text: As part of its enterprise risk management ("ERM") framework, Morgan Stanley has implemented and maintains a program to assess, identify, and manage risks arising from the cybersecurity threats confronting the Firm ("Cybersecurity Program"). Morgan Stanley's Cybersecurity Program helps protect the Firm's clients, customers, employees, property, products, services, and reputation by seeking to preserve the confidentiality, integrity, and availability of information, enable the secure delivery of financial services, and protect the business and the safe operation of our technology systems, including as applicable to the Company and its unitholders. Morgan Stanley continually adjusts its Cybersecurity Program to address the evolving cybersecurity threat landscape and comply with extensive legal and regulatory expectations.

companyName: North Haven Private Income Fund LLC


text: Key elements of our cybersecurity risk management program include, but are not limited to, the following: • risk assessments designed to help identify material cybersecurity risks to our critical systems and information; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees; • an information security event response plan that includes procedures for responding to cybersecurity events; • an information security event response team (the "Response Team") principally responsible for managing our response to cybersecurity events; and • a third-party risk management process for key IT vendors based on our assessment of their criticality to our operations and respective risk profile.

companyName: Penguin Solutions, Inc.

ticker: PENG

secItem: Item 1C


text: Our VP of Engineering Infrastructure and our Chief Information Security Officer ("CISO") lead the Company's cybersecurity function. Our CISO supervises both our internal cybersecurity personnel and our external cybersecurity service providers. Our CISO has significant global experience in managing and leading IT and cybersecurity teams, with over 20 years of experience in the cybersecurity industry in various positions. Our CISO is a Certified Information Systems Security Professional by the International Information System Security Certification Consortium. Our CISO reports to our VP of Engineering Infrastructure, who has over 18 years of experience in leading software engineering teams in the technology industry, including at Yahoo!.

companyName: Maplebear Inc.

ticker: CART


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: Allison Transmission Holdings Inc

ticker: ALSN


text: Education and Awareness: CTO, through the MSP, provides regular training for personnel regarding cybersecurity threats as a means to equip personnel with effective tools to address cybersecurity threats, and to communicate evolving information security policies, standards, processes and practices.

companyName: Alpine Income Property Trust, Inc.

ticker: PINE


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section titled "Risk Factor— Our information technology systems, or those of our CROs or other contractors or consultants we may utilize, may fail, suffer disruptions or suffer security breaches, which could result in a material disruption of our product development programs."

companyName: CytomX Therapeutics, Inc.

ticker: CTMX


text: The Cybersecurity Documents outline the correct usage of elements and tasks on the networks/infrastructure to ensure safe operation, high availability, performance, and data accuracy.

companyName: VanEck Bitcoin ETF

ticker: HODL


text: Cybersecurity Strategy Our cybersecurity strategy is aligned with our overall business objectives and includes the following key elements: • Implementation of multiple layers of security controls, including firewalls, intrusion detection and prevention systems, endpoint protection and encryption, to safeguard our information assets. • Ongoing education programs for employees to enhance their awareness of cyber risks and promote a culture of cybersecurity throughout the organization.

companyName: DNOW Inc.

ticker: DNOW


text: Our Manager of IT security has more than 20 years of IT experience. He joined the company in 2015 as a Systems Engineer and was promoted to his current position in 2020. Prior to joining Rayonier, he worked as an Infrastructure Engineer at Enterprise Integration (EI), a managed services provider. Prior to joining EI, he held various IT roles in support and engineering.

companyName: Rayonier, L.P.


text: The Company's cybersecurity risk management program and strategy are regularly assessed by consultants, regulatory authorities, and external auditors. The Company's Enterprise Risk Management department also plays a crucial role in monitoring the program by internally conducting regular cyber maturity assessments. Cybersecurity processes are adjusted as needed based on the information gathered from these internal and external assessments to ensure that the program is aligned with the Company's business objectives, is designed to address evolving cybersecurity threats, satisfies regulatory requirements, and conforms with industry standards.

companyName: National Bank Holdings Corp

ticker: NBHC


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report, including "If our information technology systems or data or those of third parties upon which we rely, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; loss of customers or sales; and other adverse consequences."

companyName: Bionano Genomics, Inc.

ticker: BNGO


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section titled "Risk Factor—Risks Related to our Business, including the Regulatory Compliance and Commercialization of our Product, Gimoti— Our business and operations would suffer in the event of information technology system failures, cyberattacks, and other security incidents."

companyName: Evoke Pharma Inc

ticker: EVOK


text: We have established policies and procedures, including our Incident Response Plan ("IRP"), for assessing, identifying, managing, and responding to cybersecurity and privacy threats and incidents, including protocols for assessing potential material impact from cybersecurity threats and incidents, escalating to executive leadership and the Board, engaging external stakeholders, and reporting incidents based on applicable legal requirements. Our IRP provides guidance in the event of a cybersecurity incident, including processes with roles and responsibilities assigned to members of our Incident Response Team ("IRT"), to triage, assess severity, escalate, contain, investigate, and remediate incidents, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. Our IRT is led by our Vice President, Global Security, with representatives from our IT, Security, Corporate Legal, Communications and Public Relations, Human Resources, Ethics & Compliance and Finance departments/functions.

companyName: Rimini Street, Inc.

ticker: RMNI


text: Our cybersecurity policies and processes are based on the controls within the National Institute of Standards and Technology ("NIST") Framework, and we engage a number of external parties to enhance our cybersecurity oversight. For example, every other year, a third-party consulting firm performs an assessment of our cyber program, measuring our program against the NIST controls with a Capability Maturity Model Integration overlay to determine the program's maturity. The assessment findings are disclosed to the Audit Committee of the Board of Directors and our cross-functional management Security Steering Committee ("SSC"). Any improvements resulting from the assessment are identified, along with action plans. We also use a third party to perform an annual Breach Assessment targeting our external and internal network environment to determine the strengths and any weaknesses within our cybersecurity processes. As part of the Breach Assessment, our Incident Response Plan is instigated and reviewed to ensure it remains current and effective for all situations. We also have multiple third-party managed Security Operations Centers ("SOC") in place; including a SOC for logging and monitoring of security events; a SOC for endpoint managed detection and response, including identity protection; a SOC for executive digital and brand protection; and a SOC for protection of network credentials.

companyName: Primoris Services Corp

ticker: PRIM


text: The Company's process for assessing, identifying, and managing material risks from cybersecurity threats is as follows: the Company has cloud-based security, our computers and servers are fire walled. In addition, the Company does not allow virtual log-in on their computers. The Company has engaged third-party consultants with regard to our cloud-based cybersecurity. We have had no current or previous cybersecurity incidents that have materially affected or were likely to materially affect the Company's business strategy, results of operations or financial condition.

companyName: My City Builders, Inc.

ticker: MYCB


text: The Company and its subsidiaries' third-party service providers collect, process, and store certain information, including PII, PHI, or other confidential and proprietary information. We maintain a third-party vendor security risk management program to assess the cybersecurity risk and measures taken by such service providers. The program includes a third-party risk assessor, security risk reports, and formal business owner risk response.

companyName: CLOVER HEALTH INVESTMENTS, CORP. /DE

ticker: CLOV


text: In addition, we provide regular cybersecurity training to all employees on a quarterly basis and conduct ongoing awareness programs to keep employees informed about cybersecurity best practices. Employees have been trained, enabling them to detect and report on any malicious intrusions or social engineering attempts to infiltrate our systems. They are also regularly trained, tested and reported on through KnowB4 spear-phishing email campaigns to ensure our training is effective. We are fully insured for cyber risk through our insurance provider.

companyName: Lodging Fund REIT III, Inc.


text: Our cybersecurity policies, standards, processes, and practices are based on applicable laws and regulations and informed by industry standards and industry-recognized practices. Our strategy to assess, identify, and manage material cybersecurity risks is through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security, and availability of our information systems and data. We implement security measures and processes to identify, prevent, and mitigate cybersecurity threats and to effectively respond to cybersecurity incidents when they occur. Our cyber risk management includes: (1) enterprise risk management to identify top cybersecurity risks; (2) vulnerability management to identify software vulnerabilities and risks related to compute infrastructure; (3) vendor risk management to identify risks related to third parties and business partners, which includes pre-engagement review, use of contractual security provisions, and continued monitoring, as applicable; (4) privacy risk management to identify privacy risks in our product and platforms and ensure regulatory compliance; (5) security monitoring to analyze and assess threat activity in real time; and (6) security incident response to investigate, respond to, and mitigate cyber threats. We regularly engage third parties to identify risks in our underlying software and infrastructure, to provide threat intelligence, and to assist in triaging, identifying, and responding to cyber threats.

