text: Sixth Street maintains a comprehensive cybersecurity program, including policies and procedures designed to protect its systems, operations, and the data utilized and entrusted to it, including by us, from anticipated threats or hazards. Sixth Street utilizes a variety of protective measures as a part of its cybersecurity program. These measures include, where appropriate, physical and digital access controls, patch management, identity verification and mobile device management software, employee cybersecurity awareness and best practices training programs, security baselines and tools to report anomalous activity, and monitoring of data usage, hardware and software, among others.

companyName: Sixth Street Specialty Lending, Inc.

ticker: TSLX


text: Cybersecurity and risks associated with information security are operational risks included in the Company's Enterprise Risk Management ("ERM") Framework. Under the ERM Framework, the Company's Information Technology department and all employees are the first line of defense ("First Line"). Those in the First Line are each responsible for identifying and managing the information security risk associated with their activities. The Company's IT Steering Committee is part of the independent risk oversight of information security risk along with the Company's Compliance and ERM Committees, both of which are management risk oversight committees.

companyName: Oak Valley Bancorp

ticker: OVLY

secItem: Item 1C


text: A cybersecurity incident response plan operationalized in a governance, risk, and compliance ("GRC") platform; and A third-party risk management process for vendors that includes annual assessments and Service Organization Control Type 2 (SOC 2) reviews While we have experienced cybersecurity incidents and expect to continue to be subject to such incidents, to date we have not experienced any cybersecurity incidents that have materially affected our business strategy, financial condition, or results of operations. The cybersecurity threat landscape continues to evolve and escalate. We are subject to ongoing risks from cybersecurity threats that could materially affect our business strategy, financial condition, or results of operations, as further described in Part I, Item 1A, "Risk Factors" of this Annual Report on Form 10-K.

companyName: Clearfield, Inc.

ticker: CLFD


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "If our information technology systems or data, or those of the third parties upon which we rely, are or were compromised, we could experience adverse impacts resulting from such compromise, including, but not limited to, regulatory investigations or actions, litigation, fines and penalties, interruptions to our operations such as our clinical trials, claims that we breached our data protection obligations, harm to our reputation, and a loss of future customers or sales and other adverse consequences."

companyName: Kronos Bio, Inc.


text: In addition, we provide awareness training to our employees to help identify, avoid and mitigate cybersecurity threats and to remind them of the importance of handling and protecting our information. We engage third-parties to conduct evaluations of our security controls, including testing both the design and operational effectiveness of our controls. We also participate in cybersecurity information-sharing with our peers, industry groups and government agencies.

companyName: Qorvo, Inc.

ticker: QRVO


text: Our Board of Directors includes cybersecurity risk as part of its overall risk oversight function, and has delegated to our Audit Committee responsibility for overseeing, reviewing and discussing with management: (i) our cybersecurity, information technology and data security risks and threats; (ii) the potential impact of those risks and threats on our business, operations, and reputation; and (iii) management's processes, procedures and actions to identify, assess, monitor, mitigate, and remediate such risks and threats. Management provides the Board and the Audit Committee regular reports and assessments on our cybersecurity program and material cybersecurity risks. In addition, management updates the Board and the Audit Committee, as appropriate, regarding significant cybersecurity incidents should they occur.


text: In light of the pervasive and increasing threat from cyberattacks, the Board and the Audit Committee, with input from management, assess the Company's cybersecurity threats and the measures implemented by the Company in an effort to mitigate and prevent cyberattacks. The Audit Committee consults with management regarding ongoing cybersecurity initiatives, and requests management to report to the Audit Committee or the full Board regularly on their assessment of the Company's cybersecurity program and risks. Both the Audit Committee (on no less than a quarterly basis) and the full Board (on no less than an annual basis) receive regular reports from our Information Technology Department on cybersecurity risks, timely reports regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. We anticipate these reporting activities will be overseen by our newly appointed Chief Information Officer ("CIO") moving forward.

companyName: Janus International Group, Inc.

ticker: JBI


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We, however, have experienced and expect to continue to experience cyber incidents of varying degrees. See Part I, Item A "Risk Factors – Risks Related to our Operations and Our Growth Strategy – If our security measures or those of our third-party service providers are breached or fail, resulting in unauthorized disclosure of data, we could lose clients, fail to attract new clients and be exposed to protracted and costly litigation," for more detailed information on cybersecurity risks and the potential impacts.

companyName: 2U, LLC


text: Risk Management and Strategy recognize the increasing volume and sophistication of cyber threats and take our responsibility to protect the information and systems under our purview seriously. We consider cybersecurity threat risks alongside other Company risks as part of our overall risk assessment process. Our cybersecurity processes aim to provide a comprehensive approach to assess, identify, manage, mitigate, and respond to cybersecurity maintain a cybersecurity risk program predicated on a risk-based approach. We use cost-effective controls that are commensurate with the risk and sensitivity of our specific information systems, control systems and enterprise data. Our cybersecurity program incorporates best practices and industry standards from multiple sources and is designed to comply with applicable regulations. The cybersecurity program includes, but is not limited to, the following elements: risk assessment, policies and procedures, training and awareness, auditing, log collection and analysis, threat hunting and intelligence surveillance, compliance monitoring and testing, and incident response.

companyName: Optex Systems Holdings Inc

ticker: OPXS


text: Technical Safeguards We deploy technical defenses against cybersecurity risks of attack and other incidents, including firewalls, intrusion detection and prevention systems and access controls. We refine these measures based on our ongoing assessments, including cybersecurity threat intelligence updates.

companyName: Alto Ingredients, Inc.

ticker: ALTO


text: We use collaboration mechanisms established with public and private entities, including intelligence and enforcement agencies, industry groups and third-party service providers, to identify, assess and respond to cybersecurity risks.

companyName: BOYD GAMING CORP

ticker: BYD


text: Our Board of Directors oversees an enterprise-wide approach to risk management, including cybersecurity risks. While the Board has the ultimate responsibility for risk oversight, each committee of the Board also oversees risk to the extent it relates to the committee's responsibilities and provides reports to the Board in its respective area of responsibility. The Risk Committee of our Board also focuses on an enterprise-wide approach to risk management, and has primary oversight responsibility for areas of quality and nonfinancial compliance issues, including cybersecurity risks. The Risk Committee receives periodic updates from the CISO and CIDO on our cyber risks and threats, assessments of our cybersecurity program and the evolving threat landscape. Our Board of Directors also receives annual updates on such cybersecurity matters, or more frequently as appropriate under the procedures described below. Our Board and Risk Committee also receive cybersecurity risk assessments as part of the annual ERM program presentation described above.

companyName: BOSTON SCIENTIFIC CORP

ticker: BSX


text: The functions that report to our SVP-GIS include: cybersecurity risk management, Payment Card Industry compliance, and cybersecurity testing; operation of protective cybersecurity tools and systems; cybersecurity monitoring, incident response, and digital forensics; cybersecurity research and development and support for information technology and cybersecurity functions.

companyName: MARRIOTT VACATIONS WORLDWIDE Corp

ticker: VAC


text: As part of our overall cybersecurity program, we also conduct: • Regular assessments of our cybersecurity program. We assess our cybersecurity program against the NIST Cybersecurity Framework through annual internal assessments, and, every two years, we engage a third-party consultant to conduct an additive cyber assessment. These assessments review, among other things, our IT security measures and activities for alignment with the NIST Cybersecurity Framework. • Periodic penetration testing & vulnerability assessments. On an annual basis, we engage a third-party consultant to conduct two penetration tests per year. We also conduct vulnerability assessments on a monthly basis. • Regular cybersecurity awareness trainings & simulations. We conduct cybersecurity awareness training for employees and primary on-site providers during onboarding, and thereafter, multiple times per year, and we conduct regular phishing simulations in an effort to raise awareness of spoofed or manipulated electronic communications and other security threats, as well as annual tabletop simulations.

companyName: BXP, Inc.

ticker: BXP


text: Our cybersecurity risk management program is under the direction of our Senior Vice President and Chief Digital and Information Officer, who has 30 years of technology leadership, and staffed by a cybersecurity team that includes personnel with a range of information and product security experience, from early-career professionals with cybersecurity degrees to seasoned professionals with multiple cybersecurity-related certifications and more than twenty years of experience. The Senior Vice President and Chief Digital and Information Officer receives reports from our cybersecurity team on the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our Executive Cybersecurity Council meets as appropriate and receives updates from the Senior Vice President and Chief Digital and Information Officer and the cybersecurity team regarding our cybersecurity risks and risk management program; cybersecurity incidents and our response to them; and, as appropriate, developments in the external cybersecurity landscape, including learnings from external cybersecurity incidents.

companyName: Polaris Inc.

