text: Subject to oversight by our Board of Directors and Audit Committee, as described above, our Chief Digital and Information Officer is responsible for developing and guiding our global information technology and digital strategy, which includes overseeing cybersecurity risk management. The Chief Digital and Information Officer provides guidance on cybersecurity strategy initiatives and risk mitigation activities to the Senior Director, Global Information Security and the associated function. Our Chief Digital and Information Officer and our Senior Director, Global Information Security provide regular reports on security incident activity, including containment and remediation measures as relevant, and other cybersecurity risk management matters to the Board of Directors and the Audit Committee.

companyName: Ingredion Inc

ticker: INGR


text: The Cybersecurity Committee, which originated in 2015 as a dedicated cybersecurity subcommittee of the Audit Committee, was made a formal committee of the Board in 2022. The Cybersecurity Committee assists the Board in its oversight of the Company's cybersecurity programs and risks. Its responsibilities include reviewing the state of the Company's cybersecurity, its strategy, policies, and procedures to mitigate cybersecurity risks, and any significant cybersecurity incidents. The Committee also considers the cybersecurity threat landscape and the impact of emerging cybersecurity developments and regulations that may affect Howmet. The Cybersecurity Committee currently comprises three members and meets at least quarterly with members of management, including the CISO and CIO. The Cybersecurity Committee may, from time to time, invite third-party advisors and experts as it deems appropriate. Pursuant to guidelines adopted by the Cybersecurity Committee, management is required to report immediately to the Chair of the Cybersecurity Committee upon the occurrence of certain cybersecurity incidents and ransomware demands. The Cybersecurity Committee reports to the full Board after each of its meetings and as needed regarding the cybersecurity risks, incidents, and other matters reviewed and considered by the Committee. The Company's CISO leads management's assessment, prevention, and management of cybersecurity risks. The CISO reports to the CIO who has responsibility for the usability, implementation, and management of our information and computing systems. Both bring to their roles extensive experience in information technology and cybersecurity: • The Company's CISO joined the Company in 2022. The CISO has over 20 years of experience in information technology, cybersecurity and physical security management, including as Cybersecurity Operations Director at United States Steel Corporation (2020-2022); Director, Global Information Security and Compliance at Kennametal, Inc. (2018-2020); and Global Chief Information Security Officer/HIPAA Security Officer at Westlake Chemical (2013-2017). The CISO holds a Bachelor of Sciences degree in Information Systems Management from Carlow University and a Master of Sciences degree in Information Systems from Robert Morris University and is a Certified Systems Security Professional. • The Company's CIO joined the Company in 2021. The CIO has over 20 years of experience in information technology, including, most recently, as Vice President Global IT and Chief Information Officer at Varroc Lighting Systems (2018-2021) and Chief Information Officer at AM General LLC (2016-2018). The CIO holds a Bachelor of Engineering degree in Industrial Engineering from Universidad de Lima.

companyName: Howmet Aerospace Inc.

ticker: HWM

secItem: Item 1C


text: In addition, the MSP performs facility and system penetration tests, compromise assessments and security maturity assessments of our corporate and operational networks. In collaboration with the MSP, we maintain a comprehensive cybersecurity training program to help our personnel identify and assist in mitigating cybersecurity risks. Our executive officers and employees participate in annual training with additional issue-specific training as needed.

companyName: Pebblebrook Hotel Trust

ticker: PEB


text: The Audit & Risk Management Committee is central to the Board's oversight of cybersecurity risks and bears the primary responsibility for this domain. The Audit & Risk Management Committee is composed of board members with diverse expertise including risk management, technology, and finance, equipping them to oversee cybersecurity risks effectively.

companyName: Neuphoria Therapeutics Inc.

ticker: NEUP


text: Managing Material Risks & Integrated Risk Management Planet Fitness has strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. Our risk management team works closely with our information technology ("IT") department to evaluate and address cybersecurity risks in alignment with our business objectives and operational needs. These risks are captured and prioritized in a risk register.

companyName: Planet Fitness, Inc.

ticker: PLNT


text: Risk Management and Strategy Identifying, assessing and managing cybersecurity risks is an important component of White Mountains's overall enterprise risk management program. As with the management of risks generally, given our holding company structure, the management of cybersecurity risks involves coordination between the Company and its consolidated subsidiaries/affiliates.

companyName: WHITE MOUNTAINS INSURANCE GROUP LTD

ticker: WTM


text: We have developed policies and procedures with regard to cyber incident responses which policies and procedures are based on key components of the National Institute of Standards and Technology Cybersecurity Framework, together with other best practices. Since completion of the Separation and the Distribution, we have not had any risks of cybersecurity threats or cybersecurity incidents that have materially affected or, to our knowledge, are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. However, if such a material cybersecurity incident is identified or were to occur, Company management would report it to the Board of Directors immediately.

companyName: Orion Properties Inc.

ticker: ONL


text: Management uses third party consultants, as necessary, to assist in assessing, identifying and managing risks from cybersecurity threats. Annually, senior management participates in tabletop exercises to assess its readiness responding to cybersecurity incidents. Our cybersecurity team routinely challenges our employees and the effectiveness of existing controls.

companyName: STEWART INFORMATION SERVICES CORP

ticker: STC


text: In addition, the Board will oversee any cybersecurity risk management framework and a dedicated committee of the Board or an officer appointed by the Board will review and approve any cybersecurity policies, strategies and risk management practices. The Board (or designated committee or officer) will receive periodic updates on cybersecurity risks, including emerging threats, mitigation efforts and incident response activities. The updates will be provided at least annually, or more frequently as needed, to ensure cybersecurity risks are appropriately managed and integrated into our broader risk oversight strategy.

companyName: 60 DEGREES PHARMACEUTICALS, INC.

ticker: SXTP


text: Our information security organization, led by our Chief Information Officer (our "CIO") who reports to our Chief Financial Officer (our "CFO"), is comprised of both I.T. security leadership and dedicated Cybersecurity staff. The information security organization has extensive technology security and program management experience including cybersecurity professional certifications such as Certified Information Systems Security Professional ("CISSP"), advanced degrees in Information Assurance, and numerous years' experience assessing and managing cybersecurity risk within the Department of Defense and other public companies. Our CIO has over 25 years of technology experience, including leading information governance, I.T. security, and cybersecurity teams and initiatives across both publicly traded companies and global organizations.

companyName: Freshpet, Inc.

ticker: FRPT


text: The ISO leads program development, implementation, and reporting to the Board. The ISO possesses extensive experience with over 25 years of securing information systems and data, and holds many industry certifications including Microsoft Certified Software Engineer + Security, Exchange Security, Comptia Security+, Pentest+, Cyber Security Analyst(CYSA+), Cisco Certified Network Admin + Security enhancement, Cisco Certified Design architect and Certified Ethical Hacker. Recognizing cybersecurity as a shared responsibility, the Company conducts periodic management-level simulations and tabletop exercises with external resources and advisors as needed.

companyName: California BanCorp \ CA

ticker: BCAL


text: Material Cybersecurity Threat Risks The Company has not experienced any material losses relating to cybersecurity threats or incidents for the year ended September 30, 2025. We are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. Although we have a robust cybersecurity program that is designed to assess, identify, and manage material risks from cybersecurity threats, we cannot provide absolute surety that we have properly identified or mitigated all vulnerabilities or risks of incidents. The Company, and the third parties that the Company engages, are subject to constant and evolving threats of attack and cybersecurity incidents may be more difficult to detect for periods of time. A cybersecurity incident could harm our business strategy, results of operations, financial condition, reputation, and/or subject us to regulatory actions or litigation which may result in fines, judgments or indictments.

companyName: Gouverneur Bancorp, Inc./MD/

ticker: GOVB


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including those in our supply chain or who have access to our customer and employee data or our systems. Third-party risks are included within our enterprise risk management program, as well as our cybersecurity-specific risk identification program, both of which are discussed above. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers.

companyName: ALPHA PRO TECH LTD

ticker: APT


text: The Company's cybersecurity program includes a focus on governance, processes, technology, and people. Components of the program include the following: • Investments in security technology, such as vulnerability management tools, malicious software protection, email security, and around-the-clock monitoring; • Regular monitoring and updating of the Company's IT infrastructure, to respond to the dynamic cybersecurity threat environment; • Use of third parties to assess, test, validate, and strengthen the cybersecurity program, including penetration testing and the periodic use of a third party to assess the quality and maturity of the program against the NIST Cybersecurity Framework; and • Assessing and managing cybersecurity risks associated with the Company's relationships with third parties, including technology and service providers, through due diligence efforts and the imposition of contractual obligations.