companyName: VIVOS INC

ticker: RDGL


text: Management's Role Managing Risk The CEO plays a pivotal role in informing the Board of Directors on cybersecurity risks. The CEO provides comprehensive briefings to the Audit Committee on a regular basis, with a minimum frequency of once per year. These briefings encompass a broad range of topics, including: Current cybersecurity landscape and emerging threats; Status of ongoing cybersecurity initiatives and strategies; Incident reports and learnings from any cybersecurity events; and Compliance with regulatory requirements and industry standards.

companyName: Oncotelic Therapeutics, Inc.

ticker: OTLC


text: Our Chief Information Officer ("CIO") and Chief Information Security Officer ("CISO") each have over 24 years of information system experience and are primarily responsible for implementing the Cybersecurity Program and managing our information security personnel and consultants. The CIO has served in a variety of information technology leadership positions in the finance industry and holds a Bachelor of Science in Electrical Engineering. The CISO served in a variety of cybersecurity operations, cybersecurity architecture, and critical infrastructure cybersecurity enhancement programs in the finance industry, the utility industry and in government and holds a Bachelor of Science in Management Information Systems and Decision Sciences.

companyName: PennyMac Mortgage Investment Trust

ticker: PMT


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our CFO and IT manager. Our CFO has overseen and been responsible for the Company's information technology and cybersecurity programs since 2018, and before that held equivalent responsibilities at another public company. Our IT manager has approximately seven years of experience with testing, implementing and maintaining our information technology systems and security.

companyName: Kezar Life Sciences, Inc.

ticker: KZR


text: Our board of directors receives periodic reports at least annually from our CISO concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. Our board of directors also receives various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.

companyName: Fastly, Inc.

ticker: FSLY


text: Accordingly, Cybersecurity is an important and integrated part of the Company's enterprise risk management function that identifies, monitors, and mitigates business, operational, and legal risks.

companyName: Greenwave Technology Solutions, Inc.

ticker: GWAV


text: Website Access and Other Information The Company was incorporated under the laws of Ohio in 1983 with its headquarters at 221 East Fourth Street, Cincinnati, Ohio 45202 (telephone number (513) 397-9900 and website address http://www.altafiber.com). The Company has ceased to be subject to the reporting requirements of the Securities Exchange Act of 1934, as amended, but continues to voluntarily file annual, quarterly and certain other information with the SEC due to contractual provisions included in certain indentures. The SEC maintains an internet site that contains reports, proxy statements, and other information about issuers which file electronically with the SEC. The address of that site is http://www.sec.gov. Cincinnati Bell Inc.

companyName: CINCINNATI BELL INC


text: The Company's President and Chief Executive Officer, Luca Fabbri, is the member of the Company's management that is principally responsible for overseeing the Company's cybersecurity risk management program and incident reporting, in partnership with other business leaders across the Company. In the event there is a material cybersecurity breach or incident, Mr. Fabbri works in coordination with the Company's General Counsel, Christine Garrison, to assess and respond, including by reporting the breach or incident to our Board of Directors and/or applicable regulatory authorities, as necessary or required. Mr. Fabbri has a high level of exposure to cybersecurity oversight through his current and previous work in the technology sector. Mr. Fabbri has served in various roles in information technology and information security for over 30 years, including serving as a consultant with Elk Creek Ventures Inc. from 2003 to 2012, through which he provided consulting services in technology, and serving as co-founder and vice president of engineering of Co3 Systems Inc., an enterprise software company in the cybersecurity space that is now part of IBM, from 2010 to 2011. Mr. Fabbri also co-founded a software company called HomeSphere, for which he served as senior vice president and chief financial officer from 2000 to 2002, and currently serves on the board of directors of Basil Systems Inc., a healthcare software company. Mr. Fabbri, Ms. Garrison and the Company's Chief Financial Officer each hold degrees in their respective fields, and each have over 15 years of experience with managing risks at the Company and in environments similar to the Company's, including risks arising from cybersecurity threats.

companyName: Farmland Partners Inc.

ticker: FPI


text: Following the conclusion of an incident, the Franklin Templeton incident response team will generally reassess the effectiveness of the cybersecurity program and incident response plan, identify potential adjustments as appropriate and report to our senior management and Audit Committee on these matters.

companyName: Franklin BSP Realty Trust, Inc.

ticker: FBRT


text: Our CISO and Deputy CISO are primarily responsible for assessing and managing our material risks from cybersecurity threats. Our CISO has served in various roles building and securing enterprise platforms across retail, corporate and investment banking financial services as well as consumer experiences and data at multiple Fortune 500 companies for over 25 years. Our Deputy CISO has over 20 years of experience in information security, including serving as head of cybersecurity and privacy response at a global public company and information security leadership positions with the United States government. Our Deputy CISO holds undergraduate and graduate degrees in computer information systems and computer science with an information security focus and possesses various certifications, including the Information Systems Security Professional (NSTISSI No. 4011) and Information Systems Security Officer (CNSSI No. 4014) certifications.

companyName: Block, Inc.

ticker: XYZ


text: The Company assesses and monitors third-party risks and closely tracks cyber threats such as ransomware and emergent web-based vulnerabilities. A variety of controls exist to minimize the impact of these risks and ensure each is managed within organizational tolerances, which controls are monitored by management for effectiveness. In addition, James River's Information Security Office conducts cybersecurity risk reviews on new and existing third-party vendors and business partners, which are presented to management so that either appropriate risk mitigation controls can be established with respect to such third-party or the Company can avoid engaging with such third-party if they are deemed to present an unacceptable level of risk.

companyName: James River Group Holdings, Inc.

ticker: JRVR


text: Our company maintains a comprehensive Information Security Program ("IS Program") focused on detection, assessment and mitigation of cybersecurity risks. Our dedicated enterprise security team, led by our Chief Information Security Officer ("CISO"), administers the IS Program and is responsible for identification, investigation and response to cyber threats and vulnerabilities. The enterprise security team also implements, manages, and assesses our company's cyber policies, standards and procedures, which leverage our team's expertise and the National Institute of Standards and Technology Cybersecurity Framework. We have developed an incident response plan to handle suspected loss of, or unauthorized access to, information. We regularly conduct tabletop exercises, red team exercises, simulations, and other exercises to evaluate the effectiveness of our IS Program and to position our company for a coordinated, strategic response in the event of an actual security incident. All employees are required to complete cybersecurity trainings and employees in higher-risk roles are required to complete additional customized training tailored to address their specific risk exposure. Our Security Operations Center ("SOC"), which operates 24 hours a day, 365 days a year, is designed to provide visibility of security events across our Company and a mechanism for swiftly addressing cyber threats before they compromise data security. Through a combination of a threat management platform and our team of cybersecurity specialists, our SOC continuously monitors and proactively isolates and analyzes cybersecurity alerts to help us address cybersecurity risks.

companyName: CROWN CASTLE INC.

ticker: CCI


text: As an externally managed company, our day-to-day operations are managed by our Manager and our executive officers under the supervision of our board of directors and its committees. Our executive officers are senior investment professionals provided to us through our Manager pursuant to our management agreement with our Manager. Our business is highly dependent on the communications and information systems of our Manager, its affiliates and third-party service providers. Our Manager is an affiliate of ORIX Corporation USA ("ORIX USA"), a diversified financial company and a subsidiary of ORIX Corporation ("ORIX") and participates in and is subject to ORIX USA's cybersecurity program. Accordingly, we rely and Manager relies on ORIX USA and its cybersecurity risk management program to identify, assess and manage material risks to our business from cybersecurity threats.

companyName: Lument Finance Trust, Inc.

ticker: LFT


text: The Company's cybersecurity risk mitigation strategy includes the use of risk transfer via insurance that provides protection against certain potential losses arising from certain cybersecurity incidents.

companyName: Xylem Inc.

ticker: XYL


text: In certain circumstances, BHE relies on third-party service providers for a variety of products and services to run its information systems. This dependence exposes BHE, along with others who use these service providers, to the impact of a cyber attack on these providers. Cyber attacks at a third-party service provider could have a significant financial, operational, or reputational impact. BHE continuously monitors the risks associated with its service providers.