ticker: PII


text: We maintain a comprehensive technology and cybersecurity program designed to ensure our systems are effective and prepared for information security risks. Our program includes regular oversight of our systems for security monitoring for internal and external threats to maintain the confidentiality and integrity of our information assets. We have a formal, risk-based and enterprise-wide risk assessment program, which incorporates the assessment of security risk exposures, including cybersecurity risks.

companyName: INTEGRAL AD SCIENCE HOLDING CORP.


text: As cybersecurity touches all employees, we include formal training on cybersecurity in the annually required Code of Business Conduct training. The training focuses on awareness of cybersecurity risks and requirements. For targeted groups, we conduct phishing email response checks.

companyName: TRINITY INDUSTRIES INC

ticker: TRN


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information and is designed to identify, assess, prioritize and manage cybersecurity threats.

companyName: Arteris, Inc.

ticker: AIP


text: Depending on the products and services provided and the potential for data exchange and technology risk, suppliers and other third-party service providers are evaluated by the cybersecurity organization to assess their security and data protection capabilities. Additionally, security and data-focused contract provisions are incorporated where necessary in supplier and other service provider agreements to include industry-standard security and resiliency requirements that include timely reporting of cybersecurity incidents. The Corporation periodically reviews independent assessments of major service providers.

companyName: HNI CORP

ticker: HNI


text: Our management team is responsible for assessing and managing the material risks from cybersecurity threats. Our management team members have expertise in information systems, compliance and corporate governance, which we believe are disciplines that are effective in the management of the Company's cybersecurity risk. Our management team is informed of and monitors the prevention, detection, and mitigation of cybersecurity threats and incidents.

companyName: MAGELLAN COPPER & GOLD Corp

ticker: MAGE


text: We routinely review the effectiveness of our cybersecurity program using the applicable CIS Critical Security Controls and take necessary actions.

companyName: International Seaways, Inc.

ticker: INSW


text: Management is responsible for identifying, considering, and assessing material cybersecurity risks on an ongoing basis, establishing processes to the best of their ability to ensure that such potential cybersecurity risk exposures are monitored, putting in place reasonably appropriate mitigation measures and maintaining cybersecurity programs.

companyName: THUNDER MOUNTAIN GOLD INC

ticker: THMG


text: Company does not currently have processes in place for assessing, identifying or managing material risks from cybersecurity threats, but we intend to implement a formal cybersecurity program in the future. The program will be aimed at safeguarding the confidentiality, integrity, and availability of our essential systems and information, and will be designed to detect and mitigate risks from cybersecurity threats to our data and our systems. Central to our future cybersecurity efforts will be a robust incident response plan designed to designing and evaluating our cybersecurity program, we intend to adopt the National Institute of Standards and Technology Cybersecurity Framework (" NIST CSF 2.0 ") as a guiding principle. It is important to clarify that our use of the NIST CSF 2.0 will be for guidance purposes to frame our risk identification, assessment and management processes and will not equate to compliance with any specific technical standards or requirements.

companyName: NexMetals Mining Corp.

ticker: NEXM


text: Our Chief Development Officer periodically meets with our IT consultants and IT MSP about ongoing compliance and risk management, and our Chief Executive Officer provides periodic briefings to the Audit Committee regarding our cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like.

companyName: Aldeyra Therapeutics, Inc.

ticker: ALDX


text: NEE uses third parties to periodically assess the extent to which its cybersecurity risk management protocols align with the U.S. Department of Energy's Cybersecurity Capability Maturity Model standard. Certain functions within NEE are required to comply with certain regulatory standards that are designed to protect against cybersecurity incidents, including the NERC Critical Infrastructure Protection standards. Further, NEE has a cybersecurity training program and a mock phishing program to educate and train employees on potential cybersecurity risks and on privacy and data protection. Given geopolitical events, NEE continues to take steps to defend against cybersecurity threats to its and XPLR's critical infrastructure, including communications with personnel to ensure heightened awareness of increased cybersecurity threats worldwide.

companyName: XPLR Infrastructure, LP

ticker: XIFR


text: Pega Cloud for Government is rated FedRAMP Moderate and undergoes several security assessments a year as part of the FedRAMP certification process. Our Vice President of Cloud Technology reviews these assessments and provides updates to our SSG.

companyName: PEGASYSTEMS INC

ticker: PEGA


text: To date, we have not identified any cybersecurity incidents or threats that have materially impacted our business strategy, operations, or financial condition. Our materiality assessment process is designed to ensure compliance with all applicable securities laws and regulations, including the SEC's cybersecurity disclosure rules. We also consider industry-specific regulations and standards. However, there can be no assurances that such a cybersecurity incident will occur or that such incident will materially impact our business. Any breach of our security measures, or those of our third-party service providers, could result in unauthorized access to and misappropriation of our information, corruption of data or disruption of systems, operations or transactions, any of which could have a material adverse effect on our business strategy, results of operations or financial condition.

companyName: Health In Tech, Inc.

ticker: HIT


text: Depending on the environment, systems, and data, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example, incident detection and response processes, vulnerability management policy, disaster recovery and business continuity plans, risk assessments, encryption of certain data, data segregation for certain data, network security and access controls, physical security controls, asset management, tracking and disposal, monitoring for certain systems, vendor risks management processes, employee training, penetration testing, employee training, cybersecurity insurance, and dedicated cybersecurity staff.

companyName: STARZ ENTERTAINMENT CORP /CN/

ticker: STRZ


text: The Audit Committee oversees the Company's risk management policies, including the management of risks arising from cybersecurity threats. The Audit Committee receives presentations and reports on cybersecurity risks, which address a wide range of topics including annual assessments of internal and third-party policies, vulnerability assessments, technological trends and information security considerations arising with respect to the Company and our Manager. The Audit Committee also receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, the Board and the Audit Committee discuss the Company's approach to cybersecurity risk management with our Manager, including the Manager's Director of Information Technology.

companyName: NexPoint Real Estate Finance, Inc.

ticker: NREF


text: Our Chief Information Officer leads our overall cybersecurity function and is responsible for developing and implementing our information security program and managing our response to threats. In addition to our in-house cybersecurity capabilities, at times we also engage third parties to assist with assessing, identifying, and managing cybersecurity risks. Members of our IT security team, including the third party security firms we utilize as part of our program, have cybersecurity experience or certifications, such as the Certified Information Systems Security Professional certification.

companyName: STARWOOD PROPERTY TRUST, INC.

ticker: STWD


text: We believe cybersecurity is critical to advancing our technological developments. As a biopharmaceutical company, we face a multitude of cybersecurity threats that range from attacks common to most industries, such as ransomware and denial-of service. Our customers, suppliers, subcontractors, and business partners face similar cybersecurity threats, and a cybersecurity incident impacting us or any of these entities could materially adversely affect our business strategy, performance, and results of operations. These cybersecurity threats and related risks make it imperative that we expend resources on cybersecurity.

companyName: Greenwich LifeSciences, Inc.

ticker: GLSI


text: As one of the critical elements of the Company's overall enterprise risk management approach, the Company's cybersecurity program is focused on the following key areas: • Governance: As discussed in more detail under the heading "Governance," the Board's oversight of cybersecurity is delegated to the Audit and Compliance Committee of the Board, which oversees the Company's entire ERMP, reporting up to the full board on a periodic basis. The Company's Chief Information Officer ("CIO"), the Chief Compliance Officer and other members of management regularly report to the Audit and Compliance Committee, with cybersecurity representing a standing meeting agenda topic. • Collaborative Approach: The Company has implemented a systematic, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.

companyName: AMICUS THERAPEUTICS, INC.

ticker: FOLD


text: Cybersecurity is an important part of our risk management and an area of focus for our Board and management. Our Board of Directors is responsible for the oversight of risks from cybersecurity threats. The Board receives updates on a quarterly basis from senior management, including leaders from our Information Technology and Security, Risk Management. Finance, and Legal teams and our Chief Information Officer regarding matters of cybersecurity. This includes existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any) and status on key information security initiatives. The Audit Committee,of the Company's Board of Directors oversees, among other things, the adequacy and effectiveness of the Company's internal controls, including internal controls designed to assess, identify, and manage material risks from cybersecurity threats. The Board of Directors, as a whole and at the Audit Committee level, oversee the most significant risks facing the Company and our processes to identify, prioritize, assess, manage and mitigate those risks.

companyName: Lovesac Co

ticker: LOVE


text: The Audit Committee of the GE Vernova's Board of Directors is responsible for board-level oversight of cybersecurity risk, and the Audit Committee reports back to the full Board about this and other areas within its responsibility. As part of its oversight role, the Audit Committee receives reporting about GE Vernova's practices, programs, notable threats or incidents, and other developments related to cybersecurity throughout the year, including through periodic updates from our Chief Information Security Officer (CISO). The Audit Committee also receives information about cybersecurity risks as part of GE Vernova's enterprise risk management framework and reporting. In addition to receiving reports from the Audit Committee, the Board also periodically receives direct reports from the CISO on the Company's cybersecurity risk management.

