text: Assessment of Cyber Security Risk The potential impact of risks from cyber security threats on the Company are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, results of operation, and financial condition are regularly evaluated. During the reporting period, the Company has not identified any risks from cyber security threats, including as a result of previous cyber security incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, results of operation, and financial condition.

companyName: Investcorp Credit Management BDC, Inc.

ticker: ICMB


text: Communication channels between our cybersecurity teams and other risk management personnel are established to facilitate the timely sharing of information about potential cyber threats. For example, our Data Protection and Information Security working group, which includes representation by our Chief Information Security Officer, and our Legal, ERM, Information Governance and Finance departments, among others, meets regularly to discuss key risks, strategies and threats related to information security.

companyName: HERBALIFE LTD.

ticker: HLF

secItem: Item 1C


text: We invest in enhancing our cybersecurity capabilities and strengthening our partnerships with key business partners, service providers, government, and law enforcement agencies, to understand the range of cybersecurity risks in the global operating environment, enhance defenses, and improve resiliency against cybersecurity threats. Additionally, our CISO is a member of the FBI InfraGard and FBI Executive Advisory Board. Our membership in these public and private sector groups assists in our efforts to protect the Company against both enterprise and in-vehicle security risks.

companyName: Fisker Inc./DE


text: The company's CIO oversees the company's information technology programs and investments. The company's CISO reports to the CIO and oversees the company's information security programs. The company's CIO has over 30 years of information technology experience, including nine years in various information technology leadership roles. Our CIO holds a bachelor of science and master of science degrees in organizational communications as well as an M.B.A. in information technology. The company's CISO has over thirty years of experience in information security and is a Certified Information Security Manager (CISM), a Certified Data Privacy Solutions Engineer (CDPSE), as well as being Certified in Risk and Information Systems Control (CRISC). Our CISO holds a bachelor of science degree in electric engineering as well as an M.B.A. in operations, technology.

companyName: Corteva, Inc.

ticker: CTVA


text: Safeguarding our information technology systems, intellectual property, and the confidential information and personal data that customers, suppliers, business partners, employees and others share with us is a critical concern for our business. As such, we have processes in place to assess, identify, and manage material cybersecurity threats and incidents. Key to these efforts is our cybersecurity risk management program (the "Cybersecurity Program"). We aim to incorporate industry best practices throughout our Cybersecurity Program. It is founded on the National Institute of Standards and Technology's (NIST) Cybersecurity Framework (Identify, Protect, Detect, Respond and Recover) and includes elements of ISO 27001 standards, NIST SP 800-171 guidance, the International Organization for Standardization (ISO), and other applicable industry standards for protecting controlled unclassified information. The Cybersecurity Program also incorporates preventative, detective and corrective controls to identify relevant cyber risks. The controls are tested and evaluated on a regular basis and include the following controls: network and endpoint protection technologies that are designed to block and detect security events at the perimeter and within our networks; evaluation and monitoring of detected security events; and documented incident response actions and procedures. In addition to internal assessments, third party security firms perform annual risk reviews to evaluate and assess the Cybersecurity Program.

companyName: ROGERS CORP

ticker: ROG


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data related to our products ("Information Systems and Data").

companyName: MALIBU BOATS, INC.

ticker: MBUU


text: We are committed to implementing all reasonable measures to ensure the confidentiality, integrity and availability of data that is owned and managed by us. We also endeavor to protect confidential information that is shared with us by our business partners. The cybersecurity program at Koppers has been designed based on an industry standard cybersecurity framework and is aligned with local and regional compliance requirements. The cybersecurity program is reviewed periodically by an independent third-party, and the results are shared with the board of directors. Components of the cybersecurity program are guided by the results of the independent third-party assessment. The cybersecurity program is part of the larger Enterprise Risk Management (ERM) program which is reviewed by management and the board of directors on a periodic basis. Compliance with the cybersecurity program is ensured via policies, procedures, training, and systems.

companyName: Koppers Holdings Inc.

ticker: KOP


text: External Assessments Our cybersecurity policies, standards, processes and practices are periodically assessed by third parties and internal and external auditors. These assessments include a variety of activities including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. These assessments are reported to senior management and our Board through its Audit Committee. Cybersecurity processes are adjusted based on the information provided from these assessments.

companyName: CVB FINANCIAL CORP

ticker: CVBF


text: We maintain a comprehensive risk-based approach to identifying and overseeing cybersecurity risks presented by third-parties, including vendors, service providers, and other external users of our systems, as well as the systems of third-parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.

companyName: Theravance Biopharma, Inc.

ticker: TBPH


text: Although our computer and communications hardware are protected through physical and software safeguards, they are still vulnerable to system malfunction, computer viruses, malware and ransomware, and other cybersecurity threats such as phishing and social engineering attacks. These events could lead to unauthorized access to our information technology systems and result in financial loss and the misappropriation or unauthorized disclosure of confidential information belonging to us, our employees, partners, customers, or suppliers. The techniques used by criminal elements to attack computer systems are sophisticated, change frequently and may originate from less regulated and remote areas of the world. As a result, we may not be able to address these techniques proactively or implement adequate preventative measures. If our information technology systems are compromised, we could be subject to fines, damages, litigation and enforcement actions, incur financial losses, suffer reputational damage, and lose trade secrets or other confidential information, each of which could significantly harm our business.

companyName: Beyond Air, Inc.

ticker: XAIR


text: Role of External Consultants, Vendors and Other Third Parties We regularly use external consultants and vendors to assist in our assessment and management of cybersecurity risks, including employing third parties to evaluate the security of our networks and our approach to cybersecurity risk management, such as external vendors that conduct penetration testing against our network on at least an annual basis and an external vendor that reviews and tests our cybersecurity incident response plan on at least an annual basis. We also have external vendors on retainer to assist with cybersecurity incident response activities if requested.