companyName: BERKSHIRE HATHAWAY ENERGY CO


text: Management of the Company is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Company, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, information technology, and/or compliance personnel of Oxford Funds.

companyName: Oxford Square Capital Corp.

ticker: OXSQ


text: Our full Board and our Audit Committee oversee risks from cybersecurity threats and our cybersecurity practices and policies. Accordingly, our CFO periodically updates the Board and Audit Committee on cybersecurity matters, including cybersecurity risks. Additionally, our Board and Audit Committee, as well as senior management, receive reports on an as-needed basis regarding our cybersecurity posture, cybersecurity incidents, and remediation efforts.

companyName: PERPETUA RESOURCES CORP.

ticker: PPTA


text: We believe that cyber safety is everyone's responsibility at Oncor. We take proactive steps to train, re-train, educate and test our workforce on cyber safety practices and work to strengthen the cyber community within our company. We require an annual cybersecurity training of all credentialled individuals, and each year we hold an annual cyber awareness month, which includes informational events, speakers and additional training resources to increase our workforce's engagement in cyber safety.

companyName: ONCOR ELECTRIC DELIVERY CO LLC


text: As part of our risk management processes, we perform risk assessments in which we map and prioritize information security risks identified through the processes described above, including risks associated with our use of third-party service providers, based on probability, immediacy and potential magnitude. These assessments inform our risk mitigation strategies, which are reviewed regularly with the Board and management, and we view information security risks as one of the key risk categories we face. For example, our information technology and infrastructure has experienced and may in the future be vulnerable to cyberattacks (including ransomware attacks) or security incidents, and third parties have in the past and may in the future be able to access proprietary business information, and personal data that we collect, store and process. For more information regarding the information security-related risks we face, see the information in "Item 1A: Risk Factors" under the caption "We have been and may be subject to information technology system failures, cloud failures, network disruptions, cybersecurity attacks and breaches in data security, which may materially adversely affect our operations, financial condition and operating results".

companyName: WHIRLPOOL CORP /DE/

ticker: WHR


text: Our Vice President of Information Technology, as head of our information technology team, leading our cybersecurity efforts, oversees the day-to-day administration of our cybersecurity program. Our CIRT has members that include our Chief Executive Officer, Chief Financial Officer, and Vice President of Information Technology. As key members of our management team, our Chief Executive Officer, Interim Chief Financial Officer, and Vice President of Information Technology have approximately a combined 45 years of risk management experience and are responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Key members of our information technology management team collectively possess over 15 years of hands-on experience in implementing a diverse array of cybersecurity initiatives. Their expertise spans both cloud and on-premise IT infrastructure and applications/systems, cultivated through extensive engagement across various regulated environments.

companyName: Coherus Oncology, Inc.

ticker: CHRS


text: The Board oversees the Company's ERM process, including the management of risks arising from cybersecurity threats. The Board receives reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, and information security considerations arising with respect to the Company's peers and third parties. The Board also receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.

companyName: Axe Compute Inc.

ticker: AGPU


text: Our systems periodically experience directed attacks that may be intended to lead to financial loss, interruptions and delays in our operations as well as loss, misuse or theft of personal information (of third parties, employees, and other stakeholders) and other data, confidential information or intellectual property. However, we are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, which have materially affected or are reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition. Refer to "Item 1A. Risk factors" in this annual report on Form 10-K, including "Security breaches and other disruptions to our information technology networks and systems, including a disruption related to cybersecurity, could interfere with our operations and could compromise the confidentiality of our proprietary information or personal information", for additional discussion about cybersecurity-related risks.

companyName: Gentherm Inc

ticker: THRM


text: Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previous cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks and any future material incidents. Like most major corporations we have been the target of cyberattacks from time to time and we expect to be the target of such attacks in the future. In the past three years, however, we have not experienced a material information security breach. As such, we have not incurred any material expenses from cybersecurity breaches or any expenses from fines, penalties or settlements related to a cybersecurity breach. See "Risk Factors" in Item 1A of this Annual Report on Form 10-K for more information on risks from cybersecurity threats that are reasonably likely to materially affect our business strategy, results of operations and financial condition.

companyName: Tronox Holdings plc

ticker: TROX


text: Farmer Mac also maintains a privacy and security incident response program to prepare for, detect, respond to, and recover from cybersecurity incidents. That program includes processes to triage, assess severity for, escalate, contain, investigate, and remediate any cybersecurity incident, as well as to comply with any applicable legal obligations (including to preserve evidence) and to mitigate brand and reputational damage. Farmer Mac also conducts regular tabletop exercises to test and fortify the controls of its cybersecurity incident response program. Farmer Mac's security operations center and incident response team assesses the severity and priority of incidents on a rolling basis, with escalations of cybersecurity incidents provided to Farmer Mac's management team and board as appropriate. If a cybersecurity incident is determined to be a material cybersecurity incident, Farmer Mac's incident response plan defines the process for any required regulatory disclosures.

companyName: FEDERAL AGRICULTURAL MORTGAGE CORP

ticker: AGM


text: As of the date of this Annual Report Form 10-K, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, as discussed under "Item 1A. Risk Factors," specifically the risks titled "Cyberattacks or the failure to safeguard personal information and our IT systems could result in liability and harm our reputation, which could adversely affect our business" and "Our business could be materially adversely affected by system failures, interruption, integration issues, or security lapses of our IT systems or those of our third-party providers," the sophistication of cyber threats continues to increase, and the preventative actions we take to reduce the risk of cyber incidents and protect our systems and information may be insufficient. Accordingly, no matter how well our controls are designed or implemented, we will not be able to anticipate all security breaches, and we may not be able to implement effective preventive measures against such security breaches in a timely manner.

companyName: PC CONNECTION INC

ticker: CNXN


text: Additional Information For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K, including the risk factors entitled "Risk Factors—Risks Related to Privacy and Cybersecurity."

companyName: Life360, Inc.

ticker: LIF


text: A comprehensive approach to assessing, identifying, and managing cybersecurity risks is part of the Company's overall risk management strategy. A combination of internal and external monitoring services help identify, manage, and assess how management responds within our enterprise risk management processes. Any known known cybersecurity incidents would be reported to our board, chief executive officer, and disclosure committee for evaluation.

companyName: CENTERSPACE

ticker: CSR


text: Use of Third Parties Cybersecurity Service Providers and Third-Party Consultants. Periodically we engage independent cybersecurity consultants, auditors and other third parties to assess and enhance our cybersecurity risk assessment and practices. These third parties conduct independent assessments, penetration testing and vulnerability assessments to identify weaknesses and recommend improvements. When cybersecurity risks are identified, we prioritize mitigation strategies based upon risks' potential impact, likelihood, velocity, and vulnerability, considering both quantitative and qualitative factors. Additionally, we employ several third-party tools and technologies as part of our efforts to enhance cybersecurity functions and monitoring.

companyName: COMPASS MINERALS INTERNATIONAL INC

ticker: CMP


text: Our Board of Directors has ultimate oversight over cybersecurity risk assessment and management, which it administers through the Audit Committee. The Audit Committee oversees our cybersecurity policies and practices, internal controls regarding information security, and compliance with legal and regulatory requirements regarding cybersecurity risks. The Audit Committee receives periodic updates on cybersecurity matters from the leaders of our management team.

companyName: 1stdibs.com, Inc.

ticker: DIBS


text: Cyber criminals are becoming more sophisticated and effective every day, and they are increasingly targeting enterprise software companies. All companies utilizing technology are subject to threats of breaches of their cybersecurity programs. To mitigate the threat to our business, we have established a comprehensive approach to cybersecurity risk management and hold securing the data customers and other stakeholders entrust to us as one of our top priorities. As described in more detail below, we have established policies, standards, processes and practices for testing, training, and monitoring material risks from cybersecurity threats. We have devoted financial and personnel resources to implement security measures to meet regulatory requirements and customer expectations, and we intend to continue to make investments to maintain the security of our data and cybersecurity infrastructure. There can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective. Although our Risk Factors include further details about the material cybersecurity risks we face, we believe that risks have not materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations, or financial condition.

companyName: VerifyMe, Inc.

ticker: VRME


text: Management Oversight The existing controls and processes employed to assess, identify and manage material risks from cybersecurity threats are implemented and overseen by our information technology ("IT") consultant. Our IT consultant leverages its over 35 years of experience. Our IT consultant is responsible for the day-to-day management of the cybersecurity program, including the prevention, detection, investigation, response to, and recovery from cybersecurity incidents. Our IT consultant reports on its activities to senior management who then assess and manage risks of cybersecurity threats.