companyName: GE Vernova Inc.

ticker: GEV


text: The Vice President and Chief Information Officer ("CIO"), who also serves as a member of the Company's enterprise risk council, works closely with key business leaders and functions to develop and enhance the Company's cybersecurity strategy. Our cybersecurity program is designed to safeguard against an evolving threat landscape through effective prevention, detection, response and recovery processes. Our cybersecurity risk management processes include frequent assessment of our top cyber risks and mitigations.

companyName: ARMSTRONG WORLD INDUSTRIES INC

ticker: AWI


text: Autoliv has not experienced any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company. Despite our efforts, there can be no assurance that our cybersecurity risk management processes and measures described will be fully implemented, complied with or effective in protecting our systems and information. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect our business strategy, result of operations or financial condition. For a full discussion of these cybersecurity risks, please see our Risk Factors in Item 1A.

companyName: AUTOLIV INC

ticker: ALV


text: We also engage third-party security consultants to assist with assessment and enhancement of our cybersecurity risk management program and compliance with applicable practices and standards. Should a cyber security incident occur in the future, we may engage third parties to assist us in responding to the incident as well as enhancing our cybersecurity risk management program, if necessary.

companyName: Karat Packaging Inc.

ticker: KRT


text: Our chief information officer, who leads our IT department, oversees our cybersecurity program. Our chief information officer has twenty-nine years of IT experience. Our chief information officer reports to our chief financial officer. As part of our company's risk management function, our chief information officer provides periodic updates about our cybersecurity risk profile to our executive leadership team. We have an incident response program that provides for the prompt escalation of certain cybersecurity incidents to certain members of management, including our chief financial officer and our general counsel, so that decisions regarding disclosure and reporting of such incidents can be made in a timely manner.

companyName: B&G Foods, Inc.

ticker: BGS


text: Board Oversight of Cybersecurity The Equifax Board of Directors monitors our "tone at the top" and risk culture and oversees principal risks facing the Company. On an annual basis, the Board reviews an enterprise risk assessment prepared by management that describes the principal risks and monitors the steps management is taking to map and mitigate these risks. The Board then sets the general level of risk appropriate for the Company through business strategy reviews. Risks are assessed throughout the business, focusing on nine primary risk categories, including cybersecurity.

companyName: EQUIFAX INC

ticker: EFX


text: Senior IT leadership (generally, chief information officers and/or chief information security officers) at the parent company and each subsidiary are responsible for developing cybersecurity programs appropriate for their respective entities, including as may be required by applicable law or regulation. These individuals' expertise in IT and cybersecurity generally has been gained from a combination of education, including relevant degrees and/or certifications, and prior work experience. They are informed by their respective cybersecurity teams about, and monitor, the prevention, detection, mitigation and remediation of cybersecurity incidents as part of the cybersecurity programs described above.

companyName: LOEWS CORP

ticker: L


text: The Company maintains an ad hoc committee comprised of senior management with responsibility for third party (vendor) risk management, including the CISO, the Chief Risk Officer, the Chief Compliance Officer, representatives from vendor management, and enterprise risk management associates. The ad hoc committee reviews diligence regarding vendors, including cyber diligence, and monitors any incidents or cybersecurity threats involving those third parties. Cyber diligence of critical vendors (vendors which store or interact with customers' personally identifiable information) includes an annual review of the technology and data interfaces with the vendor, an annual review of the vendor's cyber security controls, and monthly monitoring of the vendor's outward-facing security posture.

companyName: FIRST FINANCIAL BANCORP /OH/

ticker: FFBC


text: One of the key functions of our board of directors is to provide oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight function directly as a whole, as well as through the audit committee.

companyName: PACIFIC BIOSCIENCES OF CALIFORNIA, INC.

ticker: PACB


text: As of December 31, 2024, we have not detected any cybersecurity threats, including prior incidents, that have materially impacted the Company, our business strategy, our financial results, or our financial health. For an examination of cybersecurity threats that could potentially have a material impact on us, please refer to our Risk Factors discussion in the section titled "We face risks relating to Cybersecurity attacks, loss of confidential information and other business disruptions" in this Form 10-K.

companyName: Whitestone REIT

ticker: WSR


text: We use various tools and methodologies to identify, manage, and test for cybersecurity risk on a regular cadence both at the enterprise level and using third-party service providers. These third parties include cybersecurity managed security service providers (MSSPs), consultants, advisors, and auditors, who we engage to evaluate our controls, whether through penetration testing, independent audits, or consulting on best practices to address new threats or challenges. To ensure we use reputable vendors for our information systems, we review and confirm SOC 1 reports for vendors providing critical business services. For vendors handling Avalo's clinical and manufacturing information, we employ quality agreements and vendor audits to ensure vendor compliance with our Program and all applicable regulatory requirements. We also engaged internal auditors to conduct a walkthrough of our information technology control environment, test our information technology controls, and report to us any findings. External security service firms monitor the Company's networks at all times, and Company laptops are patched weekly with up-to-date antivirus and real time threat-monitoring protection. Further, we actively engage with key vendors, industry participants, and law enforcement officials as part of our continuing efforts to evaluate and improve our Program.

companyName: Avalo Therapeutics, Inc.

ticker: AVTX


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including those in our supply chain or who have access to our customer and employee data or our systems. Third-party risks are included within our enterprise risk management program, as well as our cybersecurity-specific risk identification program, both of which are discussed above. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and monitor cybersecurity threat risks identified through such diligence.

companyName: FIRST US BANCSHARES, INC.

ticker: FUSB


text: The Vice President of Information Technology, in coordination with executive leadership including our Interim Chief Executive Officer ("CEO") and Chief Financial Officer ("CFO"), works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the Vice President of Information Technology monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and reports such threats and incidents to the Audit Committee when appropriate.

companyName: DOUGLAS DYNAMICS, INC

ticker: PLOW


text: As part of our broader risk management framework, we have identified the potential cybersecurity risks to our business. We have designed our business applications and hosting services to minimize the impact that cybersecurity incidents could have on our business and have identified back-up systems where appropriate. We seek to further mitigate cybersecurity risks through a combination of monitoring and detection activities, use of anti-malware applications, employee training, quality audits and communication and reporting structures, among other processes. We have an incident response plan in place that outlines containment, eradication, and recovery plans in the event of a cybersecurity threat or incident.

companyName: CVRx, Inc.

ticker: CVRX


text: Recognizing the complexity and evolving nature of cybersecurity threats, we have engaged external experts and rely on software support from third-party vendors to assist with evaluating, monitoring, and testing our information technology systems. These relationships enable us to leverage specialized knowledge and insights, to help ensure our cybersecurity strategies and processes remain effective. Our collaboration with these third parties includes regular audits, routine system monitoring, threat assessments, and consultation on potential security enhancements. We require third-party service providers with access to personal, confidential, or proprietary information to implement and maintain comprehensive cybersecurity practices consistent with applicable legal standards and industry best practices.

companyName: Brookdale Senior Living Inc.

ticker: BKD


text: As part of our overall risk management approach, we prioritize the identification and management of cybersecurity risk at several levels, which involves Board and Audit Committee oversight, senior and department executive leadership focus and commitment, and employee training. Our Audit Committee, comprised entirely of independent directors from our Board, oversees the Board's responsibilities relating to the operational (including information technology ("IT") risks, business continuity and data security) risk affairs of the Company. Our Audit Committee is informed of such risks through annual assessments, quarterly reporting and regular updates from members of the Company's executive leadership team, cybersecurity and data privacy leadership team, as well as the Internal Audit team.

companyName: Gogo Inc.

ticker: GOGO


text: We conducted at least two tabletop exercises simulating a breach scenario and tested our response readiness; and We established notification procedures to comply with applicable laws and to inform affected stakeholders promptly in the event of an incident.

companyName: ALEXANDER TECH CORP


text: The Company conducts regular internal cybersecurity assessments intended to measure inherent risk and drive the adjustment of our security posture according to the latest threats. These assessments include alignment with the FFIEC's recommendations on cyber preparedness, GLBA Safeguards Rule to protect user data, and Swift security control requirements. The Company performs continuous internal and external vulnerability scanning to measure and react to new vulnerabilities and seeks conformance to Center for Internet Security benchmarks for both cloud-based and on-premises technology. The Company reviews vendor and partner security practices to ensure they maintain proper information security safeguards.

companyName: WESTERN ALLIANCE BANCORPORATION

ticker: WAL


text: Process for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats We maintain an incident response program. In the event of a cybersecurity incident, designated personnel are responsible for assessing the severity of an incident and associated threat, containing the threat, remediating the threat, including recovery of data and access to systems, analyzing any reporting obligations associated with the incident, and performing post-incident analysis and program enhancements. We maintain a Cybersecurity Policy, which includes an Incident Response Plan in the event of a significant cybersecurity incident. In the event of a significant cybersecurity incident, our IT Director will chair an incident response team to handle the incident. Such incident response team will include members of IT, finance (if applicable), legal, communications, human resources and any affected unit or department. IT, along with a designated forensic team, will use the Incident Response Plan to guide the response.