companyName: FEDERAL NATIONAL MORTGAGE ASSOCIATION FANNIE MAE

ticker: FNMA


text: Cybersecurity risks are monitored on an ongoing basis, and the security program and practices are adjusted as necessary. We are not currently aware of risks from known cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.

companyName: KURA SUSHI USA, INC.

ticker: KRUS


text: Our information security controls and practices are certified against globally recognized standards: ISO 27001, ISO 27701, ISO 27017, SOC 2 Type II, CSA start level 1, TISAX and KY3P by S&P Global. We are also aligned to cybersecurity practices and controls recommended by the National Institute of Standards and Technology ("NIST"), part of the U.S. Department of Commerce.

companyName: JFrog Ltd

ticker: FROG


text: Cybersecurity has been identified as a top risk as attacks against participants in our industry have continued to increase in sophistication and frequency over the years. Cybersecurity risk is described in Item 1A. Risk Factors.

companyName: ENBRIDGE INC

ticker: ENB


text: Consistent with the Company's ERM practices, our cybersecurity policies, processes and layers of defense focus on the following areas: • Surveillance and Monitoring. The Company maintains 24/7 cybersecurity threat surveillance in conjunction with a managed security service that monitors system logs and network traffic for indicators of compromise and other suspicious activity, and conducts monthly external vulnerability assessments and annual penetration testing. • System Safeguards. The Company deploys system safeguards that are designed to protect the Company's information systems from cybersecurity threats, including early detection and response antivirus tools, data leak prevention tools and systems, vulnerability scans of data centers, firewalls, anti-malware functionality and access controls, and programs to support remediation, replacement or isolation of systems that have reached, or are expected to reach, end of security life. • Third-Party Collaboration. The Company utilizes collaboration mechanisms established with public and private entities, including intelligence and enforcement agencies, industry groups, and third-party service providers, to identify, assess and respond to cybersecurity risks. • Third-Party Risk Management. The Company has processes in place for identifying and overseeing cybersecurity risks presented by third-party users of the Company's systems, as well as third-party systems used by the Company. • Training. The Company requires personnel, including new hires, to complete training regarding cybersecurity threats, incident reporting procedures and acceptable use of our information systems. • Incident Response Planning. The Company has established and maintains a cybersecurity incident response plan that outlines an organized and timely approach for responding to and handling security incidents affecting the Company's systems or data, including the intrusions or incidents involving data from a third party.

companyName: PHINIA INC.

ticker: PHIN


text: Notwithstanding our defensive measures and processes, the threats posed by IT failures and cyber-attacks are always present. While our subsidiaries have experienced cybersecurity incidents in the past, no cybersecurity incidents have had, either individually or in the aggregate, a material adverse effect on our business, financial condition, cash flows or results of operations as of the date of this report.

companyName: Freedom Holding Corp.

ticker: FRHC


text: The Company has established an Information Security Committee consisting of the Chief Operations & Technology Officer, Chief Risk Officer, and department representatives across multiple functional areas of the Company to focus on cybersecurity strategic and tactical delivery, policy oversight, monitoring of key cybersecurity risk indicators, and the assessment and management of cyber risk threats. The Committee is assisted by a Virtual Chief Information Security Officer (the "vCISO") which is provided by a contracted third-party security firm. The Committee's activities support the overall protection of data and information assets of the Company in accordance with the Information Security Program, regulatory requirements and Federal Financial Institutions Examination Council guidance. The Committee submits a quarterly report, together with the minutes of its meetings, to the Enterprise Risk Management Committee of the Board of Directors.

companyName: LINKBANCORP, Inc.

ticker: LNKB


text: We rely on proprietary and third-party information systems to process, transmit and store information and to manage or support our business processes. We store and maintain confidential financial and business information regarding us and persons with whom we do business on our information technology systems. We also collect and hold personally identifiable information of our employees in connection with their employment. In addition, we engage third-party service providers that may collect and hold personally identifiable information of our employees in connection with providing business services to us, including web hosting, accounting, payroll and benefit services.

companyName: GIVBUX, INC.

ticker: GBUX


text: System lifecycle and management processes designed to oversee and manage systems and services used by Sagimet, including system assessments and the management of vulnerabilities. System protections including firewalls, endpoint protection, access controls and cloud-based security systems.

companyName: Sagimet Biosciences Inc.

ticker: SGMT


text: Our cybersecurity diligence extends to third-party vendors and partners. We have operationalized processes that seek to identify and manage cybersecurity risks from our service providers, including those who have access to our guest or team member data or direct access to our network, systems and applications, with the goal of minimizing our exposure to third party risks. In addition, cybersecurity and data privacy considerations factor greatly in the sourcing, selection and oversight of our third-party service providers. We generally require third-party service providers that access or host our data, systems, or applications or could otherwise introduce cybersecurity risk to us, to complete additional risk assessments, comply with our security and privacy requirements, and agree to the timely reporting of cyber security incidents to us.

companyName: CARNIVAL PLC

ticker: CUK


text: conduct regular phishing email simulations for all employees and contractors with access to our email systems to enhance awareness and responsiveness to possible threats;

companyName: NETLIST INC

ticker: NLST


text: Cybersecurity risks are also included with the Company's annual business risk assessment which is provided to the Board of Directors.