companyName: Grace Therapeutics, Inc.

ticker: GRCE


text: We recognize the risk posed by global cybersecurity threats, and our Board is regularly updated on emerging risks and maintains oversight of our cybersecurity program implemented to address them. In 2023, the Board conducted its annual comprehensive review of specific cybersecurity and process control topics at its September meeting. Cybersecurity risk evaluation is integrated into our enterprise risk management processes and is presented to management and the board as a part of that process.

companyName: LyondellBasell Industries N.V.

ticker: LYB


text: The company leverages the U.S. Department of Commerce's National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("Framework") as the foundation of its global information security program. The NIST Framework provides standards, guidelines, and practices for organizations to better manage and reduce cybersecurity risk and is designed to foster risk and cybersecurity management communications amongst both internal and external organizational stakeholders. The company's information security team works with independent, third-party consultants annually to assess the maturity of the company's cybersecurity program within the NIST Framework and to develop strategic areas of focus for the company's programs commensurate with the company's business objectives.

companyName: Corteva, Inc.

ticker: CTVA


text: Cybersecurity incidents may create risk to the company that may impact its reputation, financial performance, ability to operate safely or at all, and the value of its intellectual property. Like most major corporations, the company is the target of industrial espionage, including cyberattacks, from time to time. The company has determined that these incidents have resulted, and could result in the future, in unauthorized parties gaining access to certain confidential business information. However, to date, Corteva has not experienced any known cybersecurity incidents that have materially affected the company, including the company's results of operations and financial condition, changes in the competitive environment, business operations and strategy. Although management does not believe that Corteva has experienced any material losses to date related to cybersecurity incidents, there can be no assurance that Corteva will not suffer such losses in the future. For more information on potential risk related to cybersecurity incidents, including intellectual property theft and operational disruption, please see "Item 1A – Risk Factors" of this report.


text: Cybersecurity is an important part of our risk management processes and an area of increasing focus for the Company's Board of Directors and management.

companyName: Wilhelmina International, Inc.

ticker: WHLM


text: To manage risks associated with third-party service providers, we typically perform a cybersecurity assessment on new vendors before they are onboarded as a supplier. We conduct periodic reviews of these vendors to evaluate continued compliance with our policies and standards. We strive to ensure that our contracts with such vendors require them to maintain security controls in line with industry practices, applicable laws and our policies. We rely on vendors to notify us in a timely manner of significant cybersecurity incidents, by virtue of the documents governing their relationship with us or applicable law.

companyName: AECOM

ticker: ACM


text: As part of our cybersecurity risk management program, we undertake various activities, including, but not limited to, detective, preventative, and automated controls; user access controls; a centralized security information and management system; periodic assessments, including penetration testing; periodic trainings and simulations; and policies for the handling of personally identifiable information. We closely monitor the privacy and cybersecurity laws and regulations and conduct related reviews of our policies. We have implemented incident response plans providing for response, containment, reporting and disclosure and recovery, including providing training and remediation steps for internal threats. We also carry customary cybersecurity risk insurance.

companyName: Compass, Inc.

ticker: COMP


text: We continue to improve our cybersecurity program and processes by investing in preventative measures. We engage consultants and third-party service providers in connection with our cybersecurity risk testing and assessment. These third-party service providers assist us in evaluating our cybersecurity program, provide support for threat monitoring and detection, and scan for vulnerabilities and other cybersecurity events which may pose a significant risk to the Company. We also engage in cybersecurity training, with the employees of certain of our operating companies undergoing compulsory training that enables them to detect and report malware, ransomware and other malicious software or social engineering attempts that may compromise the Company's information technology systems, and those employees are routinely assessed on this training. Employees are also generally required to complete compulsory training covering the handling of sensitive data. As the cyber landscape evolves, both in our technology systems and in the broader context of the internet and expanding connectivity, management continually updates its cybersecurity approach as part of its effort to safeguard the Company's sensitive information and assets.

companyName: Distribution Solutions Group, Inc.

ticker: DSGR


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, the information security team works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.

companyName: Rani Therapeutics Holdings, Inc.

ticker: RANI


text: The Audit Committee of the Board of Directors (the "Board") oversees our cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. Each quarter,, our CTO updates the Audit Committee on the development and effectiveness of our cyber risk management program. In addition, the Audit Committee is responsible for periodically reviewing and discussing with management our practices with respect to cybersecurity and information security risk management. In addition, cybersecurity risks are reviewed by the Board as part of the Company's corporate risk mapping exercise.

companyName: STEM, INC.

ticker: STEM


text: We believe all of these functions serve the process of prevention, detection, mitigation, and remediation of cybersecurity incidents. While we have not experienced any material cybersecurity events, we believe that disruptions to and breaches of our IT systems are possible and may negatively impact our business in the future. Despite robust controls and safeguards in place, no system can guarantee complete security from internal and external threats. See Item 1A, "Risk Factors - We may not be able to prevent the unauthorized disclosure or misuse of confidential, personal or proprietary information."

companyName: NMI Holdings, Inc.

ticker: NMIH


text: Verizon validates enterprise cybersecurity maturity every two years through a third-party maturity assessment. This assessment measures Verizon's ability to identify, prevent, detect, respond to, and recover from threats to systems, assets and data. The results of the assessment serve as the baseline for enterprise cybersecurity across the company. In addition to this baseline, certain subsets of our technology environment are subject to incremental cybersecurity certification and periodic third party validation under applicable regulatory or contractual requirements.

companyName: VERIZON COMMUNICATIONS INC

ticker: VZ


text: The CIO serves as Chair of the Company's management level Cyber Risk Committee, which provides oversight over the Company's strategy and controls to identify, manage and mitigate risks related to cybersecurity and incident response and resiliency associated with the Company's IT and OT environments, and is comprised of representatives from compliance, IT and OT cybersecurity, internal audit, legal and risk. The Chair of the Cyber Risk Committee reports to the Company's management level Risk Management Oversight Committee and the Board of Directors on a regular basis.

companyName: HF Sinclair Corp

ticker: DINO


text: The Company has not identified any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its operations, business strategy, results of operations, or financial condition. The Company faces certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect the Company, including its operations, business strategy, results of operations, or financial condition. See "Risk Factors - Security breaches, cyber-security incidents and other disruptions could compromise the Company's information and impact the Company's business, financial condition or results of operations." Governance.

companyName: CUTERA INC


text: A third-party security firm provides training to our Manager's employees, helping our Manager's information technology team to maintain a state-of-the-art cybersecurity system and stay up to date on the latest threats and counter measures available. The third-party security firm places a high priority on employee threat education through automated internal phishing tests. Our Manager's information technology team attends continuing education seminars and receives timely alerts to any new viruses or cyber threats as they occur as a means to equip personnel with effective tools to address cybersecurity threats, and to communicate evolving information security policies, standards, processes and practices.

companyName: Orchid Island Capital, Inc.

ticker: ORC


text: We rely on information technology systems across our operations, including for management, supply chain and financial information and various other processes and transactions. Our ability to effectively manage our business depends on the security, reliability and capacity of these systems. We have established a range of security measures that are designed to protect against the unauthorized access to and misappropriation of our information, corruption of data, intentional or unintentional disclosure of confidential information, or disruption of operations. We have implemented additional controls, security processes and monitoring of our manufacturing systems. We have also implemented additional cloud security tools and governance processes for assessing, identifying and managing material risks from cybersecurity threats. In addition, we maintain an information security training program that encompasses the following areas: phishing and email security, password security, data handling security, cloud security, operational technology security processes, and cyber-incident response and reporting processes.

companyName: SHYFT GROUP, INC.


text: The Board of Directors provides strategic guidance regarding Cars Commerce's overall risk oversight, including identification, management and mitigation of risk. The Board has delegated direct cybersecurity and information security risk oversight to the Audit Committee. Cars Commerce management provides the Audit Committee with regular updates at least quarterly regarding the effectiveness of Cars Commerce's overall cybersecurity program and other cybersecurity related matters, which may include, Cars Commerce's inherent cybersecurity risks, updates on recent cybersecurity threats and incidents, policies and practices, industry trends, regulatory developments, threat environment and vulnerability assessments and specific and ongoing efforts to prevent, detect and respond to internal and external cybersecurity threats. The Chair of the Audit Committee informs the Board of the outcome of these meetings through updates presented to the Board at regularly scheduled Board meetings.

