery to third parties, corporate productivity services, and other functions. We engage reliable, reputable service providers that maintain cybersecurity programs and we conduct cybersecurity reviews as part of our quality assessment processes.

companyName: Akero Therapeutics, Inc.


text: To manage and remediate cybersecurity risks identified as part of our ERM process and to manage emerging cybersecurity threats in real time; we have implemented a Managed Detection and Response system that supports the Security Operations Center. We are a member of the DoD Defense Industrial Base Collaborative Information Sharing Environment and the National Defense Information Sharing and Analysis Center. These organizations share real-time cybersecurity threat information and best practices in protecting, detecting and recovering from cybersecurity threats.

companyName: COMTECH TELECOMMUNICATIONS CORP /DE/

ticker: CMTL


text: Management's Role Managing Risk The Director of Internal Audit and the Chief Financial Officer ("CFO") play a pivotal role in informing the board of directors on cybersecurity risks. They provide comprehensive briefings to the board of directors on a regular basis, with a minimum frequency of once per year. These briefings encompass a broad range of topics, including: • Current cybersecurity landscape and emerging threats; • Status of ongoing cybersecurity initiatives and strategies; • Incident reports and learnings from any cybersecurity events; and • Compliance with regulatory requirements and industry standards. In addition to our scheduled meetings, the board of directors, Director of Internal Audit, Director of Information Technology and CFO maintain an ongoing dialogue regarding emerging or potential cybersecurity risks. Together, they receive updates on significant developments in the cybersecurity domain, ensuring the Board's oversight is proactive and responsive. The board of directors actively participates in strategic decisions related to cybersecurity, offering guidance and approval for major initiatives. This involvement ensures that cybersecurity considerations are integrated into the broader strategic objectives of the Partnership. The board of directors conducts an annual review of the Partnership's cybersecurity posture and the effectiveness of its risk management strategies. This review helps in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with the overall risk management framework.

companyName: MARTIN MIDSTREAM PARTNERS L.P.

ticker: MMLP


text: In addition, our board of directors, as a whole and through its Risk Oversight Committee (the "Risk Committee"), is responsible for the oversight of risk management. In that role, our board of directors and Risk Committee, with support from the Company's cybersecurity advisors, are responsible for ensuring that the risk management processes designed and implemented by management are adequate and functioning as designed. To carry out those duties, both our board of directors and the Risk Committee receive quarterly reports from our management team regarding cybersecurity risks, and the Company's efforts to prevent, detect, mitigate and remediate any cybersecurity incidents.

companyName: QCR HOLDINGS INC

ticker: QCRH


text: Members of board of directors are also encouraged to regularly engage in conversations with management on cybersecurity-related news and events and discuss any updates to our cybersecurity risk management and strategy programs. Material cybersecurity threat risks are also considered during separate board meeting discussions of important matters like enterprise risk management, operational budgeting, business continuity planning, mergers and acquisitions, brand management, and other relevant matters. Our Chief Information Security Officer advises our Board on the specific vulnerabilities we identified and the controls we put in place to mitigate our risk.

companyName: Fulgent Genetics, Inc.

ticker: FLGT


text: While the Board has the primary responsibility for risk oversight, the Audit Committee assists the Board in fulfilling its oversight responsibility with respect to the management of cybersecurity-related risks. Through its Cybersecurity Subcommittee, the Audit Committee periodically reviews and discusses with management, including the Vice President of Information Technology, (i) the Company's information security strategy, priorities and objectives; (ii) the Company's technology and information security risks, including with respect to cybersecurity and data privacy; and (iii) the steps management has taken to manage cybersecurity risk.

companyName: Air Transport Services Group, Inc.


text: Index to Financial Statements • periodic engagement of independent security firms and other third-party experts, where appropriate, to assess, test, and certify components of our cybersecurity program, and to otherwise assist with various aspects of our cybersecurity processes and controls; and • regular assessments of the design and operational effectiveness of the program's key processes and controls by our internal audit team assisted by external consultants.

companyName: SCANSOURCE, INC.