companyName: HORMEL FOODS CORP /DE/

ticker: HRL


text: We also maintain specific coverage to mitigate losses associated with certain cybersecurity incidents. To date, we have not experienced any material cybersecurity incidents or threats. While we maintain a robust cybersecurity program, the techniques used to infiltrate information technology systems continue to evolve. Accordingly, we may not be able to timely detect threats or anticipate and implement adequate security measures. For additional information, see "Item 1A—Risk Factors.

companyName: MARINUS PHARMACEUTICALS, INC.


text: Integration with Overall Risk Management. Cybersecurity is a major component of our overall risk management approach. The Company's cybersecurity risk management program is integrated into our overall enterprise risk management processes. This integration helps ensure that cybersecurity considerations are an integral part of our decision-making processes across the organization. Our risk management team works closely with our Information Security and Information Technology departments to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.

companyName: PACIFIC PREMIER BANCORP INC


text: ISG maintains a cyber risk management program designed to identify, assess, manage, mitigate and respond to cybersecurity threats. This program is integrated within the Company's enterprise risk management system and addresses both the corporate information technology environment and the Company's client-facing products. We regularly assess the threat landscape, taking a holistic view of cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K.

companyName: Information Services Group Inc.

ticker: III


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example professional services firms, including legal counsel and cybersecurity software providers.

companyName: Gamida Cell Ltd.


text: The team is responsible for the following: • Implementing Enterprise-wide cybersecurity strategy • Developing and enforcing Cybersecurity Policy • Developing and enforcing Cybersecurity Standards • Approving and reviewing Cybersecurity Architecture • Developing and enforcing Cybersecurity Processes • Developing and testing Cybersecurity Incident response • Performing other Cybersecurity operational activities including but not limited to: Vulnerability management strategy

companyName: EDGEWELL PERSONAL CARE Co

ticker: EPC


text: The Information Technology Department is primarily responsible for identifying, assessing, and managing material risks from cybersecurity threats. The Information Technology Department is managed by the IT Manager who reports directly to the Executive Vice President/Chief Operations Officer (COO). The IT Manager has more than seven years of experience with the company and additional years of experience in the information technology ("IT") field. The IT Manager is assisted in overseeing Information Technology by an IT Managed Service Provider firm. The IT Manager and COO oversee the information security program, which is governed by various information security and cybersecurity, systems development, change control, disaster recovery/business continuity and physical asset classification and control policies. The Information Security & Network System Policy identifies data sources, threats and vulnerabilities and ensures awareness, accountability, and oversight for data protection throughout the company and with trusted third parties to ensure that data is protected and able to be recovered in the event of a breach or failure (technical or other disaster).

companyName: Central Plains Bancshares, Inc.

ticker: CPBI


text: At the management level, a management steering committee comprised of our Chief Financial Officer, Controller, and General Counsel is briefed quarterly by our Director of Information Security. Our Director of Information Security also prepares a quarterly Information Security Risk Report, which is provided to the management steering committee in advance of its quarterly meeting and also made available to the members of the Audit Committee. Our current Director of Information Security has 16 years of industry experience leading large-scale security initiatives, enhancing infrastructure defenses and instilling a culture of security awareness across all employee levels. Additionally, our Director of Information Security holds standard industry security certifications, including CISSP (Certified Information Systems Security Professional).

companyName: Bark, Inc.

ticker: BARK


text: The goal is to maintain business continuity, protect proprietary technology, and safeguard customer and employee data in the event of a cyber incident.

companyName: FARADAY FUTURE INTELLIGENT ELECTRIC INC.

ticker: FFAI


text: Procedures Governing our Corporate Account Takeover Responses. Like our approaches to responding to cybersecurity incidents and managing our Vendor relationships, our strategy for managing corporate account takeover (CATO) threats integrates organizational operations at multiple governance levels involving our Board, executive management team, members of our Senior Management of Electronic Banking Services (EBS Management Team), an Electronic Banking Services Manager (EBS Manager), and our CISO. Our Board reviews our CATO Policy for compliance with the Texas Department of Banking standards for the risk management of CATOs and charges our EBS Management Team with the responsibility of determining necessary courses of action to ensure adherence to applicable guidance and regulations. Our EBS Management Team also ensures that our CATO Policy is understood and complied with across all of our operational divisions. Some of the responsibilities of our EBS Manager include developing, implementing, and maintaining policies and procedures to comply with our CATO Policy, coordinating the performance of period risk assessments of IBC Link, our online banking product, establishing trainings for IBC Link customers regarding security controls that mitigate CATO risks, reporting CATO incidents to executive management, and coordinating with our management team and IBC Link customers if an actual or threatened CATO attack is identified. Our CISO is responsible for ensuring appropriate security controls are implemented to prevent, detect, and respond to CATOs, establishing incident-response procedures to be employed if a CATO threat is in progress, and timely notifying our primary federal regulator of any CATO incidents that are required to be disclosed to comply with applicable laws, regulations, and CATO Policy procedures.

companyName: INTERNATIONAL BANCSHARES CORP

ticker: IBOC


text: Security and data privacy awareness and training is provided to new employees and annually for current Aptar employees, which is designed to educate employees on recognizing information security and cybersecurity concerns, how they can help protect the organization and how to inform the cybersecurity team of potential incidents. In addition, Aptar implements stringent processes to oversee and manage risks associated with our third-party providers. As set forth in our Sustainable Purchasing Charter, third-party providers are expected to, among other things, protect personal data and implement security and protection measures in relation thereto. We conduct security assessments of third-party providers before engagement and monitor their compliance with our cybersecurity standards on an ongoing basis. The monitoring includes periodic and ongoing assessments by our Information Security Department. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third parties. In addition, we maintain cybersecurity insurance as part of our overall insurance portfolio.

companyName: APTARGROUP, INC.

ticker: ATR


text: The Company's system of internal controls also incorporates a protocol for the appropriate reporting and escalation of information and cyber security matters to management and the Board of Directors for resolution and, if necessary, disclosure of any material incidents. The Board of Directors is actively engaged in the oversight of the Company's continuous efforts to reinforce and enhance its operational resilience and receives education to enhance their oversight efforts to accommodate for the ever-evolving information and cyber security threat landscape. The Information Security Officer ("ISO") regularly updates these committees on the information and cyber security risks, threats, exposures, and mitigation measures. The Company's incident response process is periodically tested and includes cybersecurity scenarios.

companyName: Texas Community Bancshares, Inc.

ticker: TCBS


text: Additionally, FirstEnergy leverages third-party security firms in various capacities to assist with various aspects of FirstEnergy's cyber security program, including risk assessments, vulnerability scans, and penetration testing. FirstEnergy uses a variety of processes to address cyber security threats related to the use of third-party technology and services, such as reviewing independent assessments of the third party's cyber/information security controls, such as Systems and Organization Controls 2 audits or other standards-based assessments, where appropriate. As part of FirstEnergy's process to continuously improve its cyber and information security programs, FirstEnergy also engages third-party subject matter experts to assess and evaluate the effectiveness of various aspects of such programs. In addition to the aforementioned efforts, FirstEnergy also strongly considers cyber security risks as a part of its overall strategy and invests heavily in sophisticated and layered security measures that use both technology and hard defenses to protect critical transmission facilities and its digital communications networks. For example, security enhancements to FirstEnergy's transmission infrastructure, such as enhanced cyber security monitoring and alarming are a key component of FirstEnergy's transmission investment program.

companyName: FIRSTENERGY CORP

ticker: FE


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program and utilizes common reporting channels and governance processes that apply across other risk areas. While everyone at our company plays a part in managing cybersecurity risks, as discussed in more detail under "Cybersecurity Governance" below, our board of directors, both directly and through delegation to our Audit Committee (the "Audit Committee"), and our senior management team are actively involved in the oversight of our cybersecurity risk management program. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach by engaging teams across the business. We expect these teams to operate pursuant to our Standard Operating Procedures. Our approach is focused on preserving the confidentiality, integrity, and availability of the information that we collect and store by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur through shared processes.

companyName: DOCUSIGN, INC.

ticker: DOCU


text: h. Identify and analyze significant changes affecting information security risk management such as changes in the external environment, business model and leadership.

companyName: COMMERCE BANCSHARES INC /MO/

ticker: CBSH


text: Monitor Cybersecurity Incidents The DIT is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. The DIT, along with his staff and third party consultants, implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the DIT is equipped with a well-defined incident response plan. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.