companyName: Vuzix Corp

ticker: VUZI


text: There can be no guarantee that our policies and procedures will be effective. Although our risk factors include further detail about the material cybersecurity risks we face and how a cybersecurity incident may affect our business strategy, results of operations, or financial condition, we believe that risks from prior cybersecurity threats, including as a result of any prior cybersecurity incident, have not materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition to date. We can provide no assurances that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations, or financial condition.

companyName: Texas Roadhouse, Inc.

ticker: TXRH


text: Our processes for assessing, identifying, and managing material risks from cybersecurity are included in our Enterprise Risk Management ("ERM") program. Oversight of the Company's ERM program resides with the Audit Committee and our Board of Directors. The Audit Committee regularly reviews the results from the Company's ERM program with management. The Company's Board of Directors receive updates from the EVP – Global Business & Information Services regarding cybersecurity framework developments and information that may impact the Company's cybersecurity posture.

companyName: PYXUS INTERNATIONAL, INC.

ticker: PYYX


text: The Global Information Services team has relevant educational and industry experience. The Director of Cybersecurity has served in various roles in information technology and security at Manitowoc for over 30 years, including the last six years overseeing cybersecurity. The Senior Vice President Global Information Systems has been with Manitowoc for over 24 years, leading the Global IS team since 2022.

companyName: MANITOWOC CO INC

ticker: MTW


text: January 2020, our President and CEO who has more than 20 years of experience in the Business Finance and Audit management industry has led our information security team in assessing and managing cybersecurity programs. He reports directly to our Board of Directors on the Company's cybersecurity programs, including strategy, application, infrastructure, information security, support, and execution.

companyName: GIVEMEPOWER CORP

ticker: GMPW


text: We have also established an Incident Response Team and associated protocol led by AES' CISO that governs our assessment, response, and notifications internally and externally upon the occurrence of a cybersecurity incident. Depending on the nature and severity of an incident, this protocol provides for escalating notification to our CEO and our Board. We regularly practice our incident response through executive tabletop exercises.

companyName: DAYTON POWER & LIGHT CO


text: The Company is externally managed by the Advisor and has no employees or internal information systems. Thus, the Company relies on the Advisor, BlackRock, Inc. ("BlackRock") as well as the custodian and other service providers to protect the Company's information from cybersecurity threats. The Company's chief compliance officer (the "CCO") oversees the Company's risk management policies and procedures related to cybersecurity risks, subject to the oversight of the Board of Directors. The CCO and the Advisor also review key Company service providers' compliance and risk management policies and procedures related to cybersecurity matters, evaluate such service providers' use of information systems, which have the potential to subject the Company to information technology vulnerabilities, and receive reports from the Company's service providers regarding any cybersecurity threats and incidents.

companyName: BlackRock TCP Capital Corp.

ticker: TCPC


text: Under the oversight of the ISSC, our cybersecurity risk management program is implemented day-to-day by our cybersecurity team, who identifies, considers, and assesses risks from cybersecurity threats and incidents on a regular basis; establishes processes to monitor such cybersecurity risks; provides mitigation and remediation measures; engages in policy review and development; provides product support and deployment; and maintains our cybersecurity program. Our cybersecurity team also implements data loss prevention tools and capabilities, customer security measures, incident response measures, and processes for management of third-party vendors and service providers. Our cybersecurity incident response is driven by our Lucid Data and Security Incident Response Plan. Based upon the severity assessment and ranking, incidents are handled by the relevant teams for technical, operational, and legal risk management.

companyName: Lucid Group, Inc.

ticker: LCID


text: The Company's Chief Information Officer, or CIO, is responsible for developing and implementing our information security program and reporting on cybersecurity matters to the Audit Committee of the Board of Directors and management. Our CIO has over 20 years of cybersecurity experience in various roles involving information security, developing cybersecurity strategies, and implementing cybersecurity programs.

companyName: IRONWOOD PHARMACEUTICALS INC

ticker: IRWD


text: The Board of Directors has specifically delegated oversight of the Company's cybersecurity risks and related practices to the Audit Committee of the Board of Directors through the committee's charter. At least once each year, senior members of the Company's information technology team (including the Senior Vice President of Information Technology) and internal audit services team brief the Audit Committee on information security matters, including results from risk assessments, the Company's policies and its internal control function.

companyName: SITE Centers Corp.

ticker: SITC


text: a security team that is principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls and policies, and (3) our response to cybersecurity incidents;

companyName: Azenta, Inc.

ticker: AZTA


text: We have not encountered cybersecurity threats or incidents that have materially affected our business strategy, financial condition, or operations. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors,"

companyName: APPLIED ENERGETICS, INC.

ticker: AERG


text: Due to the dynamic nature of risks, threats, vulnerabilities, and the information systems themselves, all information systems that store, process, or transmit sensitive and confidential information are protected by defense-in-depth strategies that include strong authentication techniques, firewalls, network security settings, end point protection, physical security measures, and security awareness training.

companyName: HarborOne Bancorp, Inc.

ticker: HONE


text: Effect of Risk Like all companies w e face risks related to cybersecurity such as unauthorized access, cybersecurity attacks and other security incidents, loss of data, and misappropriation of confidential information. To identify and assess material risks from cybersecurity threats, we maintain a comprehensive cybersecurity program to ensure our systems are effective and prepared for information security risks, including regular oversight of our programs for security monitoring for internal and external threats to ensure the confidentiality and integrity of our information assets. We consider risks from cybersecurity threats alongside other company risks as part of our overall risk assessment process. We employ a range of tools and services, including third-party real-time risk assessments of cyber assets and mitigation of security risks, data loss prevention, regular air-gapped backups, continuous monitoring and threat response, next generation firewall systems, and security information and event management. As discussed in more detail under "Cybersecurity Governance" below, our audit committee provides oversight of our cybersecurity risk management and strategy processes, which are led by our Chief Information Officer.