ticker: SCSC


text: The Security Team, which is part of the Digital Office organization, is led by the CISO, who has 20 years of security experience across different industries. The CISO reports to our Head of Digital Office, who has more than 20 years of experience leading software and infrastructure teams, including over a decade in the cybersecurity industry. Our security is managed based on industry-leading standards such as ISO 27001, National Institute of Standards and Technology (NIST), Center for Internet Security (CIS), Open Worldwide Application Security Project (OWASP) Application Security Verification Standard (ASVS) and the Software Assurance Maturity Model (SAMM).

companyName: LOGITECH INTERNATIONAL S.A.

ticker: LOGI


text: The Audit Committee receives reports on the Company's cybersecurity program and developments from our Chief Information Officer ("CIO"), who reports to the Chief Executive Officer, and our CISO, who reports to the CIO, at each of our regular meetings, which occur five times a year. These reports typically include analyses of recent cybersecurity threats and incidents at the Company and across the industry, as well as a review of our own security controls, assessments and program maturity, and risk mitigation status, as well as a review of our third-party service providers. Our digital technology, legal, and the corporate audit functions also routinely present to the Audit Committee on key cybersecurity topics and, on at least an annual basis, the Board receives reports on the Company's cybersecurity program and developments from the CIO and CISO.

companyName: Baker Hughes Co

ticker: BKR


text: Our Board of Directors, primarily through the Audit Committee, oversees management's approach to managing cybersecurity risks. The Audit Committee holds periodic discussions with management regarding the Company's guidelines and policies with respect to cybersecurity risks and receives regular reports regarding such risks and the steps management has taken to monitor and control any exposure resulting from such risks. Our CISO also leads an annual review and discussion with the full Board of Directors dedicated to Primo's cyber risks, threats, and protections and provides updates throughout the year, as warranted.

companyName: Primo Water Corp /CN/


text: We are committed to maintaining robust governance and oversight of these risks and to implementing mechanisms, controls, technologies, and processes designed to help us assess, identify, and manage these risks. While we have not, as of the date of this Form 10-K, experienced a cybersecurity threat or incident that resulted in a material adverse impact to our business or operations, there can be no guarantee that we will not experience such an incident in the future. Such incidents, whether or not successful, could result in us incurring significant costs related to, for example, rebuilding our internal systems, writing down inventory value, implementing additional threat protection measures, defending against litigation, responding to regulatory inquiries or actions, paying damages, providing customers with incentives to maintain a business relationship with us, or taking other remedial steps with respect to third parties, as well as incurring significant reputational harm. In addition, these threats are constantly evolving, thereby increasing the difficulty of successfully defending against them or implementing adequate preventative measures. Based on media reports and other surveys, we believe there is a general increase in cyberattack volume, frequency, and sophistication. We have experienced the same in our own business. We seek to detect and investigate unauthorized attempts and attacks against our network and to prevent their occurrence and recurrence where practicable through changes or updates to our internal processes and tools; however, we remain potentially vulnerable to known or unknown threats. In some instances, we, our suppliers, and our customers can be unaware of a threat or incident or its magnitude and effects.

companyName: VISHAY INTERTECHNOLOGY INC

ticker: VSH


text: Cybersecurity is an integral part of our risk management program and is an area of focus for our Board of Directors and management. The Audit Committee of our Board of Directors is responsible for the oversight of risks from cybersecurity threats. Members of the Audit Committee receive updates, as warranted, including quarterly updates from our Chief Information Security Officer ("CISO") regarding matters of cybersecurity, such as key risks facing the organization, core topics, review of incidents, as well as progress against key information security initiatives. Senior executive leadership also engage in ad-hoc discussions with management on cybersecurity topics. In addition, our Board of Directors are provided with an annual report regarding cybersecurity information and related topics.

companyName: UNIVERSAL HEALTH SERVICES INC

ticker: UHS


text: Cybersecurity Program Overview The Advisor has established a cybersecurity program designed to identify, evaluate, and mitigate risks from cybersecurity threats applicable to the Company.

companyName: 5C Lending Partners Corp.