companyName: Nauticus Robotics, Inc.

ticker: KITT


text: The Southern Company system has implemented a cross-functional, risk-based, "defense-in-depth" approach to preventing, detecting, identifying, mitigating, responding to, and recovering from cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. Overall network efforts are led by the CISO and the Technology Security Organization (TSO), the organization responsible for implementing, monitoring, and maintaining cybersecurity practices across the Southern Company system, and aided by the Executive Vice President of Operations and the Energy Management System and Generation organization. The CISO meets regularly with the CIO and the Chief Executive Officer and reports regularly to committees of the Board to discuss risk management measures implemented to identify and mitigate data protection and cybersecurity risks. Security and resiliency are emphasized through business assurance, enterprise risk management, and incident response plans designed to identify, evaluate, and remediate incidents when they occur. Among other things, the Cybersecurity Incident Response Plan (CIRP) establishes a team comprised of the CISO, the Deputy CISO, the Director of the Digital Defense Center, and members of the legal and compliance organizations to evaluate emerging cyber threats and escalate to executive management and business units as appropriate. Plans, policies, and technologies are regularly updated and training exercises and crisis management preparedness activities are conducted to test effectiveness.

companyName: SOUTHERN CO GAS


text: Our cybersecurity measure is primarily focused on ensuring the security and protection of computer systems and networks. We utilize a third-party service provider, as well as internal resources, to monitor and, as appropriate, respond to cybersecurity risks. We maintain various protections designed to safeguard against cyberattacks, including firewalls and virus detection software. We also periodically scan our environment for any vulnerabilities and perform penetration testing. In addition, to promote security awareness, we provide cybersecurity risk training to all employees at least annually.

companyName: Kartoon Studios, Inc.

ticker: TOON


text: Our Audit Committee is responsible for overseeing our major financial, legal, and regulatory risk exposures, which span a variety of areas, including cybersecurity.

companyName: Outset Medical, Inc.

ticker: OM


text: The Company's cyber risk management strategy has consisted of a focus on minimizing our attach surface and leveraging industry standard cyber threat prevention, detection, and remediation tools. The Company assesses cyber security risk as follows:

companyName: REGENEREX PHARMA, INC.

ticker: RGPX


text: >ongoing cybersecurity maintenance activities, including scheduled maintenance time windows for comprehensive system updates to occur, with additional ad hoc updates occurring as needed, monitoring of all Company devices for timeliness of security updates and pushing time-sensitive updates to our system infrastructure and devices, as appropriate; >recurring, redundant backups of our applications, servers and data, with replication to remote storage locations;

companyName: COPT DEFENSE PROPERTIES

ticker: CDP


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal IT personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by cybersecurity tools deployed in the IT environment.

companyName: Erasca, Inc.

ticker: ERAS


text: Prospect Capital Management uses processes to oversee and identify material risks from cybersecurity threats, including those associated with the use of third-party service providers. Additionally, Prospect Capital Management uses systems and processes designed to reduce the impact of a security incident at a third-party service provider. As part of its risk management process. Prospect Capital Management, also maintains an incident response plan that is utilized when cybersecurity incidents impacting us, our Adviser, or our Administrator are detected.

companyName: Prospect Floating Rate & Alternative Income Fund, Inc.


text: The Audit Committee of our Board of Directors is responsible for overseeing cybersecurity risk and periodically updates our Board of Directors on such matters. The Audit Committee regularly reviews and discusses with management the strategies, processes, procedures and controls pertaining to the management of our information technology operations, including cyber risks and cybersecurity. The Audit Committee regularly and management the strategies continuously analyzes cybersecurity and resiliency risks to our business, considers industry trends and implements controls, as appropriate, to mitigate these risks.

companyName: Greenland Technologies Holding Corp.

ticker: GTEC


text: • Our Audit Committee and Board of Directors play an active role in reviewing our cybersecurity initiatives. The BrightSpire IT Partner provides our Board an annual review of our cybersecurity governance and risk management program, security metrics relevant to the period in review (including findings on phishing campaigns and vulnerability patchwork initiatives) and provides the Audit Committee and Board updates regarding the cybersecurity threat landscape (for example, the impact of artificial intelligence). In coordination with the Information Security Group, the General Counsel provides reports of material cybersecurity incidents and cybersecurity threats (if any) at each quarterly meeting of the Audit Committee and Board. • The BrightSpire IT Partner has established itself as a provider of managed services and technology solutions for over two decades, providing 24/7 oversight and services, including continuous testing and vulnerability scanning. The BrightSpire IT Partner also performs annual due diligence of key vendors on a rotating basis (including System and Organization Controls (SOC) report reviews, or alternatively solicit detailed questionnaires to evaluate such vendors cybersecurity preparedness and protections). • Our Head of IT has over two decades of experience in IT and cybersecurity work and developed and implemented our cybersecurity program with the BrightSpire IT Partner. Together with our Head of IT, the Information Security Group considers current cybersecurity trends and threats, including through discussions with the BrightSpire IT Partner, outside cybersecurity counsel, our independent financial auditor and internal auditor. The Information Security Group undertakes table-top business disruption, disaster recovery and related response strategies and plans on a periodic basis and seeks to review and update applicable policies and procedures at least annually.

companyName: BrightSpire Capital, Inc.

ticker: BRSP


text: The underlying controls of the cyber risk management program are based on recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology (“NIST”) Cybersecurity Framework (“CSF”) and the International Organization Standardization (“ISO”) 27001 Information Security Management System Requirements. SLB has an annual assessment, performed by a third party, of the Company’s cyber risk management program against the NIST CSF.

companyName: SLB LIMITED/NV

ticker: SLB


text: The IS Director and the Information Security Team communicate guidance, including various alerts to monitor and assess threats, to information security personnel in all segments to ensure consistent execution of cybersecurity risk management activities. Updates on segment-level cybersecurity risks, compliance and implementation status are provided on at least a quarterly basis to Seaboard's Chief Executive Officer ("CEO") and Chief Financial Officer ("CFO") for purposes of risk monitoring, updates to policies, allocation of resources, progress on action plans and discussions on other topics as necessary.

companyName: SEABOARD CORP /DE/

ticker: SEB


text: At Rapid7, cybersecurity risk management is integrated into our overall enterprise risk management program and is one of the pillars of our broader cybersecurity program. Our cybersecurity risk management program is designed based on prevailing security standards and controls, such as NIST-800 and ISO 27001, and to continuously evaluate cybersecurity risks in alignment with our business objectives and operational needs. Our information security team manages a framework for handling both information security risk management and operational cybersecurity threats and incidents, including those associated with the use of products and services provided by third-party service providers, suppliers, and vendors. This framework includes steps for assessing the severity of a cybersecurity threat or incident, identifying the source of such cybersecurity threat or incident (including whether such cybersecurity threat or incident is associated with a third-party service provider, supplier, or vendor), implementing cybersecurity countermeasures and mitigations and an escalation path for informing management, the audit committee of the board of directors (the "Audit Committee"), and our full board of directors (the "Board") of cybersecurity threats, incidents and risks.

companyName: Rapid7, Inc.

ticker: RPD


text: In addition, EOG's internal audit function, in conjunction with third-party experts, play a key role in reviewing and assessing EOG's cybersecurity technologies, controls and procedures, including conducting penetration testing and vulnerability assessments.

companyName: EOG RESOURCES INC

ticker: EOG


text: The Company has a Cybersecurity Incident Response Plan ("the Plan"), which provides protocols and procedures for evaluating and responding to material cybersecurity and other data security incidents, including incident handling, disclosure and reporting, notification to senior management, the Board and relevant committees, and meeting external reporting obligations. As part of the Plan, the Company has also established an Incident Response Governance Team, co-chaired by our CISO and VP, Deputy General Counsel, which is a cross-functional group comprised of relevant stakeholders throughout the organization responsible for organizing the assessment, investigation and response to any material cybersecurity or data security event.

companyName: CASEYS GENERAL STORES INC

ticker: CASY


text: Impact of Risks from Cybersecurity Threats As of the date of this Report, though the Company and our service providers have experienced certain cybersecurity incidents, we are not aware of any previous cybersecurity threats that have materially affected, or are reasonably likely to materially affect, the Company, including our business strategy, results of operations or financial condition. Despite the implementation of our cybersecurity processes, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. For more information on our cybersecurity related risks, see "Item 1A. Risk Factors" for additional information.

companyName: HighPeak Energy, Inc.