companyName: SERA PROGNOSTICS, INC.

ticker: SERA


text: Recent Cybersecurity Activity As previously disclosed on a Form 8-K dated November 2, 2023, as amended by the Form 8-K/As dated, November 9, 2023, and December 15, 2023, on October 31, 2023, we experienced a cybersecurity incident in which an unauthorized third party gained access to certain of our technology systems and obtained personal information relating to substantially all of our current and former customers. Following detection of this incident, we initiated response protocols that included deploying containment measures involving shutting down certain systems as a precautionary measure. We notified law enforcement, regulatory authorities, and other stakeholders. We worked with our existing cybersecurity firms and retained additional cybersecurity experts to support our actions.

companyName: Maverick Merger Sub 2, LLC

ticker: COOP


text: These controls and processes are reviewed periodically and include the following activities: • we monitor emerging data protection laws and implement changes to our processes that are designed to comply with such laws; • through our policies, practices, and contracts, as applicable, we require employees, as well as third parties that provide services on our behalf, to treat confidential information and data with care; • we utilize technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, virtual private networks (VPN), Web Application Firewalls (WAF), intrusion detection systems, antivirus and endpoint detection and response software, multi-factor authentication (MFA), data encryption, encrypted backups, vulnerability scanning and patching, email anti-phishing technology, malicious URL and IP filtering, application controls, USB control and threat intelligence services; • our cybersecurity personnel include certified security professionals who are experienced in networks, computer systems, cloud cybersecurity, cybersecurity risk management, incident response, and security awareness training; • we regularly test and monitor our cybersecurity defenses to ensure that they are effective; and • we also conduct security awareness training for all employees to help them identify and mitigate cybersecurity risks.

companyName: MYRIAD GENETICS INC

ticker: MYGN


text: The Audit Committee receives periodic reports from management on our cybersecurity risks. In addition, management is tasked with updating the Audit Committee, if and as necessary, regarding any material cybersecurity incidents, as well as other incidents with lesser impact potential.

companyName: Immuneering Corp

ticker: IMRX


text: We did not experience a significant cybersecurity breach or associated expenses, penalties, or settlements for the twelve months ended December 31, 2024 and 2023.

companyName: BLUE DOLPHIN ENERGY CO

ticker: BDCO


text: The Audit Committee of our board of directors (the "Audit Committee") is responsible for reviewing with management our cybersecurity and other information technology risks, controls and processes, including the processes used to prevent or mitigate cybersecurity risks and respond to cybersecurity events. Our executives with responsibility over cybersecurity provide quarterly reports to the Audit Committee as well as to the Chief Executive Officer and other members of our senior management as appropriate. These reports include updates on our cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program and the emerging threat landscape. Our program is regularly evaluated by internal and external experts with the results of those reviews reported to senior management and the Audit Committee. We also actively engage with key vendors, and intelligence and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures. The Audit Committee also receives prompt and timely information regarding any cybersecurity threat or incident that meets established reporting thresholds, as well as ongoing updates regarding any such threat or incident until it has been mitigated, resolved or otherwise addressed.

companyName: Fortinet, Inc.

ticker: FTNT


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management. As part of our Board's overall responsibility for oversight of management's general risk identification and management activities, our Audit Committee is responsible for the oversight of risks from cybersecurity threats. Members of the Audit Committee review and discuss with management and our auditors the Company's cybersecurity risks and the steps that management has taken to protect against threats to the Company's information systems and security and review risk and mitigation steps taken by management related to data privacy. Members of the Audit Committee also receive cybersecurity updates on a quarterly basis from senior management. This update includes existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any) and status on key information security initiatives. Our Board members also engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.

companyName: TrueCar, Inc.


text: Our Board of Directors has ultimate oversight responsibility over cybersecurity-related matters and has assigned oversight of cybersecurity risk management to the Audit Committee. The Audit Committee assists the Board in fulfilling its oversight responsibilities with respect to the management of risks arising from cybersecurity threats and, in furtherance thereof, regularly receives reports from our senior management and Cybersecurity Leadership Team on cybersecurity matters. These reports are intended to highlight the state of our cybersecurity and data security programs, as well as our progress on key initiatives in this area. In addition, the Board receives reports addressing cybersecurity as part of our overall enterprise risk management program and to the extent cybersecurity matters are addressed in regular business updates. As appropriate, the Board also may receive information regarding specific cybersecurity incidents and resulting mitigation efforts.

companyName: PLAYSTUDIOS, Inc.

ticker: MYPS


text: The Cooperative's Board of Directors contracts with a Managed Security Service Provider. Our Managed Security Service Provider services include: (i) managed IT services, consisting system monitoring and reporting; and (ii) cyber security services, consisting of firewall management, intrusion detection and prevention, malware and virus protection, security audits and vulnerability assessments, security incident response, and employee awareness training. In addition, our Managed Security Service Provider conducts risk assessments and provides recommendations to the Executive Vice President and the Board of Directors, provides threat containment and mitigation services, assists the Cooperative with cybersecurity compliance, and would coordinate with insurance carriers and law enforcement in the event of a cybersecurity incident.

companyName: Golden Growers Cooperative

ticker: GGROU


text: Our cybersecurity incident response and vulnerability management processes are designed to escalate certain cybersecurity incidents and vulnerabilities to members of management depending on the circumstances, including the CTO, CFO, CEO, and others. Our information security function, together with our CTO, works with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response and vulnerability management processes include reporting to the cybersecurity subcommittee of the board of directors' audit committee for certain cybersecurity incidents.

companyName: Rigetti Computing, Inc.