text: We regularly evaluate and seek to improve and mature our cybersecurity processes. Our cybersecurity program is regularly assessed through management self-evaluation and ongoing monitoring procedures to evaluate our program effectiveness, including assessments associated with internal controls over financial reporting as well as vulnerability management through active discovery and testing to validate patching and configuration. As cybersecurity threats are continuously evolving, we also periodically engage with third parties to perform maturity assessments of our program to identify potential risk areas and improvement opportunities. This includes assessment of our overall program, policies and processes, compliance with regulatory requirements and an overall assessment of key vulnerabilities. We use these assessments to supplement our own evaluation of the overall health of our program and target improvement areas.

companyName: Vuzix Corp

ticker: VUZI


text: With respect to third party service providers, our information security program includes conducting risk-based due diligence of certain service providers' information security programs prior to onboarding. We seek to contractually require third party service providers with access to our information technology systems, sensitive business data or personal information to maintain reasonable security controls and restrict their ability to use our data, including personal information, for purposes other than to provide services to us, except as required by applicable law. We also seek to negotiate contractual requirements which compel our service providers to notify us of information security incidents occurring on their systems which may affect our systems or data, including personal information.

companyName: Cheniere Energy, Inc.

ticker: LNG


text: Our CISO works with an enterprise-wide cybersecurity team that provides 24/7/365 support. Our cybersecurity policies, procedures, and strategies primarily are implemented by our information security department. Other personnel and departments in the company also assist with cybersecurity risk management, including but not limited to our technology organization and our privacy, legal, vendor risk management, and corporate audit services teams. We have also developed processes to integrate cybersecurity risk management within the company's product and software development processes. In addition, product teams and business unit leaders are involved in product-related cybersecurity risk management.

companyName: GoDaddy Inc.

ticker: GDDY


text: Our CIO, supported by our Director of Cybersecurity provides quarterly reports to the Board, which, generally includes: • Our cybersecurity risk profile; • Any changes to our cybersecurity strategy; • Status of the execution of the cybersecurity strategy; and • Summary of any non-material cybersecurity incidents that have occurred over the past quarter, including the nature, impact and resolution of incidents.

companyName: ASTEC INDUSTRIES INC

ticker: ASTE


text: Our management team is tasked with the daily management of the cybersecurity risks we encounter and supervises the EPTRC. Our EPTRC, in turn, oversees the assessment of information security, the creation of policies, standards, and procedures, as well as testing, training, and security reporting processes for our Company. The EPTRC is comprised of management with the appropriate expertise and authority to ensure effective oversight of the Information Security Program.

companyName: SOUTHERN FIRST BANCSHARES INC

ticker: SFST


text: We have integrated the above cybersecurity risk management processes into our overall ERM program. Cybersecurity risks are understood to be significant business risks, and as such, are considered an important component of our enterprise-wide risk management approach.

companyName: Chord Energy Corp

ticker: CHRD


text: Our CISO provides reports to the Audit Committee of our Board of Directors on a standing basis at each Audit Committee meeting, and as otherwise requested by the Chair of the Audit Committee or as determined necessary by the CISO or other members of senior management. The CISO is personally involved in, and responsible for, the risk assessment, identification and management process described above.

companyName: TELOS CORP

ticker: TLS


text: Technical Safeguards: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, Third parties also play a role in our cybersecurity. We engage third-party service providers to conduct evaluations of our security controls, independent audits or consulting on best practices to address new challenges.

companyName: AnTix Holdings, Inc.

ticker: IMTH


text: Our executive team, along with our Audit Committee, assess and manage cybersecurity risk as part of our overall business strategy, financial planning and capital allocation. Our Audit Committee and Board of Directors engage with members of the executive team and are briefed on cybersecurity risks at least once each calendar year and with respect to any potentially material cybersecurity incidents. Our Chief Information Officer reports regularly, and at least annually, to our Audit Committee and such report may address overall assessment of our compliance with our cybersecurity policies, and include topics such as risk assessment, risk management and control decisions, service provider arrangements, test results, security incidents and responses, and recommendations for changes and updates to policies and procedures. Our Chief Information Officer has served in various senior information technology roles, responsible for information security for over 20 years.

companyName: TransMedics Group, Inc.