companyName: HMN FINANCIAL INC


text: We describe whether and how risks from identified cybersecurity threats have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the headings "If we, our third-party vendors, our regulators or any other quasi-governmental organization we are required to report information to are subject to cyberattacks, data breaches or other security incidents, or if there is a disruption or failure of our information technology systems or software, such events could expose us to liability and could adversely affect our financial condition and operating results," "The personal information that we collect may be vulnerable to breach, theft or loss which could adversely affect our reputation, operations and ability to attract and retain students," and "Our remote work environment may exacerbate the risks related to our business technology infrastructure," included as part of our risk factor disclosures within Item 1A of this Annual Report on Form 10-K. We have not encountered risks from cybersecurity threats, including as a result of any previous cybersecurity incidents in the last three fiscal years, which have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition, and the expense we have incurred from cybersecurity incidents were immaterial.

companyName: PERDOCEO EDUCATION Corp

ticker: PRDO


text: Our Cybersecurity Risk Management program is an integrated component of the Enterprise Risk Management strategy intended to protect the confidentiality, integrity and availability of our critical systems and information.

companyName: Northfield Bancorp, Inc.

ticker: NFBK


text: In conjunction with the FAIR assessment, the Company uses the MITRE Attack framework to identify the various exploitation techniques and tactics used by the most likely threat actors. This framework informs the risk management process with valuable insight into some of the most common, or likely, cyber-attacks the Company should address.

companyName: TOMPKINS FINANCIAL CORP

ticker: TMP


text: In addition, our information technology team conducts routine security assessments as well as ongoing cybersecurity training campaigns for employees to enhance awareness and increase vigilance for the various types of cybersecurity attacks to which they may be exposed. Our internal audit team evaluates and monitors our internal controls over systems access in an effort to mitigate information security risks that may result from unauthorized access to systems and data.

companyName: W. P. Carey Inc.

ticker: WPC


text: We recognize the critical importance of developing, implementing, and maintaining cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of data we produce and collect.

companyName: Planet 13 Holdings Inc.

ticker: PLNH


text: The Company has an internal cybersecurity team that is responsible for conducting regular assessments of its information systems, existing controls, vulnerabilities and potential improvements.

companyName: ALERUS FINANCIAL CORP

ticker: ALRS


text: Additionally, the company uses third-party service providers, or vendors, in the course of conducting its operations. As such, the company has measures in place to help identify material risks from cybersecurity threats associated with the use of those vendors. When work with a vendor is evaluated, we consider, among other items, the availability of system and organization controls reports, interactions with our systems, the data involved and its level of sensitivity, the amount of data the vendor will process, where the data will be stored, what they will do with the data and destruction of data. Once a vendor is approved by the appropriate personnel, expectations regarding incident reporting are established and followed.

companyName: CINCINNATI FINANCIAL CORP

ticker: CINF


text: We maintain an information security program (the "Program") to help manage material risks and cybersecurity threats to our business, operations and assets. As part of our Program, we maintain policies, procedures and standards that outline the Company's expectations, guidelines and structured approach to managing cybersecurity risks. We leverage established security frameworks, such as the National Institute of Standards and Technology Cybersecurity Framework, as guides to organize, assess and improve our Program. In addition, our employees are required to complete a cybersecurity and privacy training program each year, which is supplemented with additional awareness efforts, including phishing campaigns and informational articles.

companyName: LPL Financial Holdings Inc.

ticker: LPLA


text: Our technology committee receives periodic reports from the CTO concerning our significant cybersecurity threats and risk and the processes we have implemented to address them. Our board of directors, our Audit Committee and our technology committees also have access to certain reports or presentations related to cybersecurity threats, risk and mitigation.

companyName: WM TECHNOLOGY, INC.

ticker: MAPS


text: Understanding the importance of cybersecurity, the Board maintains oversight of the cybersecurity risks and threats within the organization. Specifically, the Board has delegated authority to the Audit Committee to oversee risk management relating to cybersecurity. The Audit Committee is composed of members with various expertise including risk management, technology, and finance.

companyName: CROSS COUNTRY HEALTHCARE INC

ticker: CCRN


text: To date we have not experienced any cybersecurity threats and any risks from cybersecurity threats have not materially affected, and are not reasonably likely to materially affect, our business strategy, results of operations, or financial condition.

companyName: GeoSolar Technologies, Inc.


text: We have policies and procedures for identifying, assessing, and managing material risks associated with cybersecurity threats. We seek to address cybersecurity risks through a comprehensive approach focused on preserving the confidentiality, security, and availability of the information that we collect and store by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. We implement and maintain technical and physical safeguards and other organizational measures, including, for example, the use of antivirus software, intrusion prevention and detection systems, virtual private networks, firewalls, email security, link protection, the regular deployment of updates and patches as they become available, a general policy against providing access to our network to any third party (with the exception of our third party information technology vendor), the use of a third party service to conduct mandatory online training for all employees regarding identifying and mitigating cybersecurity risks, regular phishing testing, regular penetration testing, regular reviews of access to systems and networks, and routine monitoring of compliance with our written information security plan. We also maintain cybersecurity insurance that provides for certain protection against potential losses arising from a cybersecurity incident.

companyName: HENNESSY ADVISORS INC

ticker: HNNA


text: As discussed in more detail under "Item 1C. Cybersecurity—Governance," the Board's oversight of cybersecurity risk management is supported by the Audit Committee of the Board (the "Audit Committee"), which regularly interacts with the Company's management team.

companyName: Chiron Real Estate Inc.

ticker: XRN


text: Our cybersecurity program is built upon internationally recognized frameworks and maps to standards published by The National Institute of Standards and Technology ("NIST CSF"), which develops cybersecurity standards, guidelines, best practices and other resources to meet the needs of U.S. industry, federal agencies and the broader public. Utilizing monitoring technologies in conjunction with a well-established framework of policies, procedures and controls, our processes provide us with the structure to detect and respond to cyber threats, thereby mitigating the risk of potential cybersecurity issues. In addition, we conduct reoccurring security awareness training, penetration tests, and vulnerability assessments to identify any potential threats or vulnerabilities in our systems. Our processes to assess, identify and manage material risks from cyber threats include the risks arising from threats associated with third party service providers, including cloud-based platforms.

companyName: Riley Exploration Permian, Inc.

ticker: REPX


text: We have implemented a cybersecurity program to assess, identify, mitigate and manage risks from cybersecurity threats that may result in material adverse effects on the confidentiality, integrity, and availability of our information systems. As part of this program, we have processes in place that include a variety of controls, systems, and technologies designed to prevent or mitigate data loss, theft, misuse, or other cybersecurity incidents affecting the data we collect, process, store, and transmit as part of our business. We conduct penetration testing and cybersecurity audits, and require all employees to undertake data protection and cybersecurity training on an annual basis. We also use systems and processes designed to oversee and identify risks associated with our use of third-party service providers, including with respect to the occurrence of a cybersecurity incident at a third-party service provider or that otherwise implicates a third-party technology or system we use. We contract cybersecurity specialists to review and implement controls and structural mechanisms in order to enhance our cybersecurity program, and protect against and detect cybersecurity threats.

companyName: GRAN TIERRA ENERGY INC.

ticker: GTE


text: The Board provides strategic oversight regarding cybersecurity risks and threats. The Board receives and reviews periodic reports from senior executives in the Advisor's Information Security Team and the Fund's management, including the Advisor's Chief Information Security Officer ("CISO") and members of the CISO's staff. These reports contain information about risks from cybersecurity threats, including the results of recent independent reviews of the cybersecurity program, summaries of recent cybersecurity threat intelligence assessments, progress on key initiatives and strategies, and updates on recent regulatory activities, including new regulations and examinations.

companyName: GUGGENHEIM CREDIT INCOME FUND


text: The Company's Board of Directors and subsidiary technology and trust companies' Boards of Directors monitor the Program including policies and practices. The Company's Risk Committee and technology company's Board of Directors oversees areas of operational risk such as information technology activities; risks associated with development, infrastructure, and cybersecurity; oversight of information security risk assessments, strategies, policies, and programs; and disaster recovery, business continuity, and incident response process. The CISO also provides periodic cybersecurity updates to the Audit Committee and the Audit Committee Chairman is member of the Risk Committee. The management-level Technology Risk Committee and Security Advisory Committee oversee management of the Program and related assessments. Operational committees that manage risks associated with cybersecurity are Change Control Committee and Patch Management Committee.

companyName: FIRST FINANCIAL BANKSHARES INC

ticker: FFIN


text: Our board of directors, in coordination with the Audit Committee, oversees our risk management program, including the management of risks associated with cybersecurity threats. Our board of directors and Audit Committee receive periodic updates on developments in our cybersecurity risk management practices, evolving standards, third-party vulnerability assessments, and information security issues. On an annual basis, our board of directors and the Audit Committee discuss our approach to overseeing cybersecurity threats with senior management, including our Chief Executive Officer ("CEO") and Chief Financial Officer ("CFO").