ticker: HPK


text: Although we believe risks from cybersecurity threats have not to date materially affected us, including our business strategy, results of operations, or financial condition, we have, from time to time, experienced threats to and breaches of our data and systems, including ransomware attacks and phishing attacks. For more information about the cybersecurity risks we face, see the risk factor entitled "We are dependent on information technology in our operations, and the failure of such technology may adversely affect our business. Security breaches of our information technology systems, including cyber-attacks, ransomware attacks, or use of malware or phishing or other malicious techniques by threat actors, have in the past and could in the future lead to liability, impact our operations, or damage our reputation and financial results" in Item 1A, "Risk Factors".

companyName: PLUG POWER INC

ticker: PLUG


text: Information Technology and Cybersecurity Our business relies on the secure electronic transmission, storage and hosting of information, including personal information, financial information, intellectual property, and other sensitive information related to our business, customers and workforce ("sensitive information") on both our information systems and those of third-party service providers. Given the importance of cybersecurity to our business, we maintain a comprehensive information technology and cybersecurity program to increase both the effectiveness of our systems and our preparedness for cybersecurity risks, including security monitoring for internal and external threats to bolster the confidentiality, integrity and availability of our information assets. We perform evaluations of our cybersecurity program, including periodic internal and external audits, penetration tests and incident response simulations, and our information technology infrastructure and cybersecurity management system are subject to external program assessments on a regular basis. We refer to the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF") to help inform our cybersecurity management system and reduce cybersecurity risks, although we do not fully implement all aspects of NIST CSF.

companyName: INTEGRA LIFESCIENCES HOLDINGS CORP

ticker: IART


text: Management of material risks from cybersecurity threats is integrated into the Company's overall risk management processes and is monitored as an enterprise risk. The Company's Board of Directors (the "Board"), with the input of management, oversees the Company's internal controls and processes, including internal controls designed to assess, identify, and manage material risks from cybersecurity threats.

companyName: MARINEMAX INC

ticker: HZO


text: We cannot assure that our information security policies and processes will be effective in protecting us from cybersecurity threats. Risks from cybersecurity threats have not materially affected us. However, if we experience a material cybersecurity incident it is reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. For more information, please see Item 1A. Risk Factors of this Report, including the risk factors titled "If We Experience Problems with Our Originations, Accounting or Collection Systems, Our Results of Operations May Be Impaired" and "A Breach in the Security of Our Systems Could Result in the Disclosure of Confidential Information, or Subject us to Liability."

companyName: CONSUMER PORTFOLIO SERVICES, INC.

ticker: CPSS


text: The Company has engaged a third-party service provider to implement comprehensive IT and cybersecurity policies, including Guardz, Cyber Essentials, and others. These initiatives are supported by detailed policies and staff training programs, which have strengthened the Company's IT framework and improved compliance.

companyName: CDT Equity Inc.

ticker: CDT


text: Management is ultimately responsible for assessing and managing the Company's cybersecurity risk. The information security program is overseen by the Chief Financial Officer. The Board is then briefed upon the occurrence of any cybersecurity incidents and is provided an overview of the information security program on an annual basis, including updates on the IT team, IT training, implementation of IT controls, cybersecurity testing, the incident response process and the cybersecurity assets of the Company.

companyName: ProtoKinetix, Inc.

ticker: PKTX


text: 20 Service Corporation International Managing Material Risks & Integrated Overall Risk Management Cybersecurity risk management is integrated into our broader enterprise risk management system, and cybersecurity risk is strategically reviewed, monitored and managed alongside other enterprise risks on a regular basis. Our information security program is designed to evaluate, identify, and manage risks from cybersecurity threats and vulnerabilities, including malware, phishing, hacking, social engineering, and data breaches. Our program is regularly assessed using the NIST Cybersecurity Framework, and information security training is provided to our employees. Our information security team is empowered to assess and address cybersecurity risks in close collaboration with the operational teams. This forward-thinking strategy ensures that cybersecurity risk management awareness informs each stage of the business decision-making process.

companyName: SERVICE CORP INTERNATIONAL

ticker: SCI


text: Our Information Technology General Controls are firmly established based on recognized industry standards and addresses matters such as risk management, data backup, and disaster recovery. We also engage an outsourced information technology consultant to actively monitor and mitigate security threats, as well as identify vulnerabilities and respond to all cybersecurity incidents affecting us, including timely communication of significant security incidents to senior business leadership and our Board of Directors.

companyName: International Stem Cell CORP

ticker: ISCO


text: Our Board receives periodic reports on cybersecurity risks and any material cybersecurity incidents. One member of our Board of Directors, Paresh Patel, has information technology expertise.

companyName: HCI Group, Inc.

ticker: HCI


text: Cybersecurity is integrated into our operations, including through team member engagement, technology infrastructure, data fabric, and product development. Due to the sensitive nature of our customers' data that we hold, we have a heightened focus on data security and protection. We maintain administrative, technical, and physical safeguards designed to protect confidential data. Our security team seeks to identify security risks by working with state and federal law enforcement, security information-sharing organizations, and 24/7 system surveillance through internal and external detection and response teams. Additionally, to help ensure our approach to customer privacy and security is effective and in line with industry standards, we publish Service and SOC 2 attestation reports on our risk management standards established by the Statement on Standards for Attestation Engagements 18.

companyName: HEALTHEQUITY, INC.

ticker: HQY


text: >From time to time, as appropriate under our overall cybersecurity program, we engage third-party experts to support the assessment of cyber related risks, including to conduct cyber penetration testing.

companyName: GULF RESOURCES, INC.

ticker: GURE


text: We are committed to safeguarding our information systems and data from potential cyber threats. Our cybersecurity measures include comprehensive policies, continuous monitoring, regular security assessments, and employee training programs to mitigate risks and enhance our defenses against cyber incidents. We have not experienced any material cybersecurity breaches to date.

companyName: KB Global Holdings Ltd


text: We are subject to risks from cybersecurity threats and incidents. As of December 31, 2024, we do not believe such risks have materially affected or are reasonably likely to materially affect the Company, including the Company's business strategy, results of operations or financial condition. However, there can be no assurance that the Company will not be materially affected in the future.

companyName: LUB LIQUIDATING TRUST


text: Accordingly, we have established Cybersecurity standards, policies, and operating procedures, for the purpose of implementing information protection processes and technologies; carrying out Cybersecurity risk detection, identification, assessment, response, and monitoring; assigning responsibility within our organization for risk detection and oversight; implementing Cybersecurity training;

companyName: Greenwave Technology Solutions, Inc.

ticker: GWAV


text: With respect to third -party service providers with access to our information systems, assets or data, our security policies, standards and procedures are designed so that periodic due diligence is conducted as appropriate on the cybersecurity controls maintained by such third parties. The aim is to ensure the third -party service provider has adequate and appropriate cybersecurity measures in place commensurate to the risk their access to our information systems, assets or data presents.

companyName: JANUS HENDERSON GROUP PLC

ticker: JHG


text: We have an employee security awareness training program, required upon onboarding and on an annual basis thereafter, that is designed to raise awareness of cybersecurity threats across functions as well as to encourage consideration of cybersecurity risks across our Company. As part of this employee training program, we periodically conduct phishing simulations designed to raise employee awareness of such risks.

companyName: Senti Biosciences, Inc.

ticker: SNTI


text: In the event of a cybersecurity incident, we maintain an incident response plan in an effort to contain and mitigate the threat. As part of our incident response plan, our Cybersecurity Incident Response Team (a cross-functional taskforce comprised of senior representatives), is responsible for convening to assess the potential impact to our business, including financial reporting requirements and legal implications.

companyName: COLLEGIUM PHARMACEUTICAL, INC

ticker: COLL


text: For a discussion of the Company's cybersecurity-related risks, see Item 1A of this Form 10-K under the heading "Risk Factors."

companyName: Apple Inc.

ticker: AAPL


text: The board of trustees considers cybersecurity as part of its broader consideration of business strategy and risk management. Our board of trustees has delegated to the Audit Committee the responsibility of overseeing the Company's risk management program, including the company's risk assessment, risk management and risk mitigation policies and programs. A key part of this responsibility is overseeing the Company's cybersecurity program. The Audit Committee, which consists solely of independent trustees and whose chair has information security experience, receives quarterly updates with respect to the cybersecurity program, addressing topics such as current threat levels, program enhancements and vulnerability testing. The Audit Committee oversees our compliance with industry standard cybersecurity frameworks, our cybersecurity insurance coverage, cybersecurity-related internal controls, cybersecurity training provided to company personnel, penetration testing, incident response plan updates, and our business continuity plan. The Audit Committee also periodically evaluates our cyber strategy to ensure its effectiveness, including benchmarking against our peers. The Audit Committee provides regular briefings to the full board of trustees with respect to the Company's cybersecurity program. Additionally, we provide an annual update on the cybersecurity program to the full board of trustees, which has included our CTO and third-party cybersecurity experts in recent years.