ticker: TMDX


text: Companies such as ours face a variety of risks, including financial reporting, legal, credit, liquidity, operational, health, safety and cybersecurity risks. The Board believes an effective risk management system will (1) identify the material risks that we face in a timely manner, (2)

companyName: Blue Line Protection Group, Inc.

ticker: BLPG


text: Our board of directors is responsible for overseeing our risk management program and cybersecurity is an element of this program. Our cybersecurity risk assessment and management efforts are led by our Director of Information Technology, who is responsible for implementing and overseeing processes for the monitoring of our information systems. This includes responsibility for the deployment of cybersecurity measures and system audits to identify potential cybersecurity vulnerabilities. Our Director of Information Technology reports directly to our COO. Risks from Cybersecurity Threats We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing.

companyName: ZYNEX INC

ticker: ZYXIQ


text: TIAA actively monitors the current cyber threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Account in connection with its day-to-day commercial real estate, investment, and other operations.

companyName: TIAA REAL ESTATE ACCOUNT


text: The Board, acting through its committee structure, is responsible for overseeing management's implementation and execution of the risk management process and for coordinating the outcome of reviews by Committees in their respective risk areas. Although each Committee is responsible for overseeing the management of certain risks, the full Board is regularly informed by the Committees about these risks. This helps enable the Board and the Committees to coordinate risk oversight and the relationships among the various risks faced by the Company, including cybersecurity risk.

companyName: DuPont de Nemours, Inc.

ticker: DD


text: The Board receives regular reports from management on our cybersecurity risks. In addition, management updates the Board, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential. The Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Vice President of Information Technology, risk management and internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: TERAWULF INC.

ticker: WULF


text: In addition, we incorporate reviews by our Internal Audit Group and external expertise in our TRIS program, including an independent third-party assessment of our cybersecurity measures and controls and a third-party cyber maturity assessment of our TRIS program against the Cyber Risk Institute Profile standards for the financial sector. We also invest in threat intelligence, collaborate with our peers in areas of threat intelligence, vulnerability management, incident response and drills, and are active participants in industry and government forums.

companyName: AMERICAN EXPRESS CO

ticker: AXP


text: Our cybersecurity program is managed and implemented by a team of enterprise level and business unit level information security professionals, partnering with third party advisory services, as needed. The team's focus is on our operational response to cybersecurity threats, exposure analysis, security governance and the design and implementation of our security controls. Our Incident Response Plan and attendant processes, developed by management, governs our process to respond to, remediate and resolve material cybersecurity incidents, including providing appropriate internal and external communication of such incidents.

companyName: MASCO CORP /DE/

ticker: MAS


text: The underlying processes and controls of our cyber risk management program incorporate recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) and processes and controls supporting requirements with the General Data Protection Regulation (GDPR). The NIST CSF offers a thorough set of guidelines and best practices to help establish a strong cybersecurity posture. Utilizing NIST CSF enables us to systemically identify, assess, and manage cybersecurity risks most relevant and impactful to our business operations. It is important to note that using the NIST CSF as a guide does not imply our cybersecurity program meets any specific technical standards or requirements.

companyName: Banzai International, Inc.

ticker: BNZI


text: Detection and Analysis We have implemented controls aligned with industry guidelines and applicable statutes and regulations to identify threats, detect attacks and protect the integrity of our information assets. Our cybersecurity team, with the assistance of an outside cybersecurity firm, continuously monitors for threats to keep our systems secure. Cybersecurity incidents may also be detected through a variety of means, which may include, but are not limited to, employee notification to our IT service center, notification from external parties (e.g., customers, vendors, or service providers), and automated event-detection notifications. Once a potential cybersecurity incident is identified, including a third-party cybersecurity event, the incident response team designated pursuant to the incident response plan follows the procedures set forth in the plan to investigate the potential incident, including classifying the nature and severity of the event. Potentially significant cybersecurity incidents are escalated to the Disclosure Committee, which makes determinations regarding SEC reporting obligations related to the cybersecurity incident.