ticker: RGTI


text: Internal Cybersecurity Team Our Chief Information Security Officer ("CISO") oversees a team with extensive cybersecurity knowledge and experience. The team is responsible for: • leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes; • incident response and operational activities, including identifying and initiating updates to systems which require patching, vulnerability management strategy, red teaming, network security configurations and security architecture;

companyName: KIMBERLY CLARK CORP

ticker: KMB


text: During the period ended December 31, 2024, we did not identify any cybersecurity threats at the Sponsor or the Trust that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, even though we take steps to employ reasonable cybersecurity efforts, not every cybersecurity incident can be prevented or detected. Therefore, while we believe there are currently no risks from any potential cybersecurity threat or cybersecurity incident that are reasonably likely to have a material effect on our results of operations or financial condition, the likelihood or severity of such risks are difficult to predict.

companyName: Grayscale Bitcoin Mini Trust ETF

ticker: BTC


text: We have established and maintain broad incident response and recovery plans that help enable its effective and orderly management of, and response to, any identified security incidents, including escalation and internal and external-notification steps, allowing the incident response team to respond in a timely manner and enlist appropriate personnel and third-party experts. We maintain a process to promptly assess and assign severity levels to any identified security incidents in order to prioritize their importance and promptly direct resources to those issues of potentially greater impact. The notification plan establishes steps to alert external stakeholders as appropriate, including law enforcement, regulatory bodies, investors, customers and other business partners.


text: We recognize the critical importance of maintaining the trust and confidence of stakeholders toward our business and are committed to protecting the confidentiality, integrity, and availability of our business operations and systems. Our board of directors is actively involved in oversight of our risk management activities, and cybersecurity represents an important element of our overall approach to risk management. Our cybersecurity policies, standards, processes, and practices are based on recognized frameworks established by the National Institute of Standards and Technology, or NIST, and other applicable industry standards. In general, we seek to address cybersecurity risks through a comprehensive approach that is focused on preserving the confidentiality, security, and availability of the information that we collect and store by monitoring, identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.


text: Our efforts for increased information and cybersecurity readiness are driven from the top of the organization. The Enterprise Risk Management Committee has the responsibility of assessing risks associated with technology and information security, including cybersecurity. The Enterprise Risk Management Committee reports directly to our Board of Directors. The Board of Directors reviews and approves Information Security Risk Assessments and performance reviews which guides the actions of the management team, staff members, and supporting third-party service providers. In addition, the Board is active in the review and approval of all policies concerning information technology and information security. The Board further reviews reports provided by the management team regarding the status of Quaint Oak Bank's GLBA compliance, risk management program, Third Party Risk Management program, and the results of tests and exercises conducted for business continuity, disaster recovery, cybersecurity incident response, and pandemic response. Lastly, the Board of Directors reviews and approves the budget for information and cybersecurity, ensuring that we have sufficient resources to properly address all current and foreseeable information and cybersecurity threats.

companyName: QUAINT OAK BANCORP, INC.

ticker: QNTO


text: The Utilities have disaster recovery and incident response plans in place to protect their businesses from information technology service interruptions. The disaster recovery plans are established to help prevent the loss of customer data, service interruptions and disruptions to operations or damage to important facilities. In addition, the Utilities also maintain cyber liability insurance that covers certain damages caused by cyber incidents.

companyName: HAWAIIAN ELECTRIC INDUSTRIES INC

ticker: HE


text: We operate our segments and their practices through FTI Consulting and its subsidiaries in 31 countries with different business, client, and geographic cybersecurity risk profiles. We aim to proactively identify and assess our vulnerability to cybersecurity threats and actual cybersecurity incidents on an ongoing basis at both the enterprise level, as well as at a more operational level, differentiating unique risks related to our segments, practices, clients, employees, and the locations in which business is conducted. Our Information Technology Group ("ITG") closely monitors and analyzes cybersecurity incidents and risks and our progress mitigating and resolving such threats. This information is regularly discussed with our outside directors and executive management and other interested parties.

companyName: FTI CONSULTING, INC

ticker: FCN


text: Our IT Steering and Risk Committee ("ITSRC") has been delegated the responsibility for managing cybersecurity risk for the company. This committee is chaired by our Chief Technology Officer and includes a diverse cross section of company stakeholders including the Senior IT Manager, General Counsel, VP of Organizational Development and a member of our Third Party Audit team. As of July 1, 2024, we added an outsourced virtual CISO who is a key advisor to the ITSRC, specifically for his decades of expertise in managing and maturing a cybersecurity program that includes mitigation, incident prevention, detection and remediation disciplines. The ITSRC meets at least semi-annually to assess our approach to evolving cybersecurity threats and its impact on our cybersecurity program. The ITSRC is also responsible for maintaining and monitoring legal and regulatory requirements and compliance as well as oversight of the adequacy of company cyber insurance. Our third party security vendors, in collaboration with our Senior IT Manager, keep the ITSRC apprised of efforts surrounding the prevention, detection, mitigation and remediation of any cyber threats or cybersecurity incidents.

companyName: CLEANSPARK, INC.

ticker: CLSK


text: We face a number of cybersecurity risks in connection with our business. Although such risks have not materially affected us, including our results of operations or financial condition, in fiscal 2023 and recent years, we have, from time to time, experienced threats to and attempted breaches of our data and systems, including malware and computer virus attacks. In the future, we may not be successful in preventing or mitigating a cybersecurity incident that could ultimately have a material adverse effect on our business, operations and financial performance. We carry cyber risk insurance that provides protection against a breach or other data security incident, but such insurance may not be sufficient, and any related insurance proceeds may not be timely paid to us. For more information about the cybersecurity risks we face, see the risk factors under the heading entitled "Risks Related to our Information Technology Systems, Data Protection and Cybersecurity" in "Item 1A. Risk Factors" of this Annual Report on Form 10-K.