companyName: American Homes 4 Rent

ticker: AMH


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from IT security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.

companyName: Sunstone Hotel Investors, Inc.

ticker: SHO


text: Role of the Board and Management The Company's Board recognizes the importance of cybersecurity in safeguarding the Company's sensitive data. The Board is responsible for overseeing overall risk management for the Company, including review and approval of the enterprise risk management approach and processes implemented by management to identify, assess, manage and mitigate risk, at least annually. The Board has delegated responsibility for oversight of the Company's cybersecurity and information security framework and risk management to the Company's Management Cybersecurity Committee (the "Cybersecurity Committee"). Pursuant to its charter, T he Cybersecurity Committee must consist at least four (4) members of Company's executive management team, which shall include the Company's Director of Technology, Chief Operating Officer, Chief Compliance Officer and Chief Financial Officer, each of whom is required to have working familiarity, knowledge and competencies in relevant areas, including data privacy, public policy, information technology ("IT") strategy, IT development and deployment, or IT risk assessment and management, including information security management. In addition, the Company's Director of Technology has formal education in information technology and extensive experience working in and leading the Company's information systems and technology function.

companyName: Cohen & Co Inc.

ticker: COHN


text: On an ongoing basis, Cheniere assesses its people, processes and technology and, when necessary, adjusts the overall program in an effort to adapt to the ever-evolving cyber and geopolitical landscapes. Cheniere conducts regular assessments and audits, cross-functional risk mitigation exercises and risk strategy sessions to identify cybersecurity risks, applicable regulatory requirements and industry standards. These engagements are also designed to exercise, assess the maturity of and enhance Cheniere's Cyber Incident Response Plan. To support these efforts, Cheniere has contracted with third parties to perform facility and system penetration tests, compromise assessments of information technology systems, and security maturity assessments of its corporate and operational networks. Cheniere maintains a training program to help its personnel identify and assist in mitigating cybersecurity and data security risks. Cheniere's employees and the members of the Board participate in annual training, user awareness campaigns and additional issue-specific training as needed. Cheniere also provides annual training for certain contractors who have access to its information technology networks.

companyName: Cheniere Corpus Christi Holdings, LLC


text: Management's Role in Cybersecurity Risk Management Our Chief Executive Officer and President are responsible for assessing and managing material risks from cybersecurity threats. Our Chief Executive Officer and President possess relevant expertise in various disciplines that are key to effectively managing such risks, such as technology systems, technology leadership, technological development, cybersecurity, regulatory compliance and corporate governance. Our Chief Executive Officer and President are informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents, including through the receipt of notifications from third-party service providers and reliance on communications with our Chief Financial Officer and legal personnel.

companyName: Nxu, Inc.

ticker: NXUR


text: To effectively prevent, detect and respond to cybersecurity threats, we maintain a cyber risk management program under the responsibility of the head of the Information Technology ("IT") function. Management and administration of cybersecurity systems and activities are primarily outsourced to consultants who have cross-functional expertise in cyber security and who perform the work under the supervision of the IT head. Our IT head, in turn reports to the Senior Vice-President and General Counsel who is responsible for and knowledgeable of legal and contractual cybersecurity risk for the organization. The program is comprised of policies, standards, architecture, and processes, which are reviewed and updated on a periodic basis. The program leverages a multilayered approach of utilizing different practices, technologies, vendors or techniques without an overreliance on a single vendor. We engage with consultants to help develop and evidence the policies, standards, and processes in a manner consistent with applicable legal requirements, and also evaluate and adopt cybersecurity software from reputable vendors in cybersecurity, some that provide software as a service solutions backed by a Security Operations Center. We also engage separate third parties to provide penetration testing, risk consulting, cybersecurity incident assessment and forensics, as necessary and in addition to IT's internal risk assessment processes. We work with many companies that provide hosted software or support for software systems. It is important for these companies to also have effective cybersecurity measures to protect data and systems. We have a self-attestation form to assess cybersecurity readiness that is sent to select vendors based on a risk assessment. For certain vendors, we request System and Organization Controls (SOC) reports or similar documents to provide assurance that the vendors have audited practices or practices in keeping with our legal requirements even if SOC audit documentation does not exist. We have also engaged legal counsel to advise on cybersecurity matters and we have developed an escalation protocol to report cybersecurity incidents as legally required. No material cybersecurity incidents have occurred to date.

companyName: Celldex Therapeutics, Inc.

ticker: CLDX


text: We engage multiple independent third parties and cyber experts to assess our information security programs and practices. These assessments include, but are not limited to, framework maturity assessments, blind penetration testing, technology health checks, cyber skill and staffing assessments, externally facilitated tabletop exercises, external cyber legal counsel briefings, and strategic assessments. Findings from these assessments are regularly reviewed with management and the ROC. Additionally, we participate in various cybersecurity industry forums and have access to law enforcement analysis regarding current threats.

companyName: ZIONS BANCORPORATION, NATIONAL ASSOCIATION /UT/

ticker: ZION


text: The Board Risk Committee is responsible for oversight of the Company's enterprise risk management program, which encompasses information technology, information security and cybersecurity. This includes management's actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks. The Board Risk Committee also has oversight of and establishment of risk appetite guidance through the approval of Policies and Programs including the information security and cybersecurity programs. Annual independent assessments of the Company's cybersecurity program which are completed by external parties with the required expertise are also presented to the Board Risk Committee. The Chief Administrative Officer and Chief Risk Officer report to the Board and/or Board Risk Committee on cybersecurity risks and other matters reviewed by the IT/Operations Committee. Senior officers from IT or Information Security discuss cybersecurity matters that arise between Committee and Board meetings with the Chief Administrative Officer and/or the Chief Risk Officer, who will share these with the Company's Executive Officers and Board members, as appropriate.

companyName: SIERRA BANCORP

ticker: BSRR


text: Our Chief Financial Officer, or CFO, is primarily responsible for assessing and managing cybersecurity risks across the company based on the assessments by our Senior Director of IT and third-party IT specialists. Additionally, our cybersecurity risk assessment and management processes are implemented and maintained by our Senior Director of IT with assistance from third-party IT specialists. Our CFO has extensive experience managing risks at our company and at similar companies in the past, including risks arising from cybersecurity threats. Our Senior Director of IT has over 25 years of experience in IT security, and data analytics.

companyName: Pyxis Oncology, Inc.

ticker: PYXS


text: Oversee Third-party Risk Because we are aware of the risks associated with third-party service providers, we have implemented stringent processes that isolate the Company's financial and operating records from any other systems including email and other internet applications.

companyName: Gyrodyne, LLC

ticker: GYRO


text: In the ordinary course of business, the Company is subject to cybersecurity risks, which the Company manages as a component of its overall risk management strategy. The Company's management recognizes the impact that cybersecurity threats could have on our business operations, our compliance with regulations and our reputation. The Company has created a cybersecurity monitoring and reporting framework that it uses to respond to any potential cybersecurity risks. As part of this framework, the Company utilizes a third-party vendor to provide network security and assist with protection against cybersecurity risks through network assessments, monitoring, and related activities. The Company's management continues to assess material risks from cybersecurity threats, its compliance policies, and its reporting framework in order to limit the risk posed by cybersecurity incidents.

companyName: Kingfish Holding Corp


text: CNA's information security and data privacy programs are designed to protect the confidentiality of nonpublic, sensitive personal and business information and the integrity and security of our information systems. These programs include processes that provide guidance for information security decision-making and risk management, and include standards to promote understanding and compliance with applicable laws and regulations. Administrative and technical safeguards that seek to mitigate cybersecurity threats and secure the Company's information assets are also addressed on a risk-based basis. We have designed our enterprise-wide information security programs consistent with industry standards using the National Institute of Standards and Technology Cybersecurity Framework. These programs include processes implemented within our third-party risk management unit designed to identify, mitigate and monitor cybersecurity risk relating to vendors, suppliers and external partners who have access to our confidential information or our information systems. CNA engages both internal auditors and third-party information security experts in connection with reviewing such foregoing processes.

companyName: CNA FINANCIAL CORP

ticker: CNA


text: Our cybersecurity risk management program includes: • periodic risk assessments designed to help identify material cybersecurity risks to our critical systems, information, and our broader enterprise information technology environment; • skilled information security and data privacy personnel, who support our cybersecurity risk assessment processes, our security controls, and our response to cybersecurity incidents; • external service providers, where appropriate, to monitor, assess, test, or otherwise assist with aspects of our security controls, and to support risk mitigation efforts; • training for our employees on cybersecurity awareness and the importance of protecting information assets. • periodic reviews of key cybersecurity policies, and updating as needed; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents. • a third-party risk management platform is being used to govern and mitigate the potential risks, including a comprehensive process for service providers, suppliers, and vendors.