companyName: Eton Pharmaceuticals, Inc.

ticker: ETON


text: Our cybersecurity management process consists of utilizing a combination of employee education, preventative controls, detective controls, and periodic third-party cybersecurity testing. We have installed and utilize enterprise scale technology to support an appropriate cybersecurity posture including: endpoint detection and response, firewalls, security information and event management, email security, multifactor authentication, and vulnerability management. We receive cybersecurity related alerts from our membership in a number of industry groups. These alerts are evaluated and in the event an alert requires action within our environment, such actions are taken promptly. Our process and cybersecurity posture is refined based on the results of periodic third party cybersecurity assessments. We engage with the Cybersecurity and Infrastructure Security Agency through their cyber hygiene service offerings. Cybersecurity is addressed in IT's reports to the Corporate Automation Steering Committee, which consists of all Officers and the Director of Customer Service, as well as in IT's reports to the Board of Directors.

companyName: ARTESIAN RESOURCES CORP

ticker: ARTNA


text: We are committed to appropriate cybersecurity governance and oversight. Our board of directors oversees management's processes for identifying and mitigating risks, including cybersecurity and information security risks. As noted elsewhere in this report, we plan to establish a standing audit committee. Once we establish an audit committee, we anticipate that the audit committee will oversee risks related to cybersecurity and report to the full board regarding its activities, including those related to cybersecurity.

companyName: Cardiff Lexington Corp

ticker: CDIX


text: The Company has implemented and maintains a cybersecurity program governed by an information security team responsible for managing and directing strategy, policy, standards, architecture, controls, and processes. The cybersecurity program is underpinned by a cybersecurity risk management framework designed to identify and prioritize cybersecurity risks to the Company and is overseen by our Board of Directors.

companyName: LIVEPERSON INC

ticker: LPSN


text: The Company has established and maintains comprehensive incident response and recovery plans that address the response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis.


text: The Board and the Audit Committee receive updates from management at least annually on information security matters, including our cybersecurity risks. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.

companyName: iHeartMedia, Inc.

ticker: IHRT


text: The Company's IT services including, but not limited to, service desk support, endpoint management, network and server administration, cloud engineering, and cybersecurity and incident management, are provided by an IT team consisting of primarily third-party consultants who are employed on a contract basis with assistance from the Company's IT employees. Our IT team reports directly to the Company's Chief Technology Officer ("CTO") for executive oversight and accountability.

companyName: DYNEX CAPITAL INC

ticker: DX


text: The Audit Committee of our Board of Directors is responsible for oversight of our risk assessment, risk management and cybersecurity risks, and periodically updates our Board of Directors on such matters. Members of the Audit Committee engage in discussions with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.

companyName: NOCOPI TECHNOLOGIES INC/MD/

ticker: NNUP


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function and is responsible for overseeing our cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats.

companyName: Cytek Biosciences, Inc.

ticker: CTKB


text: Members of our senior management, including our Chief Executive Officer, Chief Financial Officer, and leaders from our legal and information technology functions, maintain responsibility for assessing and managing cybersecurity threats. This team has deep expertise in building and leading information systems and cybersecurity teams across a variety of institutions.

companyName: Prime Medicine, Inc.

ticker: PRME


text: Our Board is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board administers its cybersecurity risk oversight function directly as a whole, as well as through the Audit Committee.

companyName: PetVivo Holdings, Inc.

ticker: PETV


text: The information security team is responsible for, among other matters: • designing, implementing and periodically assessing our cybersecurity safeguards and related policies and procedures, including those pertaining to encryption standards, antivirus protection, remote access, multi-factor authentication, data classification, device management, and the use of the internet, social media, email and wireless devices; • monitoring current and emerging cybersecurity threats to which the business may become exposed; and • providing oversight of risks of cybersecurity threats associated with our use of third-party service providers, including reviewing such engagements when proposed in order to identify and assess risks potentially arising therefrom.

companyName: FiscalNote Holdings, Inc.

ticker: NOTE


text: Engagement of Third-party Support We engage third-party services to conduct evaluations of our security controls, whether through penetration testing, independent audits or consulting on best practices to address new challenges. These evaluations include testing both the design and operational effectiveness of security controls. We also share and receive threat intelligence with our defense industrial base peers, government agencies, information sharing and analysis centers and cybersecurity associations.

companyName: S&P Global Inc.

ticker: SPGI


text: Our cybersecurity risks are identified and addressed through a comprehensive, cross-functional approach. Key security, risk, and compliance stakeholders meet regularly to develop strategies for preserving the confidentiality, integrity and availability of Company and resident information, identifying, preventing and mitigating cybersecurity threats. We maintain controls and procedures that are designed to ensure prompt escalation of certain cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can be made by management and our board of directors in a timely manner.

companyName: Strategic Student & Senior Housing Trust, Inc.

ticker: STSR


text: Collaborative Approach: We employ a holistic, cross-functional strategy to identify, prevent, and mitigate cybersecurity threats. Our approach includes rapid escalation protocols for specific cybersecurity incidents, enabling timely decision-making on public disclosure and reporting by management.

companyName: WIDEPOINT CORP

ticker: WYY


text: Reporting to the Board of Directors The chief information officer regularly informs the chief financial officer and chief executive officer of all significant aspects related to cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential significant risks facing the Company. Furthermore, significant cybersecurity matters, and strategic risk management decisions are escalated to the Nominating and Corporate Governance Committee of our board of directors and, in certain cases, the board itself, ensuring that they have comprehensive oversight and can provide guidance on any potentially material cybersecurity incident.

companyName: Array Technologies, Inc.

ticker: ARRY


text: The cyber risk management program is overseen by our CIO who has over 20 years of experience in leading all aspects of IT. This is done in coordination with our Vice President, IT Audit and Security, who has over 25 years of experience in cybersecurity and other IT security roles, including the management of cybersecurity and compliance teams.

companyName: Excelerate Energy, Inc.

ticker: EE


text: Cybersecurity-related risks are assessed as part of the enterprise risk management program. The Audit Committee is responsible for overseeing the Company's enterprise risk management program. The Audit Committee also oversees the Company's information technology systems and controls, including the cybersecurity program and related risks. Annually, management assesses and ranks the risks identified through the enterprise risk management program according to the likelihood of occurrence and the potential monetary impact, which the Audit Committee reviews. Management also identifies and provides the Audit Committee with quarterly updates on these risks.

companyName: Fortune Brands Innovations, Inc.

ticker: FBIN


text: Neither the Bank nor the Company have experienced any information security breaches of its systems in the past five years. Based on the information available as of the date of this Annual Report on Form 10-K, we are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, despite our cybersecurity risk management processes, there can be no assurance that we, or the third parties with which we interact, will not experience a cybersecurity incident in the future that may materially affect us. For additional information, see Item 1A. "Risk Factors" for a discussion of cybersecurity risks that we face.

companyName: First Bancorp, Inc /ME/

ticker: FNLC


text: Our use of information systems for using, transmitting and storing data is a vital aspect of our business operations. Information systems can be vulnerable to a range of cybersecurity threats that could potentially have a material impact on our business strategy, results of operations and financial condition.

companyName: ZyVersa Therapeutics, Inc.

ticker: ZVSA


text: We engage third-party experts to review our cybersecurity program to help identify areas for continued focus, improvement and/or compliance. These third-party experts perform periodic cyber assessments, including security assessments using the CIS Controls cybersecurity framework. Our processes address cybersecurity threat risks associated with our use of these third-party service providers, including those in our supply chain or who have access to our customer and employee data or our systems. Third-party risks are included within our enterprise risk management assessment program, as well as our cybersecurity-specific risk identification program, both of which are discussed above. In addition, cybersecurity considerations affect the selection and oversight of our third party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and continually monitor cybersecurity threat risks identified through such diligence. Additionally, we generally require those third parties that could introduce significant cybersecurity risks to us to agree by contract to manage their cybersecurity risks in specified ways, and to agree to be subject to cybersecurity audits, which we conduct as appropriate.

companyName: PERDOCEO EDUCATION Corp

ticker: PRDO


text: During 2023, there were no cybersecurity incidents that had a material effect on the Company. Furthermore, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us to date, including our business, business strategy, results of operations, or financial condition. For a discussion of prospective risks related to potential cybersecurity incidents, please refer to Item 1A, Risk Factors.

companyName: ITT INC.

ticker: ITT


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a written information security program, cybersecurity policy, cyber incident response policy and cyber incident response plan.

companyName: FIGS, Inc.