companyName: Grocery Outlet Holding Corp.

ticker: GO


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, operational, and financial risk areas.

companyName: Camping World Holdings, Inc.

ticker: CWH


text: As of the date of this Annual Report on Form 10-K (this "Form 10-K"), we are not aware of any risks from any potential cybersecurity threat or from any previous cybersecurity incident that have materially affected or are likely to materially affect our business strategy, results of operations or financial condition. However, the preventative actions we have taken and continue to take to reduce the risk of cybersecurity threats and incidents may not successfully protect against these potential threats and incidents in the future.

companyName: TAYLOR DEVICES, INC.

ticker: TAYD


text: We understand the importance of preventing, assessing, identifying, and managing material risks associated with cybersecurity threats. Processes designed to assess, identify and manage risks from cybersecurity threats have been incorporated as a part of the Company's overall risk assessment process. On a regular basis we implement into our operations these processes, technologies, and controls to assess, identify, and manage material risks. Specifically, we engage a third-party cybersecurity firm to assist with network and endpoint monitoring, cloud system monitoring and assessment of our incident response procedures. Further, we employ periodic penetration testing and tabletop exercises to inform our risk identification and assessment of material cybersecurity threats.

companyName: Independence Contract Drilling, Inc.


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part I, Item 1A, Risk Factors in this Annual Report on Form 10-K, including the risk factors titled "Significant disruptions of our information technology systems or data security incidents could result in significant financial, legal, regulatory, business and reputational harm to us" and "Artificial Intelligence presents new risks and challenges to our business."

companyName: Longboard Pharmaceuticals, Inc.


text: Our business operations, including the provision of the products and services described above, involve the compilation and transmission of confidential information, including patient health information. We also collect and store other sensitive data such as credit card, insurance, and other information. We have included security features in our systems that are intended to protect the privacy and integrity of this information, but our systems may be vulnerable to security breaches, viruses, programming errors and other similar disruptive problems.

companyName: TruBridge, Inc.

ticker: TBRG


text: the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; cybersecurity awareness training of our employees, incident response personnel, and senior management;

companyName: PUMA BIOTECHNOLOGY, INC.

ticker: PBYI


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section titled "Risk Factor— Our information technology systems, or those used by our third-party CROs or other contractors or consultants, may fail or suffer security breaches and geopolitical tensions or conflicts, such as the ongoing war in Ukraine or conflicts in the Middle East, may create a heightened risk of cyberattacks."

companyName: Coherus Oncology, Inc.

ticker: CHRS


text: Additional information about cybersecurity risks we face is discussed in Item 1A. Risk Factors, under the heading "Disruption, failure or cybersecurity attacks affecting or targeting information technology and infrastructure used by the Corporation or our business partners may materially impact our business and operations" which should be read in conjunction with the information above.

companyName: HESS CORP


text: Board Governance Disclosure One of the Board's key functions is informed oversight of our risk management process, which includes responsibility for ensuring management has processes in place designed to identify, evaluate, manage, and mitigate cybersecurity risks to which it is exposed. The Board receives regular updates, on at least a quarterly basis, from our senior management team on such cybersecurity risks, developments in cybersecurity, and updates to the Company's information security management program. The Board is also involved in strategic decisions related to the impact of these risks on our business.

companyName: APPIAN CORP

ticker: APPN


text: The VP, Information Technology, along with the information technology organization, is primarily responsible for the assessment and management of material risks from cybersecurity threats. This individual is responsible for briefing our executive officers and their direct reports about information technology threats to the organization and recommended courses of action. The Company's cybersecurity incident response plan includes measures for communicating with executive leadership about prevention, detection and remediation of identified information technology incidents.

companyName: KAMAN Corp


text: To date, the Company has not, to its knowledge, experienced any cybersecurity threats or previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. However, we can give no assurance that we have detected or protected against all cybersecurity incidents or cybersecurity threats. Please refer to the risk factor titled " Our inability or failure to execute our business continuity and response plan following a major disaster such as a natural disaster, terrorism, social unrest or a cybersecurity incident affecting our corporate facilities could materially adversely affect our business" in "Item 1A, Risk Factors" in this report for additional information about risks related to cybersecurity matters.

companyName: El Pollo Loco Holdings, Inc.

ticker: LOCO


text: Role of Management Management is directly involved in assessing and managing PNC's risks from cybersecurity threats. PNC uses a three-lines-of-defense model where cybersecurity risk is managed and assessed by the first line of defense, led by the Chief Information Security Officer and the Director of Technology and Security Risk Management, and the second line of defense which is led by the Chief Technology Risk Officer, who reports to the Chief Risk Officer. The first and second lines of defense are examined internally by our third line of defense, Internal Audit. The lines of defense model is designed to ensure appropriate oversight within the management structure. See the Risk Governance and Oversight section of Risk Management for more details on each of our lines of defense. In addition to the three lines of internal defense, PNC engages external consultants to assess and inform the program, as needed.

companyName: PNC FINANCIAL SERVICES GROUP, INC.

ticker: PNC


text: Our Manager uses the Center for Internet Security Critical Security Controls as a guide to help identify, assess, and manage cybersecurity risks relevant to our business. This does not imply that our Manager meets any particular technical standards, specifications, or requirements.

companyName: Claros Mortgage Trust, Inc.