companyName: Cars.com Inc.

ticker: CARS


text: The S&RC's responsibilities include: • reviewing crisis preparedness and incident response plans; • monitoring Unisys' enterprise risk profile and its ongoing and potential exposure to risks of various types; • reviewing summaries of any incidents or activities; • reviewing reports or presentations from management or advisors, including third-party experts, regarding the management of enterprise risk programs; • periodically meeting with the CISO and Chief Privacy Officer (CPO); and • periodically briefing the full Board of Directors on cybersecurity matters.

companyName: UNISYS CORP

ticker: UIS


text: Our CISO has over 25 years of experience in the field of cybersecurity. His background includes extensive experience as a technology consultant. His in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies.

companyName: Hilton Grand Vacations Inc.

ticker: HGV


text: The Company uses the National Institute of Standards and Technology's Cybersecurity Framework (NIST CSF) as a guide for cyber risk management. The Center for Internet Security (CIS) Benchmarks and the Payment Card Industry (PCI) Security Standards are also followed to ensure compliance with the Payment Card Industry Data Security Standard (PCI-DSS) and to assist with managing risk.

companyName: INGLES MARKETS INC

ticker: IMKTA


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Executive Director of Information Technology, and a dedicated information security analyst with more than 15 years of experience. Our Executive Director of Information Technology is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. This member of the management team is also responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: MANNKIND CORP

ticker: MNKD


text: The Registrants' contingency plans, including its security incident response plan and event management framework, set forth the processes through which cybersecurity incidents are managed, including how management is informed of cybersecurity incidents. As part of these plans, incidents are evaluated, classified and elevated, as necessary, to an executive team which includes the Vice President of Technology, Data and Security and other executives on the Registrants' Corporate Risk Oversight Committee. Once elevated, these executives are ultimately responsible for the management, mitigation and remediation of incidents.

companyName: OGE ENERGY CORP.

ticker: OGE


text: Board of Directors is fully aware of the vital importance of managing cybersecurity risks. To ensure effective governance in handling these risks, the Board shall implement a strong oversight mechanisms. This reflects our understanding of the significant impact these threats can have on operational integrity and stakeholder confidence.

companyName: ASIAFIN HOLDINGS CORP.

ticker: ASFH


text: We have adopted as the governance framework for our cybersecurity program the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF). We use this framework as a guide to help us identify, assess, respond to, and manage cybersecurity risks relevant to our business. Our cybersecurity risk management program includes: • periodic risk assessments designed to help identify material cybersecurity risks to our critical systems, information, and our broader enterprise information technology environment; • skilled internal information security and data privacy personnel, who support our cybersecurity risk assessment processes, our security controls, and our response to cybersecurity incidents; • external service providers, where appropriate, to monitor, assess, test, or otherwise assist with aspects of our security controls, and to support risk mitigation efforts; • training for our employees on cybersecurity awareness and the importance of protecting information assets, including "phishing" tests; • periodic reviews of key cybersecurity policies, and updating as needed; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.

companyName: STAAR SURGICAL CO

ticker: STAA


text: The governance of our risk management program is a partnership between our cross functional management team and our Board. This program includes both a cyber team led by our Chief Information Officer ("CIO"), as well as an Enterprise Risk Management ("ERM") program led by our head of compliance. Our CIO has over 30 years of information technology experience, including over 4 years of direct oversight of information security. Risk oversight for both our cyber and ERM programs is primarily the responsibility of the Audit Committee of the Board who receive quarterly updates, at a minimum, with additional updates shared to the full Board on a recurring basis.

companyName: J.Jill, Inc.

ticker: JILL


text: We design and assess our program based on the industry-standard frameworks such as the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Omega Therapeutics, Inc.


text: Cyber Incident Response Plan : We maintain a comprehensive cyber incident response plan that sets forth the applicable processes, roles, engagements, escalations and notifications to promptly respond to a cybersecurity incident. This plan covers steps to be taken upon the detection of a cybersecurity incident detection, review by relevant committees, identification of damages, recovery process, post-incident analysis and the introduction of improvement measures. Such incident responses are managed in a timely manner by a dedicated team and overseen by relevant organizations, including IT, finance, legal and compliance.

companyName: MAGNACHIP SEMICONDUCTOR Corp

ticker: MX


text: No security measure is infallible. Refer to Risk Factors - Terrorist attacks, cyberattacks and threats could have a material adverse effect on our business, financial condition and results of operations. for additional information about the risks to our business associated with a breach or compromise to our information technology systems.

companyName: Prairie Operating Co.

ticker: PROP


text: We use third-party service providers to perform a variety of functions throughout our business, including but not limited to application providers and hosting companies. We have a vendor management program to oversee, identify and manage cybersecurity risks associated with our use of these providers. The program includes a risk assessment for vendors that may include, depending on the vendor and nature of services being performed, security questionnaires, review of the vendor's written security program, review of security assessments, audits and reports, vulnerability scans related to the vendor, security assessment calls with the vendor's security personnel, and the imposition of certain contractual obligations on the vendor, among other elements, in accordance with the processes outlined in our internal vendor selection, management, and oversight process policy and other internal guidelines. More specifically, the level of assessment may depend on the following: the nature of the services provided and the data the vendors may collect, retain, and utilize, the sensitivity of the Information Systems and Data at issue, and the identity of the provider.

companyName: MERRIMACK PHARMACEUTICALS INC


text: With the approval of Audit Committee, we also engage third party assessors, consultants, and auditors in connection with the Company's Information Security Program and in accordance with our Audit Program, including to conduct external and internal penetration testing, independent audits, and risk assessments. The ISO performs information security assessments for third party service providers that store or process our confidential data. These information security assessments, include a review of any service organization controls ("SOC") reports, and proof of the vendor's independent testing of their data protection controls, as well as a review of any exceptions noted and assessment of management responses, results of vulnerability and penetration testing, incident response processes, and third party data protection controls (which can include, but are not limited to: access reviews and controls, backups, monitoring, encryption standards, and disaster recovery). The review of these areas is taken into account in order to provide an overall information security conclusion and risk rating for the vendor. In addition, we use a combination of technology, policies, procedures, training, and monitoring to promote security awareness and prevent security incidents.

companyName: Community West Bancshares

ticker: CWBC


text: We have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our management is generally responsible for assessing and managing any cybersecurity threats. If and when any reportable cybersecurity incident arises, our management shall promptly report such matters to our board of directors for further actions, including regarding the appropriate disclosure, mitigation, or other response or actions that the board deems appropriate to take. of the date of this report, we have not encountered any cybersecurity incidents since our IPO.

companyName: Charlton Aria Acquisition Corp

ticker: CHAR


text: The Company depends on and engages various third parties, including suppliers, vendors, and service providers, to operate its business. The Company relies on the expertise of risk management, legal, information technology, and compliance personnel of the Investment Adviser when identifying and overseeing risks from cybersecurity threats associated with our use of such entities.

companyName: Brightwood Capital Corp I


text: Our Audit Committee has been designated by our Board to oversee cybersecurity risks. The Audit Committee receives biannual updates on cybersecurity and information technology matters and related risk exposures from members of the senior leadership team. The Board also receives updates from management and the Audit Committee on cybersecurity risks on at least an annual basis.

companyName: Viridian Therapeutics, Inc.\DE

ticker: VRDN


text: We recognize the critical importance of maintaining the safety and security of our systems and data and have a process for overseeing and managing cybersecurity and related risks, which is supported by both management and our Board.

companyName: KORE Group Holdings, Inc.

ticker: KORE


text: Many of our key IT systems are provided by third parties with extensive experience and knowledge in addressing cybersecurity risks involving those systems and have their own robust system of controls regarding their software products, which we monitor on a recurring basis through review of independent reports on their systems of internal controls provided to us. Such IT systems include our primary accounting, financial reporting, payroll and employee benefits, document storage, email and video communication and employee expense reporting systems. Our internal intranet and IT asset control systems are also managed on our behalf by a third-party service provider, with whom we participate in regular weekly meetings to discuss cybersecurity-related items such as (i) operating and application system patching, (ii) phishing attempts, (iii) malware, (iv) non-compliant devices, (v) third-party secure scorecard results, and (vi) alerts provided through our Security Operations Center.

companyName: FTC Solar, Inc.