ticker: FIGS


text: The Company's CIO, Senior Vice President of Engineering and Technology responsible for technical services, and Vice President of Engineering and Technology responsible for IT risk management oversee all material risks associated with cybersecurity threats. Our CIO has over 30 years of experience leading data and technology initiatives and has held executive and senior leadership roles across Fortune 500 companies. Our Senior Vice President of Engineering and Technology has more than 34 years of IT experience and has led initiatives in IT application development, IT operations, cloud computing, cybersecurity, business continuity, governance, compliance, and enterprise risk management across various industries. Our Vice President of Engineering and Technology, has more than 30 years of expertise with the Company in cybersecurity, engineering, governance, risk, and compliance, having successfully led numerous projects for the Company. Their backgrounds provide them with a comprehensive understanding of cybersecurity challenges and solutions.

companyName: HUNT J B TRANSPORT SERVICES INC

ticker: JBHT


text: Management has started to implement a process for identifying relevant risks that could affect the organization's ability to provide secure and reliable service to its users. The risk assessment will occur annually, or as business needs change, and covers identification of risks that could act against the company's objectives as well as specific risks related to a compromise to the security of data.

companyName: Charging Robotics Inc.

ticker: CHEV


text: A team led by the CISO implements and maintains systems designed to detect and prevent cybersecurity threats, monitors important developments that may present risk to Company and third-party systems, and oversees the results of internal and third-party security reviews. The CISO provides regular updates to Mattel's CTO regarding critical and major severity security incidents involving Company systems, security incidents involving third parties that have the potential to impact Mattel's operations or involve sensitive customer, supplier, consumer, or employee data, and mitigation and remediation implemented to address such threats or incidents.

companyName: MATTEL INC /DE/

ticker: MAT


text: We have begun to conduct risk assessments at least annually to identify cybersecurity threats. These risk assessments include identifying reasonably foreseeable potential internal and external risks, the likelihood of occurrence and any potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, controls and other safeguards we have put in place to manage such risks. Our risk management process also encompasses cybersecurity risks associated with the use of our major third-party vendors and service providers. Following these risk assessments, we design, implement, and maintain reasonable safeguards to minimize the identified risks; reasonably address any identified gaps in existing safeguards; update existing safeguards as necessary; and monitor the effectiveness of our safeguards.

companyName: CRYO CELL INTERNATIONAL INC

ticker: CCEL


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational and financial risk areas.

companyName: Revolution Medicines, Inc.

ticker: RVMD


text: We face risk from cybersecurity threats that could have a material adverse effect on our business, financial condition, results of operations, cash flows or reputation. We acknowledge that the risk of a cyber incident is prevalent in the current threat landscape and that a future cyber incident may occur in the normal course of our business. However, cyber incidents have not been identified to date, therefore having no material adverse effect on our business, financial condition, results of operations, or cash flows. We understand potential vulnerabilities to known or unknown threats remain and have implemented the cyber risk management program described above to stay up to date on attacks against our IT assets, data, and services, and to prevent their occurrence and recurrence where practicable. Further, there is increasing regulation regarding responses to cyber incidents, including reporting to regulators, investors, and additional stakeholders, which could subject us to additional liability and reputational harm in the event of the occurrence of a reportable cyber incident. In response to such risks, we have implemented the aforementioned initiatives. See Item 1A. "Risk Factors" for more information on our cybersecurity risks.

companyName: Sachem Capital Corp.

ticker: SACH


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management ("ERM") framework, and shares common methodologies, reporting channels, and governance processes that apply across the ERM framework to other areas, including legal, compliance, strategic, operational, and financial risk. We assess and identify cybersecurity risk to the organization by: • Employing a cybersecurity policy that sets forth a protocol for assessing, testing, identifying and preventing security risks; • Conducting assessments of risk likelihood and magnitude from unauthorized access, use, disclosure, disruption, modification or destruction of IT systems and the related information processes, storage, or transmission; • Training personnel on security risks and how to identify and prevent such risks; • Performing risk analysis and security assessments that document the results of the assessment for use and review; • Overseeing and identifying any risk from cyber threats associated with any third-party service provider; • Ensuring security controls are assessed for effectiveness, implemented correctly and operating as intended; and • Continuously scanning for vulnerabilities and remedying vulnerabilities in accordance with the associated risk.

companyName: SPRUCE POWER HOLDING CORP

ticker: SPRU


text: We have implemented and maintain a cybersecurity program designed to identify, assess, and manage material risks from cybersecurity threats to (i) our information systems and data, which include critical computer networks, third-party hosted services, communications systems, hardware and software, and (ii) critical data, including our intellectual property, confidential information that is proprietary, strategic or competitive in nature, and our customers' data. Our cybersecurity program includes an information security policy, access management policies, an open-source policy, security incident response processes, and a supply chain policy, in addition to the secure design and vendor management programs described below. For a description of the risks from cybersecurity threats that may materially affect us, see the risk factor titled "If we, our customers, or third-party service providers experience an actual or perceived security breach or unauthorized parties otherwise obtain access to our customers' data, our data, or our platform, our platform may be perceived as not being secure, our reputation may be harmed, demand for our platform may be reduced, and we may incur significant liabilities. " in the section titled "Risk Factors" included elsewhere in this Annual Report on Form 10-K.

companyName: Snowflake Inc.

ticker: SNOW


text: Protect. Our employees are the first line of defense against cybersecurity incidents. As such, employees receive annual security awareness training to understand the behaviors and technical requirements necessary to protect information. We also conduct annual phishing awareness exercises to educate employees to recognize and report suspicious activity. We also use a combination of tools and in-house technologies to protect Cars Commerce, our employees and our customers, including but not limited to using only SOC 2 compliant hosting providers, anti-malware software, intrusion prevention systems, network and web application firewalls, multi-factor authentication, encryption, and remote access via virtual private network ("VPN") software.

companyName: Cars.com Inc.

ticker: CARS


text: The Audit Committee receives regular reports from management on our cybersecurity risks and reviews our cybersecurity program on at least an annual basis, or more frequently as necessary or advisable. In addition, the Audit Committee is informed, as necessary, regarding material cybersecurity incidents, as well as incidents with lesser impact potential.

companyName: COOPER COMPANIES, INC.

ticker: COO


text: Governance & Personnel Our Board believes a robust cybersecurity strategy is vital to protect our business, customers, and assets. The Board has delegated to the Audit Committee responsibility for oversight and review of our cybersecurity and other information technology and data privacy risk management program, controls, strategies, and procedures. The Audit Committee periodically evaluates our cybersecurity strategies to ensure effectiveness and, if appropriate, includes a review from third-party experts. In addition, our Board also may review and assess cybersecurity risks as part of its responsibilities for general risk oversight.

companyName: SBA COMMUNICATIONS CORP

ticker: SBAC


text: • The Privacy and Security Committee ("P&S Committee"), co-chaired by the CISO and our Deputy General Counsel, brings together Information Security, legal, compliance, human resources and other function leads. The P&S Committee provides a forum for these cross-functional members of management to: consider new laws and regulations relating to privacy and security; consider emerging risks relating to cybersecurity and data protection; approve, review and update policies and standards as appropriate; and promote cross-functional collaboration to manage cybersecurity and privacy risks across the enterprise. • The Operational Risk Committee ("ORC"), comprised of senior IT, operations, risk, legal and compliance leaders across business segments, manages risks from matters related to business continuity including risks posed by cybersecurity threats, and implements controls to mitigate such operational risks. Among other processes, the ORC reviews the Company's programs and processes related to business operations and resiliency, including crisis incident management and cyber risk response, third party risk, vendor management, facilities, unplanned downtime, business disruption, business continuity and disaster recovery. Key information reviewed by the ORC, including as it relates to cybersecurity, are included in the COO's quarterly report to the Audit Committee. • The Crisis Incident Management Team ("CIMT"), which includes senior executives across the Company, is alerted as appropriate to cybersecurity incidents, natural disasters and business outages. Each quarter, the CIMT exercises its communication plan to confirm that its members can be alerted quickly in the event of an actual crisis and meet as a team to discuss the event and response options. • The IT Steering Committee ("IT Committee", which includes our CIO, CISO, COO and members of executive leadership, oversees IT initiatives while considering cybersecurity risk mitigation with respect to these initiatives.

companyName: ARCH CAPITAL GROUP LTD.

ticker: ACGL


text: Engagement and Continuous Improvement periodically evaluate our cybersecurity measures through internal and external audits and assessments to ensure our cybersecurity program is at the forefront of industry best practices. The results of these audits and assessments inform adjustments to our cybersecurity program to improve our resilience against emerging cybersecurity threats.

companyName: Alto Ingredients, Inc.