ticker: CMTG


text: In the event of a cybersecurity breach, the Company would execute its incident response plan, which provides a structured response, including proper reporting and communication of the incident. When a cybersecurity incident is determined to be significant, it is addressed by Senior Director of Information Technology using processes that leverage subject-matter expertise from across the Company. Further, the Company typically will engage third-party advisors as part of our incident management processes. All cybersecurity incidents that are identified as having the potential to be highly significant to the Company are brought to the attention of SVP, Chief Financial Officer as part of our cybersecurity incident response processes. The Company's executive management would report such incidents to the Company's Board of Directors as deemed necessary based on the overall significance and impact to the Company.

companyName: TITAN INTERNATIONAL INC

ticker: TWI


text: Our chief information security officer ("CISO"), chief technology officer ("CTO"), Chief Legal and Compliance Officer ("CLCO") and Director Information and Cybersecurity ("DC") have primary responsibility for assessing and managing material cybersecurity risks and are members of an internal committee that reviews issues and initiatives related to data security and privacy (the "Security Committee"), which drives alignment on security decisions across the Company. The CISO has over 20 years of experience in various roles related to information security and related technology, including roles specific to managing security requirements related to organizations operating in the payment card industry. The CTO and DC also each have over 20 years of experience serving in various roles in information technology fields; the CTO has been with the Company since 2014 and the DC previously served as the Chief Information Security Officer at an IT services and consulting company. The CLCO has over 10 years of experience managing risks, including risks arising from cybersecurity threats, at publicly traded companies. The Security Committee meets at least quarterly to review security performance metrics, identify security risks and assess the status of approved security enhancements. The Security Committee also considers and makes recommendations to the Audit Committee on security policies and procedures, security service requirements and risk mitigation strategies.

companyName: CPI Card Group Inc.

ticker: PMTS


text: Third-Party Risk we are aware of the risks associated with third-party service providers, we implement processes to oversee and manage these risks. We conduct security assessments of all third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. The monitoring includes regular assessments by our technology team. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third parties.

companyName: Freight Technologies, Inc.

ticker: FRGT


text: The CRO has a degree in Business Administration and Finance from the University of Montana. The CRO has over 20 years of combined experience with financial institution risk management, including prior experience as a bank regulator and a credit risk management consultant.

companyName: GLACIER BANCORP, INC.

ticker: GBCI


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "We may be unable to adequately protect our information systems from cyberattacks, which could result in the disclosure of confidential or proprietary information, including personal data, damage our reputation, and subject us to significant financial and legal exposure," which disclosures are incorporated by reference herein.

companyName: TAO Synergies Inc.

ticker: TAOX


text: When a potential threat or incident is identified, our cyber security incident response team will assign a risk level classification and initiate the escalation and other steps called for by our plan. All incidents that are initially assessed by the cybersecurity incident response team as potentially high-risk are escalated promptly to our CISO. Our CISO, Chief Legal Officer and Chief Financial Officer, will determine whether and what elements of our cybersecurity crisis response and management plan should be activated, including escalation to other senior management or our Executive Committee. Our Executive Committee will inform our Board of Directors of cybersecurity incidents, as appropriate, considering a variety of factors, including financial, operational, legal or reputational impact.

companyName: BIOGEN INC.

ticker: BIIB


text: Security Governance Oversight of our security program starts at the Board level. On an annual basis, the enterprise risk team reports to the full Board regarding the top ten enterprise risks, including cybersecurity. Additionally, on a quarterly basis, the Audit/Finance Committee receives presentations by LiveRamp security, highlighting any risks, initiatives, and/or relevant industry trends.

companyName: LiveRamp Holdings, Inc.

ticker: RAMP


text: Parker's cybersecurity program is led by our Digital & IT VP – Infrastructure and Security, who functions as our chief information security officer (CISO) and has over 23 years of experience in cybersecurity operations, cybersecurity governance and compliance, risk management, operational technology (OT) and connected products (IoT) with global Fortune 200 and Fortune 500 companies across diverse industries, such as retail, consumer goods, entertainment and manufacturing. The CISO reports to our CDIO and is supported by and receives regular updates from our dedicated Cyber Security team within our IT function, as well as our IT Risk Council, a cross-functional group that meets regularly to optimize our Digital & IT Risk Management Program and promote alignment with our Enterprise Risk Management program.

companyName: Parker-Hannifin Corp

ticker: PH


text: There have not been any risks from cybersecurity threats, including as a result of any cybersecurity incidents, which have materially affected or are reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition. Refer to "Item 1A. Risk factors" in this annual report on Form 10-K, including "Our internal computer systems or those of our development collaborators, third-party CDMOs, or other contractors or consultants may fail or suffer cybersecurity or other security breaches, which could result in a material disruption of our product development programs and cause our business and operations to suffer. We face risks related to our collection and use of data, which could result in investigations, inquiries, litigation, fines, legislative and regulatory action, and negative press about our privacy and data protection practices", for additional discussion about cybersecurity-related risks.

companyName: Ocugen, Inc.

ticker: OCGN


text: the use of external service providers, where appropriate, to assess, test, or otherwise assist with aspects of our security controls;

companyName: DIH HOLDING US, INC.


text: Spok's enterprise risk management program includes our cybersecurity risk management program ("Cybersecurity Program"), which is designed to protect the confidentiality, integrity and availability of our critical systems and information. Our Cybersecurity Program is designed utilizing guidance from the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) and includes security policies and procedures, security appliances and software, third-party vulnerability testing, business continuity plans, and other administrative, physical and technical measures. Executive management, including Chief Information Officer (CIO)/Chief Information Security Officer (CISO) and VP Technology Operations, has overall responsibility for assessing and managing key cybersecurity risks; implementation of the Cybersecurity Program is led by key information technology and security management members, including the CIO/CISO who have over a combined four decades of experience, specialized training, and various certifications in information technology and cybersecurity strategy, tools and governance. As part of the enterprise risk management program, our Cybersecurity Program shares similar methodologies, reporting channels and governance processes to other areas across the Company.