companyName: American Homes 4 Rent

ticker: AMH


text: We face a number of cybersecurity risks in connection with our business and have from time-to-time experienced cybersecurity incidents, which to date have not had a material impact on our financial condition or results of operations. For more information about the cybersecurity risks we face, see Item 1A—Risk Factors "Our internal computer systems, or those used by any CROs or other third-party contractors or consultants we may engage, may fail or suffer security breaches."

companyName: Clene Inc.

ticker: CLNN


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management, including training on best practices for data privacy and security and safekeeping of patient information; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for information technology software service providers, suppliers, and vendors that have access to our critical systems and information.

companyName: bluebird bio, Inc.


text: Notwithstanding our defensive measures and processes, the threat posed by cyber-attacks is severe, and we may not be successful in preventing or mitigating all cybersecurity incidents that could have a material adverse effect on the Company. However, as of the date of this Form 10-K, the Company is not aware of any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition that are required to be reported in this Form 10-K. For further discussion, please see Item 1A. "Risk Factors" for a discussion of cybersecurity risks.

companyName: Third Coast Bancshares, Inc.

ticker: TCBX


text: During the year ended December 31, 2024, we did not identify any risks from known cybersecurity threats, including because of any prior cybersecurity incidents, that have materially affected us. However, in the future, we may face certain ongoing cybersecurity risks or threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the heading "Our operations could be disrupted by failure of our information systems or cyber-attacks."

companyName: Innoviva, Inc.

ticker: INVA


text: The Evergy Companies have been subjected to attempted cyber attacks from time to time, and will likely continue to be subject to such attempted attacks, but these prior attacks have not had a material impact on the Evergy Companies' operations or financial results to date. However, because technology is increasingly complex and cyber attacks are increasingly sophisticated and more frequent, there can be no assurance that such incidents will not have a material adverse effect on the Evergy Companies in the future. See Item 1A. Risk Factors – Operational Risks for additional information.

companyName: Evergy, Inc.

ticker: EVRG


text: Third-Party Risk Management—We maintain a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties (including vendors, service providers and other external users of our systems) as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.

companyName: HERC HOLDINGS INC

ticker: HRI


text: Our executive team is responsible for overseeing matters relating to our information technology and cybersecurity risk exposures and the steps our Company takes to monitor and mitigate these risks. The executive team is briefed quarterly or as needed by senior management and the Chief Information Security Officer, or CISO, on cybersecurity matters, or more frequently as the circumstances require. Our Vice President of Technology, who serves as our CISO, oversees data privacy, information technology, and cybersecurity matters. Our CISO has extensive information technology and program management experience, has served in this role for the Company since 2022 and has supported the Company's information security function since 2017.

companyName: Korth Direct Mortgage Inc.


text: The Company maintains administrative, physical, technical and organizational safeguards, including employee training, incident response capability reviews and exercises, cybersecurity insurance and business continuity mechanisms for the protection of the Company's assets. From time to time, the Company's processes are audited and validated by internal and external experts. The Company leverages a third-party cybersecurity program with the goal of minimizing disruption to the Company's business and production operations, strengthening supply chain resilience in response to cyber-related events and supporting the integrity of components and systems used in its products and services.

companyName: General Motors Co

ticker: GM


text: We have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our management is generally responsible for assessing and managing any cybersecurity threats. If and when any reportable cybersecurity incident arises, our management shall promptly report such matters to our board of directors for further actions, including regarding the appropriate disclosure, mitigation, or other response or actions that the board deems appropriate to take. of the date of this report, we have no t encountered any cybersecurity incidents since our IPO.

companyName: ALPHATIME ACQUISITION CORP


text: To mitigate material risks posed by cybersecurity threats to our critical networks, third -party services, and data assets, we have instituted a comprehensive suite of information security processes. These measures encompass the diligent identification, assessment, and management of potential risks, threat monitoring services, and vulnerability assessments.

companyName: Whitestone REIT

ticker: WSR


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Chief Information Security Officer, Chief Information Officer, and our management technology steering committee. Such individuals have collectively over 30 years of prior work experience in various roles involving managing information security, developing cybersecurity strategy, and implementing effective information and cybersecurity programs, as well as several relevant certifications, including Certified Information Security Manager, Cisco Certified Network Administrator-Security, CompTIA Secure Infrastructure Specialist, and many others.