ticker: ALTO


text: We periodically engage independent security firms and other third-party experts, where appropriate, to assess, test and certify components of our cybersecurity program, and to otherwise assist with aspects of our cybersecurity processes and controls. As part of our overall risk mitigation strategy, we maintain insurance coverage that is intended to address certain aspects of cybersecurity risks, however, such insurance may not be sufficient in type or amount to cover us against claims related to security breaches and incidents, cyberattacks and other related matters.

companyName: Seagate Technology Holdings plc

ticker: STX


text: In the event of a cybersecurity incident, dependent upon the nature of the incident, the Company has a Security Incident Response Team ("SIRT") that is comprised of employees who have responsibility and authority to act during a cyber incident without delay, including, dependent upon the nature of the incident, the Company's Chief Legal Officer, Chief Information Security Officer and Chief Information Officer. The SIRT includes individuals responsible for assessing, containing, and responding to incidents, as well as those responsible for assessing the business and legal impacts, reporting incidents as appropriate, communicating to internal and external stakeholders, and engaging with industry and government response partners to coordinate information and resource sharing when needed. During a cybersecurity incident, as warranted, the SIRT keeps the Company's senior leadership and Board apprised of the response to the incident, any material operational or business impacts, and any material internal or external communications regarding the incident. The SIRT will also seek the input of the Company's senior leadership and Board, as needed, when addressing a cybersecurity incident. Upon resolution of a cybersecurity incident, generally, the Audit Committee will review the incident, the impact and the mitigation efforts and remediation actions the Company will implement. The Audit Committee then monitors the completion of the remediation actions and mitigation efforts.

companyName: OMNICELL, INC.

ticker: OMCL


text: We recognize the increasing significance of cybersecurity in the financial industry and the potential risks associated with cyber threats. Our processes to identify, assess and monitor material risks from cybersecurity threats are part of our overall enterprise risk management program and are integrated into our operating procedures, internal controls and information systems. Our risk management program and processes are intended to maintain an effective and comprehensive Cybersecurity Program under the direction of a dedicated Chief Information Security Officer ("CISO"). Our established Cybersecurity Program is mapped to the NIST Cybersecurity framework ("NIST CSF"), Payment Card Industry Data Security Standards ("PCI DSS"), the Center for Internet Security ("CIS") Critical Security Controls, and relevant ISO standards to maintain the confidentiality, integrity, and availability of our information systems, networks, and corporate and customer data. Highlights of the program include the following processes: A security testing schedule, which includes internal/external penetration testing; Regular vulnerability assessments; Detailed vulnerability management; 24/7 Security Operations Center Monitoring and reporting of systems and critical applications; Data loss prevention controls; File access and integrity monitoring and reporting; Threat intelligence; Third-party vendor management.

companyName: Bancorp, Inc.

ticker: TBBK


text: The CISO is also responsible for monitoring data security incidents at third parties who have access to the Company's information which may impact the Company or its customers if it was compromised. When the Company becomes aware of such events, the CISO engages with the impacted third party service providers to understand the incident, assess the risk that the Company's information was released, and determine methods by which the Company can mitigate the damage, if any, and fulfill its notification obligations to impacted parties.

companyName: COMMUNITY FINANCIAL SYSTEM, INC.

ticker: CBU


text: The CIRO and CITO routinely present cybersecurity reports to the Audit Committee at its regularly scheduled meetings. These reports may address cyber risks and threats, the status of projects to strengthen the Company's information security systems, assessments of the Company's security program, prior incidents, and the emerging cyber threat landscape. In addition, the full Board receives briefings from the CIRO and CITO on at least an annual basis.

companyName: LABCORP HOLDINGS INC.

ticker: LH


text: We are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, which have materially affected or are reasonably likely to affect us, including our business strategy, results of operation or financial condition.

companyName: AVANOS MEDICAL, INC.

ticker: AVNS


text: The Cybersecurity Program is currently overseen by the Board of Directors (Board) and is managed by a dedicated Chief Information Security Officer (CISO), who in turn reports to the Chief Information Officer (CIO), who currently reports to the CEO. The CISO's organization has oversight responsibilities for cybersecurity strategy, policy, standards, architecture and processes for the security of our corporate and manufacturing enterprise network, information assets and medical device technologies. Our current CISO has over 20 years of experience in cybersecurity and risk and technology management, and has held numerous positions in the cybersecurity sector, including serving as Global Cyber Risk Officer at another Fortune 500 medical products and equipment company and CISO at other healthcare companies and health care delivery organizations. Our current CIO has over 30 years of experience in information technology and has served in a number of professional services leadership roles, including as CIO over the past 15 years at three companies. The CISO's organization monitors and manages, and works to identify and assess, cybersecurity risk through various technologies, resources, processes and policies that are updated as necessary to align with the changing threat landscape, our evolving business needs as well as global regulatory requirements. In addition, from time to time, we also utilize external auditors and assessors to help evaluate our Cybersecurity Program, including conducting penetration testing and vulnerability, risk and maturity assessments. We also actively engage with industry experts, regulatory agencies, advocacy groups, industry peers, intelligence and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our Cybersecurity Program and to stay abreast of the emerging cybersecurity landscape.

companyName: BAXTER INTERNATIONAL INC

ticker: BAX


text: We have processes in place to identify, assess and monitor material risks from cybersecurity threats, including the material risks of the Company. These processes are part of our overall enterprise risk management process and have been embedded in our operating procedures, internal controls and information systems. On a regular basis we implement into our operations these cybersecurity processes, technologies, and controls to assess, identify, and manage material risks. Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through a multi-faceted approach including third party assessments, IT security, governance, risk and compliance reviews. To defend, detect and respond to cybersecurity incidents, we, among other things, have developed cybersecurity measures for our technology platform that include a variety of safety measures.

companyName: MANGOCEUTICALS, INC.

ticker: MGRX


text: Board oversees risk management after receiving briefings from Integris IT and also based on its own analysis and conclusions regarding the adequacy of our risk management processes. The Board continuously evaluates and manages material risks including geopolitical and enterprise risks, financial risks, environmental risks, health and safety risks and cybersecurity risks. Integris IT informs our directors about any cybersecurity risks and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents.

companyName: Blue Line Protection Group, Inc.

ticker: BLPG


text: Third-party supply risk is managed by functional teams for the Group. Our third-party risk management process ensures that we evaluate relevant third-party cybersecurity controls through a cybersecurity questionnaire. Risks are identified and assessed, and we include security addendums to our contracts where applicable. We have worked to develop and further implement our supplier-risk framework to help us to manage our suppliers more holistically across the lifecycle. In addition, we have an external third-party threat intelligence service that monitors the dark web and other intelligence sources to provide real-time threat information to the Group and for selected critical suppliers. This information is a proactive position on cyber threats. The intelligence is acted upon and disseminated to the relevant functional teams for action and information.

companyName: Flutter Entertainment plc

ticker: FLUT


text: The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity risk oversight. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Executive Vice President, Chief Administrative Officer, Executive Vice President, General Counsel and Secretary, and Vice President, Enterprise Applications as part of the Board's continuing education.

companyName: KILROY REALTY CORP

ticker: KRC


text: The Board routinely receives information and updates from Company management and the Audit Committee with respect to the effectiveness of the Company's information systems' security framework, which may include cybersecurity assessments, risk management, and mitigation measures. The Board will also be provided updates on any material incidents relating to information systems security and cybersecurity incidents. As discussed above, we maintain endpoint and other protection systems, and incident response processes, both internally and through third-party experts.

companyName: BATTALION OIL CORP

ticker: BATL


text: We have a Cybersecurity Incident Response Plan that is integrated into our crisis management program. The plan provides protocols for evaluating and responding to cybersecurity incidents, including incident disclosure and reporting, notification to senior management and relevant committees, and meeting external reporting obligations. The plan is reviewed and updated regularly by our CISO and Chief Legal Officer to ensure its continued effectiveness. We periodically perform tabletop exercises where we conduct walkthroughs of cyber incident situations to test our response plan, and we plan to continue testing on a periodic basis going forward.

companyName: DOLLAR TREE, INC.

ticker: DLTR


text: Our management team, including our Chief Operating Officer, is responsible for assessing and managing our material risks from cybersecurity threats. Our Chief Operating Officer has primary responsibility for our overall cybersecurity risk management program and supervises our retained provider of IT services and external cybersecurity consultants. Our Chief Operating Officer has experience supervising and managing company security and privacy departments.

companyName: Indaptus Therapeutics, Inc.

ticker: INDP


text: The CISO has primary responsibility for assessing and responding to material risks from cybersecurity threats. The current CISO is an experienced Information Security and Information Technology professional with over 25 years of experience specializing in cyber defense, vulnerability management, security operations, recovery management and as a Windows system engineer. On a quarterly basis, the CISO updates the Risk Committee on the state of cybersecurity and potential risks to Peoples' to be considered by the Risk Committee.