companyName: Cardio Diagnostics Holdings, Inc.

ticker: CDIO


text: Risks from cybersecurity threats are among those that we address in the Company's general risk management program. As part of our overall risk management processes, the Company maintains various policies related to information security, including an Incident Response Policy and a Cybersecurity Incident Reporting Policy. We identify cybersecurity threats as part of our risk management processes, including (depending on the environment or systems) through internal monitoring, monitoring the threat environment using manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting scans of the threat environments, evaluating our and our industry's risk profile, evaluating threats reported to us, conducting threat assessments for internal and external threats, and conducting vulnerability assessments to identify vulnerabilities. Our information technology team is responsible for identifying, assessing, and managing the Company's cybersecurity threats and risks under the oversight of our Chief Technology Officer. This team works with third parties from time to time to help identify, assess, and manage cybersecurity risks, including professional services firms and other vendors.

companyName: Dutch Bros Inc.

ticker: BROS


text: While the ONES Committee has primary committee responsibility for cybersecurity due to the operational issues involved, the Board of Directors has determined that the topic is of sufficient importance to warrant this comprehensive oversight approach. Augmenting such oversight efforts, the Board of Directors conducts drills to practice its response in a possible emergency situation to ensure it is well prepared and positioned to perform in a possible crisis.

companyName: XCEL ENERGY INC

ticker: XEL


text: Internally, the CISO coordinates oversight of reviewing security alerts, identifying and monitoring ongoing and potential cybersecurity threats, evaluating strategic business impacts of cybersecurity threats and developing programs and initiatives to educate the Company's employees regarding cybersecurity. The CISO also manages the Company's Computer Security Incident Response Plan (the "Incident Response Plan"), which outlines action steps for the preparation, identification, triage, analysis, containment, eradication, recovery and reflection stages of a cybersecurity incident. The Incident Response Plan serves as the charter for the Company's Computer Security Incident Response Team (the "Incident Response Team"), which includes a strategic team comprised of executives from various cross-functional management teams, as well as a tactical team comprised of internal technical support roles and external third-party service providers. The Incident Response Plan provides how the Incident Response Team will analyze and, as necessary, escalate cybersecurity incidents both internally and with third-party service providers based on type and severity of the specific incident.

companyName: MOHAWK INDUSTRIES INC

ticker: MHK


text: As part of preparatory and post-closing integration activities in connection with merger and acquisition activity, the Company: (i) conducts a cybersecurity risk threat assessment and when evidence of a breach is uncovered, conducts additional due diligence; (ii) based on the assessment, the Company develops and implements risk mitigation plans if needed and brings the acquisition under the Company's cyber-attack/breach detection and response programs; and (iii) conducts an internal controls risk and compliance assessment and creates, as needed, responsive action plans intended to mitigate and remediate identified weaknesses in the control environment.

companyName: DuPont de Nemours, Inc.

ticker: DD


text: The Board of Directors oversees Management's processes for identifying and mitigating risks, including cybersecurity risks, and to support alignment of our risk exposure with our strategic objectives. Senior leadership, including our Vice President – IT Operations and Chief Information Security Officer (CISO), regularly briefs the Board of Directors on our cybersecurity and information security posture and the Board of Directors is apprised of cybersecurity incidents deemed to have a moderate or higher business impact, even if immaterial to us. In the event of an incident, we intend to follow our incident response protocol, which outlines the steps to be followed from incident detection to mitigation, recovery and notification, including notifying functional areas (e.g., legal), as well as senior leadership and the Board of Directors, as appropriate.

companyName: PATRICK INDUSTRIES INC

ticker: PATK


text: We have an established process led by our Chief Information Officer ("CIO") that governs how we assess, respond and report, internally and externally, the occurrence of cybersecurity incidents and threats. Typical incidents and threats are cataloged and reported to the CIO on a weekly basis together with details regarding the mitigation actions implemented as well as other possible mitigation actions that could be implemented to mitigate or prevent future similar incidents. Urgent or severe incidents are reported to the CIO immediately where triage then begins and does not end until the threat has been mitigated. Depending on the nature and severity of an incident, our process provides for escalating notification to our CEO and the Board including the Chairman of the Board, our Lead Independent Director and the Audit Committee chair. Otherwise, the Audit Committee receives quarterly reports that summarize the new threats identified over the quarter as well as threats that were mitigated over the quarter, with details on the quantity, severity, and addressability of the incidents.

companyName: United Parks & Resorts Inc.

ticker: PRKS


text: We rely on a multidisciplinary team, including our information technology ("IT") department, management, and third-party service providers to identify, assess, and manage cybersecurity threats and risks. Our information security program utilizes various security tools and strategies, including risk assessments, incident detection and response, vulnerability management, disaster recovery and business continuity plans, internal controls within our accounting and financial reporting functions, encryption of data, network security controls, access controls, physical security, asset management, systems monitoring, and employee training. We also work with third parties that assist us to identify, assess, and manage cybersecurity risks, including professional services firms, consulting firms, and threat intelligence service providers.

companyName: Ascend Wellness Holdings, Inc.

ticker: AAWH


text: The Audit Committee is integral to overseeing the Company's overall risk management strategies, including cybersecurity risks and disclosures. To keep the Audit Committee informed, the Chief Audit Executive maintains a direct and open communication channel with the Audit Committee. Regular meetings are held for the Chief Audit Executive to report to the Audit Committee. These include an enterprise-wide risk assessment that highlights cybersecurity risks and cybersecurity risk mitigation actions. Additionally, the Audit Committee receives updates on significant incidents and cybersecurity risks that have been presented to or discussed with the Enterprise Risk and Compliance Committee.

companyName: T-Mobile US, Inc.

ticker: TMUS


text: We have elected to outsource our information technology function to a third-party managed service provider, ("MSP") that specializes in fully managed information technology services and fully managed cybersecurity. The MSP is responsible for managing all of our hosted services, all of the computer and computer-related hardware and software we use, and all onsite and offsite backups. The MSP also provides managed security services designed to prevent cybersecurity threats, to identify and remediate vulnerabilities, to monitor systems 24/7, to protect data and systems, to detect potential intrusions and cybersecurity incidents, to quarantine systems should they be compromised, and to recover from business interruptions or other disasters. The MSP follows the NIST Cybersecurity Framework, developed by the National Institute of Standards and Technology of the U.S. Department of Commerce, to measure the maturity of the services it provides to us and its other clients.

companyName: Pebblebrook Hotel Trust

ticker: PEB


text: Our Director of Information Technology, who reports directly to our Chief Financial Officer, is responsible for the day-to-day management of our cybersecurity risk management processes. The Director of Information Technology role is currently held by an individual who has thirty years of information technology and cybersecurity experience.

companyName: Societal CDMO, Inc.


text: The Board of Directors is charged with overseeing the establishment and execution of the Bank's risk management framework and monitoring adherence to related policies required by applicable regulations and statutes. Consistent with this responsibility, the Board may delegate some responsibilities to the Audit Committee. The CISO holds the primary day-to-day responsibility for the strategic, operational, and risk management components of cybersecurity. The Audit Committee, and the board through summary reports, receives updates on cybersecurity risks and incidents and the cybersecurity program through direct communication with the CISO. Additionally, awareness and training on cybersecurity topics is provided to the Board at least annually.

companyName: GUARANTY BANCSHARES INC /TX/


text: Our cybersecurity risk management program is integrated with our overall enterprise risk management program, and shares common methodologies, reporting channels, and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.

companyName: SLM Corp

ticker: SLM


text: The Information Security Steering Committee ("ISSC"), appointed by the Board, bears the responsibility for cybersecurity risk management and strategy. It aids the Board in fulfilling its oversight duties related to IT security, aligning with the Bank's business strategy, and adhering to regulatory requirements. The Virtual Chief Information Security Officer ("vCISO"), who is also appointed by the Board, oversees the ISP and coordinates the ISSC.

companyName: Sound Financial Bancorp, Inc.

ticker: SFBC


text: We regularly collaborate with the Company's internal audit department and third parties with security and infrastructure expertise for review and evaluation of the Company's cybersecurity risk program and the associated IT control environment. We engage third-party service providers to perform annual external and internal penetration testing, disaster recovery testing, and security incident simulations.

companyName: Texas Pacific Land Corp

ticker: TPL


text: Our cybersecurity incident response and vulnerability management processes are designed to escalate certain cybersecurity incidents and vulnerabilities to members of management depending on the circumstances, including work with the company's incident response team to help the company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the company's incident response processes include reporting to the Board of Directors for certain cybersecurity incidents.

companyName: Leatt Corp

ticker: LEAT


text: The Audit and Risk Committee of the Board of Directors is primarily responsible for the oversight of risks from cybersecurity threats, and is regularly briefed on the Company's Cybersecurity Program by the Vice President of Information Technology and/or Director of IT Security, Risk and Compliance. These briefs include updates on the Company's cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging cybersecurity threat landscape.