companyName: Mechanics Bancorp

ticker: MCHB


text: The Company's information security and cybersecurity program is managed by our Chief Information Security Officer (CISO) and our Chief Technology Officer (CTO). The CISO and the Senior Director Information Security are responsible for our overall network security and assessing and managing cybersecurity risks and threats. The CISO has over 20 years of information security, privacy, auditing and compliance experience and holds numerous certifications. The Senior Director of Information Security has over 15 years of experience in information security, and holds numerous certifications. The CTO has over 20 years of experience and has been a leader of our Company's information systems and technological advancements for the past nine (9) years. The SVP of Engineering has over 20 years of experience in IT and has specialized knowledge in systems and network infrastructure. The Director of SRE and Security has eight (8) years of experience and has principal responsibility for our network operations and system administration.

companyName: Talkspace, Inc.

ticker: TALK


text: Our Board of Directors provides oversight of risks from cybersecurity threats. The Security and Privacy Management Committee (the "SPMC") consists of our Chief Financial Officer, General Counsel, Vice President of Information Technology, Chief Human Resources Officer, Director of Information Security and Director of Environmental Health and Safety. The SPMC is tasked with ensuring risks are adequately addressed within our governance framework.

companyName: EXPONENT INC

ticker: EXPO


text: an information technology department principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents;

companyName: Sunstone Hotel Investors, Inc.

ticker: SHO


text: Our Information Security Officer is responsible for managing our information security program, inclusive of cybersecurity risk assessment, incident response, vulnerability assessment, threat intelligence, identity access governance, third-party risk management, and business continuity. Some of these responsibilities are carried out in collaboration with other internal departments, such as the information technology department. In any case, the Information Security Officer provides guidance, oversight, and monitoring of the information security program, and acts in an independent role, reporting directly to the Chief Operating Officer and subsequently to the Audit and Examination Committee of the board of directors. Our Information Security Officer has extensive bank operations experience, has attained Certified Banking Security Manager certification with the banking industry, and attends relevant cybersecurity training sessions on a regular basis. Our information technology department consists of technology professionals with varying degrees of education and experience. Our information technology management team has significant technology and operational experience, including experience in mitigating and responding to cybersecurity threats.

companyName: CITIZENS FINANCIAL SERVICES INC

ticker: CZFS


text: Our business operations and relationships with customers and suppliers are heavily reliant on technology. We operate a cybersecurity program designed to assess our security risks and threats, to manage those risks and protect our technology systems and data, and to detect and respond to cybersecurity incidents.

companyName: lululemon athletica inc.

ticker: LULU


text: In addition, our company's incident response policy and vulnerability management policy include reporting to the audit committee of the board of directors for certain cybersecurity incidents. Our audit committee receives periodic reports from our information technology department concerning the company's significant cybersecurity threats and risk and the processes the company has implemented to address them.

companyName: Moatable, Inc.

ticker: MTBLY


text: We have established an Enterprise Risk Committee ("ERC") to manage overall risk across the Company including cybersecurity risks identified by the cybersecurity team; the ERC includes representatives from relevant functions and is led by our Chief Executive Officer ("CEO"). We have also established an Operational Risk Committee ("ORC") which is responsible for applying the policy decisions of the ERC. Operational responsibility for ensuring the adequacy and effectiveness of our risk management, control and governance processes is assigned to our Chief Information Security Officer, who periodically reports, among other things, potentially material cybersecurity incidents to the ORC and, in coordination with the Chief Information Officer and Head of Operations, reports to the ERC at least annually. The Chief Information Security Officer leads the Company's cybersecurity team, which includes individuals dedicated to incident detection and response. This team is responsible for identifying threats that can impact the Company and designing controls to mitigate vulnerabilities before they are exploited and to detect and neutralize any threats that do materialize. The Chief Information Security Officer and Chief Information Officer each have more than 20 years of experience in their fields. The Chief Information Security Officer and senior members of the cybersecurity team hold industry standard certifications.

companyName: TPG Inc.