companyName: PEOPLES BANCORP INC

ticker: PEBO


text: The Board is responsible for oversight of the Company's ERM program, including risks from cybersecurity threats. The Board has not assigned that responsibility to any committee or subcommittee of the Board. The Company's management generally provides the Board with updates on and assessments of ongoing and emerging risks from cybersecurity threats at regularly scheduled Board meetings.

companyName: UNITIL CORP

ticker: UTL


text: The Company engages with external experts and advisors, as needed, to review, enhance, and support our IS Program. For example, third parties may be used to assist in the event of a breach or to mitigate certain threats to Regions' environment. Internally, the Company regularly provides associates with cybersecurity training and education. To bolster these practices, Regions maintains cybersecurity insurance, which is reviewed annually, to cover potential financial losses from cyber events. In addition, Regions participates in information sharing organizations to gather and share information with peer banks and other financial institutions to better prepare and protect its information systems from attack as well as topics including fraud.

companyName: REGIONS FINANCIAL CORP

ticker: RF


text: TIAA has instituted a cybersecurity program designed to identify, assess, and mitigate cyber risks applicable to the Company. This cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Company relies. TIAA actively monitors the current cyber threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Company in connection with its day-to-day commercial real estate, investment, and other operations.

companyName: Nuveen Global Cities REIT, Inc.


text: We monitor and update our information technology networks and infrastructure to prevent, detect, address and mitigate risks associated with unauthorized access, misuse, computer viruses and other events that could have a security impact. Additionally, to protect and secure sensitive data such as customer information, we employ multi-factor authentication, a suite of security tools, systems monitoring and alerting, audit logs, and controls across our major systems, corporate devices, and business processes. Our cybersecurity process is designed to assess, identify, prevent, and manage cybersecurity risks and threats, as well as identify, contain and respond to cybersecurity incidents. This process includes a variety of activities, such as company-wide security awareness training, including regular phishing simulations, acceptable use training, self-assessments, and other targeted training throughout the year as appropriate. These cybersecurity trainings provide employees the opportunity to gain an understanding of the various forms of cybersecurity incidents and enable our employees to handle and report any suspicious activity or threat.

companyName: Stran & Company, Inc.

ticker: SWAG


text: As of the date of this annual report, this incident has not had a materially adverse impact on our results of operations. Though our response has not included material changes to our cyber risk management, strategy, or governance, we have taken or plan to take additional cybersecurity measures to continue to advance our cybersecurity policies, practices, and technology. We have incurred expenses, and may incur in the future expenses and losses, related to this incident. See also the risks included below the heading " Cybersecurity, Information Technology and Outsourced Services Related Risks " in Item 1A, Risk Factors, of this annual report for additional discussion of risks related to cybersecurity.

companyName: PACIFIC HEALTH CARE ORGANIZATION INC

ticker: PFHO


text: Internal Cybersecurity Team Our internal cybersecurity team, led by our IT Manager, is responsible for implementing, monitoring, and maintaining cybersecurity and data protection practices across the company.

companyName: Koil Energy Solutions, Inc.

ticker: KLNG


text: Education and Awareness BancPlus' cybersecurity program requires each of the Company's employees to contribute to the Company's data security efforts. The Company regularly reminds employees of the importance of handling and protecting customer and employee data, including through annual privacy and security training to enhance employee awareness of how to detect and respond to cybersecurity threats.

companyName: BANCPLUS CORP


text: The Company has no employees and is externally managed by our Manager, which is a wholly owned subsidiary of CTO, a publicly traded diversified REIT. Pursuant to the terms of the Management Agreement, our Manager manages, operates and administers our day-to-day operations, business and affairs, subject to the direction and supervision of the Board. The Board recognizes the critical importance of maintaining the trust and confidence of our tenants and business partners. The Board plays an active role in overseeing management of our risks, and cybersecurity represents an important component of the Company's overall approach to risk management and oversight.

companyName: Alpine Income Property Trust, Inc.

ticker: PINE


text: As of the date of this report, we are not aware of any material risks from cybersecurity threats that have in the reporting calendar year materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition.

companyName: Vaxart, Inc.

ticker: VXRT


text: To the extent our processes identify a heightened cybersecurity related risk, risk owners are assigned to develop risk mitigation plans, which are then tracked to completion.

companyName: CEDAR REALTY TRUST, INC.

ticker: CDR-PC


text: Our cybersecurity program also addresses cybersecurity risks associated with our use of third-party service providers. We use systems and processes that are designed to assess, identify and reduce the potential impact of a cybersecurity incident at any of our third-party service providers. We assess information security controls of certain of our third-party service providers as part of our third-party information technology risk due diligence, and we conduct third-party vulnerability analysis.

companyName: B&G Foods, Inc.

ticker: BGS


text: Our information security program is managed through a dynamic enterprise-wide cybersecurity strategy, policies, standards, architecture, and processes. The Bank relies upon a formalized internal Information and Cybersecurity Program ("the Program") to safeguard confidential information, maintain the confidentiality of our customers' data and to ensure the integrity of financial transactions. The Program is approved by the Bank's Board of Directors or a Committee thereof annually, and is designed to identify reasonably foreseeable internal and external threats, assess the likelihood and potential damage these threats could cause, and assess the appropriateness of policies, standards and procedures used to identify and mitigate risks associated with a material Cybersecurity incident. The Program has been designed to align with industry best practices, as well as Regulatory guidelines and laws; and leverages the National Institute of Standards and Technology Cybersecurity framework ("NIST CSF") as its baseline. We are dedicated to cybersecurity and maintaining the trust and confidence of our customers and stockholders.

companyName: Bogota Financial Corp.

ticker: BSBK


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing our cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats.

companyName: Mirum Pharmaceuticals, Inc.

ticker: MIRM


text: As of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to affect the Company, including its business strategy, results of operations, or financial condition.

companyName: MCGRATH RENTCORP

ticker: MGRC


text: We also actively engage with third parties, such as key vendors, auditors, consultants, industry participants, and intelligence and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our cybersecurity program. We monitor emerging data protection laws and cybersecurity and privacy regulatory requirements and implement changes to our standards and processes for continued compliance. Our cybersecurity program also includes employee and contractor training, which primarily consists of monthly educational videos, annual trainings and certifications, and phishing exercises.

companyName: VERISIGN INC/CA

ticker: VRSN


text: Risks from Cybersecurity Threats; Actual and Potential Material Impact In addition, we continuously learn from and leverage experience gained from previous cybersecurity incidents that we, like many other companies, have experienced. As previously disclosed, we have been and remain subject to risks and uncertainties as a result of a ransomware attack against us in May 2020 in which a cybercriminal removed a copy of a subset of data from our self-hosted environment. As a result of the Security Incident, we are currently subject to certain legal proceedings and claims and could be the subject of additional legal proceedings, claims, inquiries and investigations in the future that might result in adverse judgments, settlements, fines, penalties or other resolution. See Note 11 to the consolidated audited financial statements contained in this report for additional information regarding the Security Incident and its past and potential impact on the Company.

companyName: BLACKBAUD INC

ticker: BLKB


text: Board Oversight of Cybersecurity Risk The Audit Committee of the Board of Directors (Board) has primary responsibility for overseeing Verizon's risk management and compliance programs relating to cybersecurity and data protection and privacy.

companyName: VERIZON COMMUNICATIONS INC

ticker: VZ


text: from Cybersecurity Threats have not encountered cybersecurity challenges that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. board of directors oversees the management of risks associated with cybersecurity threats.

companyName: CleanCore Solutions, Inc.

ticker: ZONE


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us. For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part I. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "If our information technology systems or data, or those of third parties upon which we rely, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; and other adverse consequences."

companyName: SCYNEXIS INC

ticker: SCYX


text: The Company's ISO has many years of experience appropriate to the role and is supported by skilled internal personnel. The ISO is responsible for identifying, assessing and managing cybersecurity risks and designing, implementing and maintaining the Company's information security program. The ISO reports to the Chief Risk Officer and the Board of Directors. Management's enterprise risk management committee receives regular updates from the ISO on cybersecurity related risks, including trends and emerging threats.

companyName: NATIONAL BANKSHARES INC

ticker: NKSH


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, which have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect the organization, including operations, business strategy, results of operations, or financial condition. See "Risk Factors - Our information technology systems, or those of any of our CROs, manufacturers, other contractors or consultants or Chiesi or potential future collaborators, may fail or suffer security breaches, which could result in a material disruption of our seralutinib development program, which could materially affect our results."