ticker: FTCI


text: Risk Management & Strategy The Company has adopted information security policies that establish requirements and responsibilities with respect to the protection of the Company's interests and information technology assets against loss, improper disclosure and unauthorized modification. The Company regularly educates and shares best practices with its employees to raise awareness of cybersecurity threats and the Company's information security program, which the Company believes creates a culture of shared responsibility for the security of sensitive data and the Company's network. All employees are regularly offered information security and protection training, including specialized training for employees exposed to sensitive information, which prompt them to certify their awareness of and compliance with applicable information technology policies and additional technology and cybersecurity standards. The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, encryption intrusion prevention and detection systems, anti-malware functionality, data monitoring, endpoint extended detection and response, architecture controls, access controls and ongoing vulnerability assessments.

companyName: STANLEY BLACK & DECKER, INC.

ticker: SWK


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected or are reasonably likely to affect the Company, including its business strategy, results of operations, or financial condition.

companyName: Krystal Biotech, Inc.

ticker: KRYS


text: One of our strategies to mitigate cybersecurity risks is to utilize expert third-party software-as-a-service, human resource, and clinical providers to store and manage personally identifiable information, rather than maintaining and processing such data within our enterprise. We select reliable, reputable service providers that maintain cybersecurity programs of their own and other measures to comply with privacy and security requirements, including when applicable Canada's Personal Information Protection and Electronic Document Act ("PIPEDA") and the U.S. Health Insurance Portability and Accountability Act ("HIPAA"). Depending on the nature of the services provided, the sensitivity and quantity of information processed and the identity of the service provider, we may also contractually impose certain security obligations on the provider.

companyName: Edesa Biotech, Inc.

ticker: EDSA


text: Identified Cybersecurity Risks Federal regulators have issued multiple statements and guidance regarding cybersecurity and that financial institutions need to design multiple layers of security controls to establish lines of defense and to ensure that their risk management processes also address the risk posed by compromised client credentials, including security measures to reliably authenticate clients accessing internet-based services of the financial institution. In addition, a financial institution's management is expected to maintain sufficient business continuity planning processes to ensure the timely recovery, resumption and maintenance of the institution's operations in the event of a cyber-attack. A financial institution is also expected to develop appropriate processes to enable recovery of data and business operations and address rebuilding network capabilities and restoring data if the institution or its critical service providers fall victim to a cyber-attack. If a financial institution fails to observe the regulatory guidance, they could be subject to various regulatory sanctions, including financial penalties.

companyName: SOUTHERN MISSOURI BANCORP, INC.

ticker: SMBC


text: Our Corporate Information Security Officer, who holds relevant degrees and certifications and has more than 15 years of information technology and information security experience specific to the financial services industry, is charged with managing our enterprise information security function and administering our information security program. This area's roles and responsibilities include cybersecurity risk assessment, vulnerability assessment, defensive operations, threat intelligence and identity access governance, as well as coordination with our Business Continuity Director for additional risk assessment, incident response and business resilience. These responsibilities are addressed by a first line of defense function, with our second line of defense function, including the Corporate Information Security Officer, providing oversight, guidance, monitoring and management of the first line's activities. Through ongoing engagement among these personnel, our Corporate Information Security Officer and other key members of management routinely monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents, and report such threats and incidents to the ERC when appropriate.

companyName: Ameris Bancorp

ticker: ABCB


text: We are a shell company with no business operations. As a result, we do not consider that we face significant cybersecurity risk. Nevertheless, we employ various procedures designed to identify, protect, detect and respond to and manage reasonably foreseeable cybersecurity risks and threats given our limited operations. These include, but are not limited to, internal reporting and monitoring and detection tools. We also periodically assess risks from cybersecurity and technology threats and monitor our information systems for potential vulnerabilities, including those that could arise from internal sources and external sources such as third-party service providers we do business with. We may in the future determine to engage an assessor(s), consultant(s), auditor(s) or other third party(s) to supplement our processes.

companyName: Yale Transaction Finders, Inc.

ticker: YTFD


text: To minimize our risk and exposure to material cybersecurity incidents, we also conduct company-wide annual and ongoing cybersecurity awareness training and education of our employees. This includes but not limited to topics such password hygiene, phishing, and other cybersecurity-related information. In addition to performing an annual risk assessment and developing a detection and mitigation plan, along with a comprehensive review and update of our cybersecurity and data privacy policies and procedures, we continuously evaluate new and emerging risks and ever-changing legal and compliance requirements. Our comprehensive information security program includes agreements with third-party cybersecurity partners for continuous monitoring, alerting, and response. To supplement our cybersecurity and data privacy risk assessment, identification, management, and mitigation efforts, we regularly consult with third-party experts, which include the following services: • conduct annual cybersecurity and data privacy risk assessments; • conduct external and internal penetration tests; • monitor critical infrastructure for abnormal behavior; and • provide validation of the Company's cybersecurity and operations processes against the National Institute of Standards and Technology cybersecurity framework.

companyName: DIODES INC /DEL/

ticker: DIOD


text: We maintain various technical, physical, and organizational measures, in the form of policies, standards, processes, and technical capabilities, designed to manage and mitigate material risks from cybersecurity threats to our Systems and Data, including, among other things, internal reporting, annual and ongoing cybersecurity awareness training for employees, mechanisms to detect and monitor unusual network activity, as well as threat detection, containment, incident response and backup recovery tools.

companyName: INTELLINETICS, INC.

ticker: INLX


text: We have an established process and playbook led by our CISO governing our assessment, containment, mitigation, response and internal and external disclosures upon the occurrence of a cybersecurity incident. Depending on the nature and severity of an incident, this process provides for escalating notification to our CEO and the board of directors (including our lead independent director and the audit and committee chair).

companyName: RingCentral, Inc.

ticker: RNG


text: Following these risk assessments, if needed, we evaluate whether and/or how to re-design, implement, and maintain reasonable safeguards to mitigate identified risks and reasonably address any identified gaps in existing safeguards. We do not yet have an IT manager given our limited exposure to risks, and therefore the review of our limited systems is undertaken by our Chief Executive Officer (CEO) to manage the risk assessment and mitigation process. When applicable to our corporate structure and when we believe exposure to risks within our systems exceeds the current limited levels of exposure, we will monitor and test our safeguards and train our employees on the implementation of such safeguards, in collaboration with human resources, IT, and management, as available. We aim to promote a company-wide culture of cybersecurity risk management as we grow in size.

companyName: Qrons Inc.

ticker: QRON


text: Arrow has implemented and regularly reviews and updates its internal controls and procedures as well as corporate governance policies and procedures intended to protect its business operations, including the security and privacy of the confidential information of its customers. Arrow also regularly assesses and tests its security systems and disaster preparedness, including the adequacy and functionality of its back-up systems. In addition, Arrow engages a variety of vendors to meet data processing and communication needs. Arrow communicates and works directly with all of our critical information technology ("IT") vendors to resolve issues and install releases. We perform business continuity plan testing on a periodic basis.

companyName: ARROW FINANCIAL CORP

ticker: AROW


text: The ISOC, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our ISOC's expertise includes a combined 20 plus years of experience in managing security technologies; designing and implementing security strategies; and risk management and incident response across various industries. Our ISOC takes steps to stay informed about and monitor efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment Mike Murray has served as our Chief Information Officer since April 2024. Mr. Murray brings with him a wealth of experience in technology leadership, including in the area of cybersecurity. Before joining the Company, Mr. Murray championed technology initiatives at The Container Store, overseeing critical areas such as IT governance, infrastructure, PMO, operations and support. Prior to The Container Store, he worked at Pier 1 Imports, Inc., which saw him in diverse senior leadership positions, notably as VP of Technology with a strategic focus on IT, Ecommerce, and Business Development.

companyName: Solo Brands, Inc.

ticker: SBDS


text: Following our monitoring, we adjust, implement and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with our Chief Information Officer, who reports to our Chief Financial Officer and Chief Operating Officer, to manage any identified risks and mitigation process. As part of our overall cyber security framework, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with our information technology (IT) department and management. Personnel at all levels and departments are made aware of our cybersecurity policies through ongoing training.

companyName: Atara Biotherapeutics, Inc.