ticker: TPG


text: Role of Management Pathward's Information Security Program is managed by the Company's Chief Information and Operations Officer ("CIOO") and Chief Information Security Officer ("CISO"). The current CIOO has over 30 years of experience in senior leadership positions in the areas of information technology, technology innovation and enterprise architecture, and has been recognized for various technology and leadership awards. The current CISO reports to the CIOO and has extensive years of experience in information security both at Pathward and at other companies as well as many years of executive management experience. The CISO regularly reports to executive management, the Risk Committee of the Board of Directors (the "Board Risk Committee") and the Board of Directors regarding all aspects of information security including cybersecurity risk and incidents. The Information Technology Committee and Executive Risk Committee provide governance and oversight of the Information Security Program. These Committees convene at least four times annually, reporting significant activities and issues upward to the Board Risk Committee and the Board of Directors as necessary.

companyName: PATHWARD FINANCIAL, INC.

ticker: CASH


text: The Company has adopted policies and implemented certain controls and procedures that allow its management to assess, identify and manage material risks from cybersecurity threats and for the Board of Directors (the "Board"), through its Audit Committee, to actively oversee the strategic direction, objectives, and effectiveness of the Company's cybersecurity risk management framework. The Cybersecurity Program is developed and reviewed by the Company's executive leadership alongside the Company's Audit Committee and carried out and overseen by the senior person in charge of IT at the Company, currently our Chief Compliance Officer ("CCO").

companyName: Quipt Home Medical Corp.

ticker: QIPT


text: As of the date of this Annual Report on Form 10-K, we have not encountered risks from cybersecurity threats that have materially affected, or are reasonably likely to materially affect, our business strategy, results of operations or financial position. For more information about the cybersecurity risks we face, see the risk factor entitled "Malicious cyber-attacks and other adverse events affecting the Company's operational systems or infrastructure, or those of third parties, could disrupt the Company's business, result in the disclosure of confidential information, damage the Company's reputation and cause losses or regulatory penalties" in Item 1A- Risk Factors.

companyName: Cantor Fitzgerald Income Trust, Inc.


text: We are committed to safeguarding our stakeholders' sensitive information shared in the application of software and services provided by the Company. We believe that our cybersecurity program, risk management and governance reflect our commitment to our stakeholders.

companyName: Simulations Plus, Inc.

ticker: SLP


text: Governance and Oversight of Cybersecurity Risks GECM's cybersecurity program is managed by Great Elm IT Management. The members of the Great Elm IT Management team collectively have years of experience helping to oversee the information technology infrastructure and processes at GECM and other asset managers. Great Elm IT Management is responsible for supervising and interfacing with providers to implement GECM's monitoring and alert response processes, vulnerability management, changes made to its critical systems, including software and network changes, and various other technological and administrative safeguards.

companyName: Great Elm Group, Inc.

ticker: GEG


text: The Company recognizes the risk that cybersecurity threats pose to our operations, and cybersecurity is an integral component of our overall risk management strategy. We have adopted the U.S. Department of Commerce's National Institute of Standards and Technology (NIST) Cybersecurity Framework (the Framework) to guide our cybersecurity program. Developed in 2013, the Framework is a voluntary set of standards, guidelines, and best practices designed to help organizations better manage cybersecurity risks. CNX's cybersecurity team consists of certain of our executive officers as well as dedicated cybersecurity personnel – including without limitation, our Chief Information Officer (CIO), Director of Cybersecurity, and multiple cybersecurity engineers. The cybersecurity team, led by professionals with deep cybersecurity expertise across multiple industries, takes a cross-functional approach to addressing these risks and engages in discussions with the Board of Directors (The Board) and our executive management team accordingly on an as-needed basis.

companyName: CNX Resources Corp

ticker: CNX


text: With oversight from the Board of Trustees, the Advisor is responsible for managing all cyber risks and overseeing our security programs. Cybersecurity risk management has been delegated to the Advisor's executive officers, with day-to-day management carried out by the Advisor's Chief Transformation Officer (CTO), Jamie Bucholz.