companyName: Gossamer Bio, Inc.

ticker: GOSS


text: For additional information on our cybersecurity risks, see " Data loss or other breaches or disruptions of our information systems and information system security could materially harm our business and results of operations." in Part I, Item 1A of this Annual Report on Form 10-K.

companyName: Atlanta Braves Holdings, Inc.

ticker: BATRA


text: Working with our third-party security operations center, we maintain an incident response plan to timely, consistently and compliantly address any cyber event that may occur and have a designated Incident Response Team consisting of representatives from select business functions which is led by our Vice President of Information Technology ("VP of IT"), who is also in charge of information security, and our Chief Global Privacy Officer ("CPO"). We regularly test our incident response plan, conduct compliance audits, annual tabletop exercises, vulnerability assessments, and where necessary engage third parties to assist with these audits and assessments, as well as mitigation and remediation options and plans.

companyName: FRESH DEL MONTE PRODUCE INC

ticker: FDP


text: In addition, CenterPoint Energy's cybersecurity program is increasingly leveraging intelligence-sharing capabilities about emerging threats within the energy industry, across other industries, with specialized vendors, and through public-private partnerships with U.S. government intelligence agencies. By engaging with utility-specific organizations, CenterPoint Energy benefits from quality analysis and rapid sharing of security information across the energy sector. Such intelligence helps allow for better detection and prevention of emerging cyber threats before they materialize. Just as it tests its policies and plans internally, CenterPoint Energy also engages in external exercises such as the bi-annual GridEx Security Exercise to evaluate and address the preparedness of the industry as a whole.

companyName: CENTERPOINT ENERGY RESOURCES CORP


text: In the past three years, we have not experienced any material computer data security breaches as a result of a compromise of our information systems and we are not aware and have not had a significant cybersecurity breach or attack that had a material impact or are reasonably likely to materially impact our business operations, operating results, or financial condition.

companyName: Century Communities, Inc.

ticker: CCS


text: Our processes also allow for our board of directors and the Audit Committee to be informed of key cybersecurity risks outside the regular reporting schedule. While the Audit Committee conducts meetings regularly, the committee is authorized to meet with management or individual directors at any time it deems appropriate to discuss matters relevant to the committee. The Company's policy is for the board and the Audit Committee to receive prompt and timely information regarding any cybersecurity risk (including any incident) that meets reporting thresholds, as well as ongoing updates regarding any such risk, in accordance with our data breach reporting procedure and GDPR.

companyName: VOLITIONRX LTD

ticker: VNRX


text: We have processes to evaluate third-party service providers and vendors that have access to sensitive systems and customer data, which may include due diligence procedures such as assessments of that service provider's cybersecurity posture or a recommendation of specific mitigation controls. Following an assessment, we determine and prioritize service provider risk based on potential threat impact and likelihood, and such risk determinations drive the level of due diligence and ongoing compliance monitoring required for each service provider.

companyName: RADIANT LOGISTICS, INC

ticker: RLGT


text: As of the date of this report, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. However, we are subject to various cybersecurity risks that may adversely affect our business, financial condition and results of operations. See Item 1A. Risk Factors, "Our business and operations would suffer in the event of system failures, cyberattacks or a deficiency in our cybersecurity" for further discussion.

companyName: KalVista Pharmaceuticals, Inc.

ticker: KALV


text: The Company's Board of Directors (the "Board") is responsible for overseeing the Company's risk management program and cybersecurity is a critical element of this program. Management is responsible for the day-to-day administration of the Company's risk management program and its cybersecurity policies, processes, and practices. The Company's cybersecurity policies, standards, processes, and practices are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards and are standalone from the Company's overall risk management system and processes. In general, the Company seeks to address material cybersecurity threats through a company-wide approach that addresses the confidentiality, integrity, and availability of the Company's information systems or the information that the Company collects and stores, by assessing, identifying and managing cybersecurity issues as they occur.

companyName: Amentum Holdings, Inc.

ticker: AMTM


text: The Company maintains a Cybersecurity Incident Response Plan (CSIRP), which establishes an organizational framework and guidelines intended to facilitate an effective response and handling of cybersecurity incidents that could jeopardize the availability, integrity, or confidentiality of U. S. Steel's assets. The CSIRP outlines roles and responsibilities, criteria for measuring the severity of a cybersecurity incident, and an escalation framework. The CSIRP also addresses senior management responsibility with respect to disclosure determinations related to a cybersecurity incident and provides for Audit Committee and Board briefings as appropriate. Along with the CSIRP, management sustains numerous programs and processes to stay informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity incidents. The list of cybersecurity programs and processes described below is not meant to be exhaustive, but to provide examples of such programs and processes.

companyName: UNITED STATES STEEL CORP


text: Through our third-party IT Service Team ("IT Service Team"), we continuously monitor and update our information technology networks and infrastructure to prevent, detect, address and mitigate risks associated with unauthorized access, misuse, computer viruses and other events that could have a security impact. Our IT Service Team invests in industry standard security technology to protect the Company's data and business processes against risk of cybersecurity incidents. Our data security management program includes identity, trust, vulnerability and threat management business processes, as well as adoption of standard data protection policies.

companyName: YIELD10 BIOSCIENCE, INC.


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated oversight of cybersecurity and other information technology risks to our Audit Committee. The Audit Committee oversees management's implementation of our cybersecurity risk management program.

companyName: AUDACY, INC.


text: Day to day management of our cybersecurity program is the responsibility of the Director, Information Technology Security. The Director manages an internal team of security professionals, as well as a third-party managed security operations center which provides 24/7 security monitoring. Our Director of IT Security reports to the Chief Information Officer. The two, combined, have over 50 years of experience in the information technology field and 30 years in IT security.

companyName: SelectQuote, Inc.

ticker: SLQT


text: Effects and Impacts of Cybersecurity Risks As of the date of this report, we have not identified any risks from known cybersecurity threats, including any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. For a discussion on the Company's cybersecurity related risks, see the risk factors titled " We depend on information technology systems and infrastructure to operate our business, and increased cybersecurity threats, system inadequacies, and failures could disrupt our operations, compromise customer, employee, vendor and other data which could negatively affect our business" and other risk factors contained in Part 1, Item 1A of this Annual Report on Form 10-K.

companyName: BERRY GLOBAL GROUP, INC.


text: The Company's cybersecurity risk management practices are intended to assess, identify and manage risks from threats to the security of our information, systems, products and network. We have developed and implemented cybersecurity and data privacy processes and procedures that are informed by recognized cybersecurity frameworks and standards, including the National Institute of Standards and Technology (NIST) Cybersecurity Framework and International Organization for Standardization 27001 (ISO 27001) Framework. We use these frameworks, together with information collected from assessments, to tailor aspects of our cybersecurity and data privacy practices given the nature of our assets, operations and business. Key features of our cybersecurity and data privacy processes and procedures include the following: • Risk-based controls for information systems and information on our networks: We seek to maintain an information technology infrastructure that implements controls that are tailored based on risk and designed to protect the confidentiality, integrity and access to our information systems and information stored on our networks, including member, customer and employee information, intellectual property and proprietary information. We employ in-depth defense mechanisms throughout our enterprise, including, but not limited to, employee training, vulnerability management, multi-factor authentication, cybersecurity insurance and managed security services to monitor, mitigate and/or prevent cybersecurity incidents. • Cybersecurity incident management and response: We have a cybersecurity incident response plan and specified teams to respond to cybersecurity incidents. If a cybersecurity incident occurs or we identify a vulnerability, our cross-functional teams lead the initial assessment of priority and severity, and external experts may also be engaged as appropriate. Our cybersecurity teams assist in responding to incidents depending on severity levels and seek to improve our cybersecurity incident management plan through periodic simulations of common incidents. Further, we work closely with our external managed security services experts to provide ongoing monitoring and to augment our internal cybersecurity team with incident management and response specialists. • Cybersecurity awareness and training: Our employees are required to complete security awareness training and a compliance course annually, which we believe helps our employees understand their information protection and cybersecurity responsibilities. We also provide additional training to certain employees in accordance with member or customer requirements and regulatory obligations. Further, we regularly communicate with employees about evolving cybersecurity trends through company-wide cybersecurity alerts, which heightens awareness of cybersecurity events that may be impacting our business, peers and industry. • Our assessments of third parties: We have implemented a third-party risk management process that includes, among other things, periodic cybersecurity assessments on certain third parties on which we rely based on an assessment of their risk profile. We also seek contractual commitments from third parties to satisfy our cybersecurity and data privacy requirements, and require third parties to maintain their information technology systems and protect Wheels Up information that is processed on their systems.

companyName: Wheels Up Experience Inc.

ticker: UP