ticker: ATRA


text: Management is responsible for identifying and assessing cybersecurity risks, establishing processes to ensure that such cybersecurity risk exposures are monitored, implementing proactive mitigation measures and responding in the event of an incident. We seek to identify and mitigate cybersecurity risks through a comprehensive, cross-functional approach. The Cyber Incident Response Team is headed by the Manager's Senior Vice President of Information Technology (the "SVP of IT") and also includes senior representatives from various corporate and operational functions of the Manager. The Manager's SVP of IT possesses deep experience in technology and cybersecurity, gained over a career of over 20 years managing IT functions for organizations, including network infrastructure, cloud administration, application development and cybersecurity. The SVP of IT possesses a degree in Information Systems and regularly attends educational and professional development seminars on cybersecurity trends and threats. She leads our information technology team, which is responsible for managing our internal IT and cybersecurity processes. The Manager's SVP of IT meets quarterly with the Manager's Risk Committee, which is comprised of senior representatives from various corporate functions and other members of our senior management to provide updates on the Company's cyber risks and threats, cybersecurity incidents (if any), the status of projects to strengthen our information security systems, assessments of the information security program and the emerging threat landscape. We have processes in place to guide our assessment, response and notification procedures upon the occurrence of a cybersecurity incident. Further, we have partnered with a third-party cybersecurity vendor to provide managed security services in order to supplement our internal IT and cybersecurity processes. Depending on the nature and severity of the cybersecurity incident, this process provides for notifying and escalating the incident to our board of directors.

companyName: LandBridge Co LLC

ticker: LB


text: Risks from Cybersecurity Threats To date, we have not experienced any cybersecurity incidents that have materially affected our business strategy, results of operations or financial condition. However, we are subject to risks from cybersecurity threats that could have that effect, as further described in Part I, Item 1A "Risk Factors" of this Annual Report.

companyName: ZimVie Inc.


text: Our cybersecurity risk management program is an integrated component of the Enterprise Risk Management strategy designed to protect the confidentiality, integrity and availability of our critical systems and information.

companyName: Northfield Bancorp, Inc.

ticker: NFBK


text: Our awareness and training program is designed to create a risk-aware culture to ensure employees understand cybersecurity threats and are accountable for completing required training. We have trained our employees to recognize and resist phishing attempts with our simulated phishing program. At least quarterly, our employees are presented with simulated phishing scenarios that deliver hands-on experience and on-the-spot education opportunities. All engineers and employees holding equivalent roles who are involved in software development also receive mandated secure software development training.

companyName: PRINCIPAL FINANCIAL GROUP INC

ticker: PFG


text: Cybersecurity risk management is an integral part of our overall enterprise risk management program. Our cybersecurity risk management program is designed to provide a framework for handling cybersecurity threats and incidents, including threats and incidents associated with the use of services provided by third-party service providers, and to facilitate coordination across different departments of our company. Our processes include steps for assessing the severity of a cybersecurity threat, identifying the source of a cybersecurity threat including whether the cybersecurity threat is associated with a third-party service provider, implementing cybersecurity countermeasures and mitigation strategies and informing management and our board of directors of material cybersecurity threats and incidents. Our cybersecurity team also engages third-party security experts for risk assessment and system enhancements. In addition, our cybersecurity team provides training to all appropriate employees.

companyName: OLYMPIC STEEL INC

ticker: ZEUS


text: We have in place certain infrastructure, systems, policies, and procedures that are designed to proactively and reactively address risks from cybersecurity threats. This includes processes for assessing, identifying, and managing material risks from cybersecurity threats. Our information security management program seeks to follow processes set forth in recognized industry standards, and we evaluate and evolve our security measures as appropriate. We maintain a cybersecurity incident response plan that we practice and update as needed. The identification, assessment and management of cybersecurity risk is integrated into our overall enterprise risk management program that is ultimately overseen by the Board.

companyName: Super Micro Computer, Inc.

ticker: SMCI


text: When implementing third-party packaged software and cloud services, Honda makes decisions based on risk assessments following established security standards and conducts annual checks after implementation. In response to cyberattacks on production facilities and suppliers, Honda verifies the status of security measures at both domestic and overseas production facilities and suppliers. Based on the results of these verifications, Honda takes measures to strengthen security, such as supporting the introduction of solutions for managing cybersecurity incident information, and monitoring malicious activities. For such activities to strengthen security, Honda has concluded outsourcing agreements with security consulting companies and external specialists to receive support.

companyName: AMERICAN HONDA FINANCE CORP


text: Our response to cybersecurity threats is triggered through various means. Through annual user awareness training, we teach our employees to identify and appropriately respond to such threats. Our incident response program is designed to mitigate and recover from suspected and actual cybersecurity incidents and provide all required consumer and regulatory notices regarding cybersecurity threats in a timely manner.

companyName: PROGRESSIVE CORP/OH/

ticker: PGR


text: Key elements of our cybersecurity risk management practices include but are not limited to: • risk monitoring and assessments designed to help identify material cybersecurity risks from cybersecurity threats to our critical systems, information, products, services, and our broader enterprise IT environment; • internal and external IT professionals responsible for managing our (1) cybersecurity risk analysis, (2) security controls, and (3) response to cybersecurity incidents; • the use of external service providers, where appropriate, to assist with aspects of our security controls; • cybersecurity awareness training of our employees and senior management; and • a breach response and cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.

companyName: AN2 Therapeutics, Inc.

ticker: ANTX


text: Disclosure of the Board's Responsibility While management is primarily responsible for assessing and managing cybersecurity risks on a day-to-day basis, the Company's Board of Directors oversees management's efforts to assess and manage risk. The Board (in conjunction particularly with the Audit Committee) monitors the cybersecurity risk assessment and response process. The Audit Committee is briefed by our Chief Financial Officer on our cybersecurity ISMS program and the overall cybersecurity risk environment. The briefing may include discussions on topics such as: information security and technology risks, cybersecurity risk assessment process and updates, information risk management strategies, and progress on cybersecurity and data protection training initiatives for employees, among others.

companyName: AVITA Medical, Inc.

ticker: RCEL


text: Yubo Beijing's assessment and management of material risks from cybersecurity threats are integrated into its overall risk management processes. For example, the cybersecurity function works with management to prioritize the risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to its business.

companyName: Yubo International Biotech Ltd

ticker: YBGJ


text: There have been no cybersecurity incidents which have materially affected the Management Company to date, including its business strategy, results of operations or financial condition. However, any future potential risks from cybersecurity threats, including but not limited to exploitation of vulnerabilities, ransomware, denial of service, supply chain attacks, or other similar threats may materially affect the Management Company, including its execution of business strategy, reputation, results of operations and/or financial condition.

companyName: AEI INCOME & GROWTH FUND XXI LTD PARTNERSHIP

ticker: XXAAU


text: We seek to use a defense-in-depth approach for cybersecurity management, layers of technology, policies and training at all levels of the enterprise designed to keep our assets secure and operational. We use various processes as part of our efforts to maintain the confidentiality, integrity and availability of our systems, including security threat intelligence, incident response, identity and access management, endpoint extended detection and response protection, network segmentation, data encryption, and event monitoring. In an effort to validate the effectiveness of our cybersecurity program and assess such program's compliance with legal and regulatory requirements, we engage third-party service providers to perform audits, assessments and penetration tests.

companyName: HILLS BANCORPORATION

ticker: HBIA


text: Our Chief Information Security Officer, Chief Privacy Officer, and Vice President, Risk Management and Compliance work in collaboration as our Digital Risk Management ("DRM") group and have primary responsibility for our digital risk and security program. These individuals have extensive experience in their roles at the Company and in prior roles at other companies in the areas of information technology and security, data protection and privacy, and risk management and compliance, respectively. The members of the DRM group, among other things, continuously review and evaluate our cybersecurity risks to: identify technical and business risks; assess the potential impacts of identified risks; develop mitigation strategies to control or reduce risk where needed; communicate to others to ensure that risk owners and stakeholders as well as executive leadership have visibility into identified risks; and monitor identified risks and applicable risk response efforts.

companyName: Premier, Inc.


text: Our Program is designed to adapt to an evolving landscape of emerging cybersecurity threats and advancing technology to determine the Company's cybersecurity preparedness. Through routine data gathering, emerging risks, internal incidents, technology investments and internal controls, our Program and overall cybersecurity risk strategy is adjusted as needed.

companyName: UWHARRIE CAPITAL CORP

ticker: UWHR


text: The Board of Directors, in coordination with the Audit Committee, oversees the Company's enterprise risk management processes, including the management of risks arising from cybersecurity threats. The Audit Committee generally receives quarterly reports from our Global IT Senior Director regarding cybersecurity risks, which may address a range of topics including recent developments, risk assessments, third-party and independent reviews and technology trends. We have protocols in place by which certain cybersecurity incidents that meet established reporting thresholds are escalated internally, and as appropriate, reported to the Audit Committee or Board in a timely manner.