companyName: Bioventus Inc.

ticker: BVS


text: We conduct a regular cybersecurity risk assessment process through our Chief Technology Officer and dedicated information security team which reports to our management-level information technology steering committee, which is a subset of our management-level enterprise risk committee. These committees meet at least quarterly to discuss and evaluate risks that could be material to our business, including cybersecurity threats. This management-level enterprise risk committee is comprised of key leadership across the Company, including our Chief Executive Officer, Chief Financial Officer, Chief Underwriting Officer, President & Chief Fiduciary Officer, and General Counsel.

companyName: Beneficient

ticker: BENF


text: Our management recognizes the impact that cybersecurity threats could have on our business operations, our compliance with regulations and our reputation. We have identified cybersecurity as a critical business risk as part of our overall risk management strategy, which our board of directors oversees.

companyName: ORAGENICS INC

ticker: OGEN


text: Scanning and assessing vulnerabilities arising from software and hardware on our network infrastructure, ATMs, software applications, computers, copiers and other electronic assets to ensure that vulnerabilities are identified and resolved timely;

companyName: INTERNATIONAL BANCSHARES CORP

ticker: IBOC


text: Despite our efforts and the efforts of our third-party service providers to secure our and their IT systems, cybersecurity attacks and incidents have occurred in the past, and may continue to occur in the future. For additional information regarding the risks we face from cybersecurity and privacy incidents, see Item 1A "Risk Factors—Risks Related to Information Technology and Data Security—Privacy breaches and other cyber security risks related to our business could negatively affect our reputation, credibility and business."

companyName: Capri Holdings Ltd

ticker: CPRI


text: To date, we have not identified risks from cybersecurity threats or incidents, including as a result of any previous cybersecurity incidents, that have materially affected the Company or are reasonably likely to materially affect our operations, business strategy, results of operations, of financial condition. However, the sophistication of and risks from cybersecurity threats and incidents continues to increase, and there can be no assurance that our cybersecurity risk management program and processes, including our IRP, and other preventative actions the Company has taken and continues to take to reduce the risk of cybersecurity threats and incidents and protect its systems and information, will be fully implemented, complied with or successful in protecting against all cybersecurity threats and incidents. For more information on how cybersecurity risk could materially affect the Company's business strategy, results of operations, or financial condition, please refer to "Item 1A Risk Factors—Risks Related to our Business and Industry—We rely significantly on the use of information technology, as well as those of our third-party service providers. Any significant failure, inadequacy, interruption or data security incident of our information technology systems, or those of our third-party service providers, could disrupt our business operations, which could have a material adverse effect on our business, prospects, results of operations, financial condition and/or cash flows."

companyName: Solo Brands, Inc.

ticker: SBDS


text: The Company has adopted the Factor Analysis for Information Risk (FAIR) assessment approach, an industry standard risk assessment methodology. Under the FAIR approach, the Company identifies, catalogs, assesses and manages material cyber risks by: (a) documenting threat actors and organizations (i.e., cybercriminals, nation state actors, hackers, company insiders), (b) analyzing their likelihood of attack, their motives, capabilities and tactics; (c) assessing the potential impacts of such threat actor attacks against company assets, and documented vulnerabilities (or cyber exposures), both internally and externally of the organization; and (d) evaluating the implemented security controls and effectiveness of those controls against defined risk scenarios. The Company rates vulnerabilities based on the criticality of a vulnerability and/or the value of the asset associated with the vulnerability (for example, people, systems, customer data, or money). When a residual risk exceeds the desired threshold set by the Board-defined risk appetite of the organization, additional controls are recommended and implemented to reduce the potential risk to an acceptable level and provide appropriate management of the cyber risk exposure.

companyName: TOMPKINS FINANCIAL CORP

ticker: TMP


text: To date, risks from cybersecurity threats or incidents have not materially affected the Company. However, the sophistication of and risks from cybersecurity threats and incidents continues to increase, and the preventative actions we have taken and continue to take to reduce these risks and protect our systems and information may not successfully protect against all cybersecurity threats and incidents. For more information on how cybersecurity risk could materially affect our business strategy, results of operations, or financial condition, please refer to Item 1A Risk Factors.

companyName: HAVERTY FURNITURE COMPANIES INC

ticker: HVT


text: As of the date of this Form 10-K, we are not aware of cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including our business, strategy, results of operations, or financial condition at this time. For further discussion of the risks associated with cybersecurity incidents, see Part I, Item 1A of this Form 10-K under the risk factor entitled.

companyName: I-ON Digital Corp.

ticker: IONI


text: We have established policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats. We have devoted substantial financial and personnel resources to implement and maintain security measures to meet regulatory requirements, and we intend to continue to make significant investments to maintain the security of our data and cybersecurity infrastructure. Despite these efforts, our policies and procedures may not be properly followed in every instance and may not always be effective. Our risk factors, which can found be found in Part I, Item 1A. "Risk Factors," include further detail about the material cybersecurity risks we face. We have had no cybersecurity incidents or other risks from cybersecurity threats to date that have materially affected, or are reasonably likely to materially affect, us, including our business strategy, results of operations, or financial condition.


text: Under our global incident response process, cybersecurity incidents are assessed and classified by severity, and significant incidents are escalated as appropriate to senior executive leadership. In addition, we have a process to promptly notify the Board of Directors, as appropriate, in the event of any cybersecurity incident impacting the Company that may be material.

companyName: Kyndryl Holdings, Inc.

ticker: KD


text: Our Chief Technical Officer is responsible for the management of the Company's information systems and oversees the Company's information technology team ("IT Team"). The IT Team has in place documented procedures for cybersecurity response plans, which are reviewed annually or as events warrant. The IT Team utilizes third party security experts to provide continuous external penetration testing, conduct security reviews, and to provide a managed security operations center that does 24/7 monitoring as well as provide additional resources for threat and incident response activities.

companyName: GIVBUX, INC.

ticker: GBUX


text: The Board and the information technology and security committee directed the formation of a cross-functional cybersecurity council at the Company, and receive regular cybersecurity reports from the global CIO, the corporate CIO and the chief information security officer (CISO), among others. These reports include updates on the Company's cybersecurity strategy and execution of its processes, including updates on procedures to prepare for, prevent, detect, respond to and recover from (as applicable) cyber incidents. Such updates also include updates on the Company's continued compliance with regulatory requirements. The Company's information security and risk management program is periodically evaluated by third-party specialists, and the results of those reviews are reported to the Board.

companyName: CORPAY, INC.

ticker: CPAY


text: Our vCISO has substantial relevant expertise and formal training in the areas of information security and cybersecurity risk management and is accountable for managing our enterprise information security department and developing and implementing our information security program. The responsibilities include cybersecurity risk assessment, defense operations, incident response, vulnerability assessment, threat intelligence, identity access governance, third-party risk management, client, vendor and employee education and awareness, and business continuity and disaster recovery.


text: the use of external service providers, where appropriate, to assess risk, monitor alerts, perform penetration testing or otherwise assist with aspects of our security controls and response to cybersecurity incidents; and a documented framework and supporting processes for handling security incidents that facilitates coordination across multiple parts of the Company.

companyName: AMPHENOL CORP /DE/

ticker: APH


text: We view cybersecurity as a shared responsibility. In an effort to detect and defend against cyber threats, the Company provides its employee-partners with various cybersecurity and data protection training programs and requires annual security awareness training participation. These programs cover timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, asset use and mobile security, and these programs educate employee-partners on the importance of reporting all incidents promptly to the IT security team. We also require employee-partners in certain roles to complete additional role-based, specialized cybersecurity trainings.

companyName: CINTAS CORP

ticker: CTAS


text: Our Chief Technology Officer ("CTO"), as well as the security operations, engineering, risk management and legal functions help identify, assess and manage the Company's cybersecurity threats and risks. Our security operations team monitors and identifies potentially material cybersecurity threats and risks, and implements and maintains the Company's incident management policies and plans. Our security operations team leads our efforts to identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example, subscribing to reports and services that identify cybersecurity threats, monitoring incident notifications from stakeholders, conducting threat assessments, managing software vulnerabilities and patches, conducting tabletop incident response exercises, and, in connection with our legal function, coordinating with law enforcement concerning threats.

companyName: Sweetgreen, Inc.

ticker: SG


text: The Company is committed to protecting the security and integrity of our systems, networks, databases and applications and, as a result, has implemented processes designed to prevent, assess, identify, and manage material risks associated with cybersecurity threats.

companyName: Liberty TripAdvisor Holdings, Inc.


text: Cytokinetics recognizes the critical importance of developing, implementing, and maintaining cybersecurity measures designed to safeguard our information systems and protect the confidentiality, integrity, and availability of our critical data.

companyName: CYTOKINETICS INC

ticker: CYTK