companyName: Sterling Real Estate Trust


text: Prevention and Preparation Franklin Templeton undertakes regular internal and external security audits and vulnerability assessments to reduce the risk of a cybersecurity incident and they implement business continuity, contingency and recovery plans to mitigate the impact of an incident. As part of these efforts, Franklin Templeton periodically engages consultants to conduct external reviews of its vulnerabilities, including penetration testing and compromise assessments. Franklin Templeton employs best practice identity and access management including broad adoption of multifactor authentication, geo-location blocking, behavior analytics and controls aligned to a zero trust model.

companyName: Franklin BSP Capital Corp

ticker: FRBP


text: We experience cybersecurity threats and incidents from time to time. However, as of the date of this report, we have not experienced a cybersecurity threat or incident that has materially affected the Company, including our business strategy, results of operations, or financial condition, in at least the last three years. While we are not currently aware of any risks from cybersecurity threats that are reasonably likely to materially affect the Company, please see Part I, Item 1A. – "Risk Factors – Malicious cyber-attacks, attempted cybersecurity breaches, and other adverse events affecting our operational systems or infrastructure, or those of third parties, could disrupt our businesses, result in the disclosure of confidential information, damage our reputation and cause losses or regulatory penalties."

companyName: MARKETAXESS HOLDINGS INC

ticker: MKTX


text: Our management, including our Chief Executive Officer, Chief Financial Officer, Chief Technology Officer ("CTO"), and Information Technology team, is responsible for identifying and assessing cybersecurity risks, establishing monitoring processes and implementing mitigation and remediation measures. In fiscal 2025, we hired a full-time Director of Information Technology, who is a Certified Information Security Professional. Our cybersecurity programs are managed under the direction of our CTO and the Director of Information Technology, with support from internal and external third-party resources.

companyName: AstroNova, Inc.

ticker: ALOT


text: We are required to comply with the UK General Data Protection Regulation (GDPR) relating to the security of personally identifiable information that we process. A data breach can result in non-compliance with the GDPR, leading to fines or litigation.

companyName: LUXFER HOLDINGS PLC

ticker: LXFR


text: Our Board of Directors, Audit Committee and senior management oversee risk management to ensure that the Company's policies and procedures are functioning as intended to protect the Company's information systems from cybersecurity threats. The Audit Committee performs an annual review and discussion of the Company's cybersecurity program, which includes planned actions in the event of a threat or recovery situation.

companyName: ENNIS, INC.

ticker: EBF


text: Additionally, our Cybersecurity Steering Committee is co-chaired by our CIO and Cybersecurity, Governance Risk and Compliance manager along with other key leaders, including the Chief Human Resources Officer, Vice President of Finance, Corporate Controller, Senior Corporate Risk Manager, Director of Enterprise Infrastructure and Senior Director of Internal Audit, all overseeing the management of key cybersecurity risks and strategy for the organization. The Cybersecurity Steering Committee meets and receives bi-monthly updates, which provide ongoing visibility into cybersecurity risks and mitigation efforts.

companyName: AMERICAN WOODMARK CORP

ticker: AMWD


text: Related to Cybersecurity Risks Our Vice President of Information Technology ("VP of IT") is responsible for the direction of our information technology organization. Our VP of IT has over twenty-five years of cybersecurity and incident management experience. Our VP of IT is supported by a third-party virtual chief information security officer ("vCISO") who also has over twenty-five years of cybersecurity experience. Our VP of IT, supported by our vCISO, assesses our cybersecurity risks through regular meetings with our IT team, and escalates cybersecurity matters as needed to management.

companyName: Anika Therapeutics, Inc.

ticker: ANIK


text: We have established processes designed to identify, assess and manage material risks associated with cybersecurity threats. Our information technology, networks, and infrastructure may be subject to damage, disruptions, or shutdowns due to cyber-attacks, malware, employee or third-party error or malfeasance, power outages, communication or utility failures, systems failures, natural disasters or other catastrophic events. These risks include, among other things, operational risks, intellectual property theft, fraud, extortion, harm to employees or customers, violation of privacy or security laws and other litigation and legal risks, and reputational risks.

companyName: Frontier Communications Parent, Inc.