companyName: Whole Earth Brands, Inc.


text: Primary responsibility for assessing, monitoring, and managing our cybersecurity risks rests with the CISO, Jason O'Neill. With over 25 years of experience in the field of IT Technology and enterprise security, Mr. O'Neill brings a wealth of expertise to his role.

companyName: New Horizon Aircraft Ltd.

ticker: HOVR


text: We are a special purpose acquisition company with no business operations. Since our initial public offering, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates for business combination. Therefore, we do not consider that we face significant cybersecurity risks.

companyName: Future Vision II Acquisition Corp.

ticker: FVN


text: In addition to the enterprise risk management process, we utilize an additional cybersecurity risk management program that assesses the risks and protections of several key assets within the organization. As a result of these assessments and as the threat landscape becomes increasingly sophisticated, we continue to evolve our defensive strategy by deploying new technology, continuing education of our user community, and advancing our protections against ongoing cybersecurity risks and threats. Protecting our infrastructure assets, along with our information systems and data, against outside threats is of vital importance and we plan to continue to invest in new technology, including investments within our five-year plan for capital expenditures for the years 2025 to 2029, to address these risks. We leverage threat intelligence and external industry practices for continuous improvement and refinement of our cybersecurity program.

companyName: ITC Holdings Corp.


text: Our management team is responsible for the day-to-day management of risks we face, including our Chief Information Security Officer. Our Chief Information Security Officer has 20 years of information technology and information security experience, and before joining our Company has held the positions of Chief Technology Officer and Director of IT and Information Security Officer at his prior places of employment.

companyName: Midland States Bancorp, Inc.

ticker: MSBI


text: The Head of Information Security oversees the Information Security team, which assesses and manages cybersecurity risks at First Solar as part of our information security program. The Head of Information Security and our Information Security team members collectively hold certifications in cyber-risk oversight from the National Association of Corporate Directors, Certified Systems Security Officer and Certified Information Systems Manager credentials, and Certified Information Systems Security Professional and Systems Security Certified Practitioner credentials. The Head of Information Security, who has over 20 years of information technology experience, including over 10 years in leadership roles at First Solar, reports to the Chief Information Officer and regularly briefs the Chief Financial Officer and, at least quarterly, briefs the audit committee of the board of directors on cybersecurity matters. Effective March 16, 2025, our Head of Information Security will be departing the Company and, as a result, our Chief Information Officer will act as our interim Head of Information Security while we conduct a search for a permanent replacement. Our Chief Information Officer has 25 years of information technology experience, including 18 years in leadership roles at First Solar.

companyName: FIRST SOLAR, INC.

ticker: FSLR


text: Employees, including representatives of management, conduct an annual cybersecurity incident response tabletop exercise to review our processes and procedures in the event of a material information or cybersecurity incident, including the process for assessing the materiality of an incident and communication of an incident to the audit committee and, as appropriate, the board of directors. In addition, to promote a company-wide culture of cybersecurity risk management, we conduct regular phishing email simulations for employees to enhance awareness and responsiveness to possible threats and other kinds of preparedness training. We also require all employees to complete an annual cybersecurity and privacy awareness training.

companyName: PIPER SANDLER COMPANIES

ticker: PIPR


text: external service providers, where appropriate, to monitor, assess, test, or otherwise assist with aspects of our security controls, to support risk mitigation efforts, and to utilize a security information and event management system (SIEM);

companyName: VYCOR MEDICAL INC

ticker: VYCO


text: We believe data privacy and cybersecurity are critical to supporting our vision and enabling our strategy. Our approach to data privacy and cybersecurity is supported by our commitment to preserving the trust our employees and customers place in us and focuses on driving continuous improvement as the threat landscape evolves.

companyName: Symbotic Inc.

ticker: SYM


text: Our cybersecurity incident response plan is designed to escalate certain cybersecurity incidents to members of senior management, depending on the circumstances. Senior management works with the Company's cybersecurity incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's cybersecurity incident response plan includes reporting to the Board for certain cybersecurity incidents.

companyName: DELCATH SYSTEMS, INC.

ticker: DCTH


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including, for example, cybersecurity consultants, cybersecurity software and hardware providers, outside legal counsel, penetration testing firms, dark web monitoring services, and forensic investigators.

companyName: Vaxcyte, Inc.

ticker: PCVX


text: Internally, the CISO coordinates oversight of reviewing security alerts, identifying and monitoring ongoing and potential cybersecurity threats, evaluating strategic business impacts of cybersecurity threats and developing programs and initiatives to educate our employees regarding cybersecurity. The CISO also manages our Incident Response Team, which includes a team comprised of executives from various cross - functional management teams, internal technical support roles and external third - party service providers. The Incident Response Team will analyze and, as necessary, escalate cybersecurity incidents both internally and with third - party service providers based on type and severity of the specific incident.

companyName: Reservoir Media, Inc.

ticker: RSVR


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, operational disruption; intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy or security laws and other litigation and legal risk; and reputational risks. We have implemented several cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage such material risks.

companyName: ALPHA PRO TECH LTD

ticker: APT


text: Effect of Risk We face risks related to cybersecurity such as unauthorized access, cybersecurity attacks and other security incidents, including as perpetrated by hackers and unintentional damage or disruption to hardware and software systems, loss of data, and misappropriation of confidential information. To identify and assess material risks from cybersecurity threats, we maintain a comprehensive cybersecurity program to ensure our systems are effective and prepared for information security risks, including regular oversight of our programs for security monitoring for internal and external threats to ensure the confidentiality and integrity of our information assets. We consider risks from cybersecurity threats alongside other company risks as part of our overall risk assessment process. We employ a range of tools and services, including regular network and endpoint monitoring, audits, vulnerability assessments, penetration testing, threat modeling and tabletop exercises to inform our risk identification and assessment. As discussed in more detail under "Cybersecurity Governance" below, our audit committee provides oversight of our cybersecurity risk management and strategy processes, which are led by our Chief Financial Officer, General Counsel, and Director of Information Technology.

companyName: Inhibrx, Inc.


text: During the fiscal year ended, and as of, December 31, 2023, there were no risks from cybersecurity threats (including as a result of previous cybersecurity incidents) that have materially affected or are reasonably likely to materially affect the Company (including its business strategy, results of operations, or financial condition).

companyName: UNITIL CORP

ticker: UTL


text: The Board of Directors receives a report on cybersecurity annually, and the AFC receives reports on cybersecurity twice a year. For meetings where cybersecurity is not on the formal agenda, the AFC will receive a pre-read that includes cybersecurity updates or discussion topics. During these reviews, management discusses various topics, including information relating to IT/OT Security strategy, program management, cybersecurity risks and threats, and provides briefings on notable cybersecurity attacks, including those relating to third-party service providers, if known. In addition to this regular reporting, significant cybersecurity risks or threats may also be escalated on an as needed basis to the AFC and Board of Directors.

companyName: CONOCOPHILLIPS

ticker: COP


text: We recognize the importance of developing, implementing and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity and availability of our data. Our processes for assessing, identifying, and managing material risks from cybersecurity threats have been integrated into our overall risk management system and processes. Cybersecurity events are collected, evaluated and, when appropriate, escalated to the Chief Information Security Officer (CISO) for impact analysis utilizing the cybersecurity risk management policy.

companyName: Civeo Corp

ticker: CVEO


text: We face a number of cybersecurity risks in connection with our business. Although such risks have not materially affected us, including our results of operations or financial condition, in fiscal 2024 and recent years, we have, from time to time, experienced threats to and attempted breaches of our data and systems, including malware and computer virus attacks. In the future, we may not be successful in preventing or mitigating a cybersecurity incident that could ultimately have a material adverse effect on our business, operations and financial performance. We carry cyber risk insurance that we believe provides protection against a breach or other data security incident, but such insurance may not be sufficient, and any related insurance proceeds may not be timely paid to us. For more information about the cybersecurity risks we face, see the risk factors under the heading entitled "Risks Related to our Information Technology Systems, Data Protection and Cybersecurity" in "Item 1A. Risk Factors" of this Form 10-K.

companyName: Grocery Outlet Holding Corp.

ticker: GO