companyName: Spok Holdings, Inc

ticker: SPOK


text: While the Company's information systems are exposed to cybersecurity threats and risks, the Company has not experienced any material cybersecurity incidents during 2024, 2023 or 2022, and any costs or operational impacts related to cybersecurity incidents were immaterial during this period.

companyName: ILLINOIS TOOL WORKS INC

ticker: ITW


text: Additional information about cybersecurity risks we face is discussed in "Item 1A. Risk Factors," which should be read in conjunction with the information above.

companyName: Atkore Inc.

ticker: ATKR


text: We conduct post-incident reviews of our response to cybersecurity threats and incidents, in addition to evaluating the effectiveness of supporting recovery protocols. In addition, employees and stakeholders can report cybersecurity threats, cybersecurity and data privacy incidents, or other concerns through external and internal reporting channels.

companyName: Rimini Street, Inc.

ticker: RMNI


text: Spire's cybersecurity program is led by the Chief Information Officer and the Chief Information Security Officer, who together have over 40 years of experience in information technology and cybersecurity, along with a cross-functional team of technology, legal, physical security and risk leaders. Internal Audit provides assurances of risk management activities, including certain third-party cybersecurity activities, such as penetration testing.

companyName: SPIRE INC

ticker: SR


text: Our cybersecurity program is risk-based with an underlying threat modeling framework to enable us to track and measure our progress based on five pillars: strategy and foundation, teach and communicate, build and enhance, risk reduction and maturity, and security compliance. Our program framework and foundation are based on common security standards and frameworks, including ISO/IEC 27001/2:2022 and NIST Cyber Resiliency Framework and Model, in alignment with PCI DSS, privacy laws and regulatory requirements.

companyName: Dine Brands Global, Inc.

ticker: DIN


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from our third - party vendors; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.

companyName: CHARLES & COLVARD LTD


text: Related to Cybersecurity Risks Under the ultimate direction of the Chief Executive Officer and our executive management team, the Cybersecurity Supervisory Committee (CSSC) has primary responsibility for overseeing our management of cybersecurity risks, which includes representatives from finance, legal, operations, human resources, and information technology. The CSSC meets as circumstances warrant to review and update incident response procedures and to provide oversight of incident response activities of the Cyber Security Incident Response Team.

companyName: Kymera Therapeutics, Inc.

ticker: KYMR


text: The Chief Information Security Officer ("CISO") works closely with the Chief Information Officer and the Chief Privacy Counsel to collectively manage our global information security, information technology and data privacy programs. The Company's information security program includes a robust set of controls and safeguards for the systems, applications, and databases of the Company and of its third-party vendors. The CISO manages the information security program and sets annual targets and security objectives. The program includes regular risk assessments and recurring internal and external audits to assess the program's maturity and effectiveness. The results of these assessments and audits help inform decisions to make program adjustments and ensure that the program's security objectives are effective and up to date. Additional features of our cybersecurity program include security controls, such as firewalls and intrusion detection systems; data loss prevention tools; penetration testing of network, cloud, and application platforms; security assessments of our third-party vendors; and security awareness education for our employees and specialized training for our information security specialists.

companyName: WYNN RESORTS LTD

ticker: WYNN


text: Our Board of Directors has charged the Audit Committee with the governance and oversight of this risk. Our governance philosophy is to discuss cybersecurity at least quarterly with our Audit Committee, as provided for within that committee's charter, including regular reporting by our Vice President of Information Technology with respect to key accomplishments, planned activities, and monitoring results. Board experience in risk assessment has been enhanced with certification achievements specific to cybersecurity risk, providing us with the appropriate oversight to this evolving threat.

companyName: NWPX Infrastructure, Inc.

ticker: NWPX


text: Information Security is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. Information Security reports to the Chief Administrative and Legal Officer, who, together with other members of our management team, including the Chief Financial Officer and President, is responsible for assessing and managing our material risks from cybersecurity threats based on regular reports from Information Security and information technology ("IT") teams. Management receives periodic reporting on the status of projects to strengthen the security of our IT systems and efforts regarding the prevention, detection, mitigation, and remediation of cybersecurity events. Reports may include briefings that have been informed by internal security personnel, threat intelligence and other information obtained from governmental, public, or private sources in addition to alerts and reports produced by security tools deployed in the IT environment.

companyName: Camping World Holdings, Inc.

ticker: CWH


text: The following factors, among others, are considered by the Company in assessing its cybersecurity risks, mitigation, and remediation strategies: the likelihood and severity of risk; impact on the Company and others, if a risk materializes; feasibility and cost of controls; and impact of controls on operations and on others. The specific controls used by the Company vary based on the systems involved, but usually include firewalls, intrusion prevention and detection systems, anti-malware technical safeguards and access controls, endpoint threat detection and response (EDR), identity and access management (IAM), privileged access management (PAM), logging and monitoring involving the use of security information and event management (SIEM), multi-factor authentication (MFA), and vulnerability and patch management.

companyName: TTEC Holdings, Inc.

ticker: TTEC


text: Material Impact of Cybersecurity Risks In the last three fiscal years, we have not experienced a material information security breach incident and the expenses we have incurred from information security breach incidents have been immaterial, and we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business. However, future incidents could have a material impact on our business strategy, results of operations, or financial condition. For additional discussion of the risks posed by cybersecurity threats, see "Item 1A. Risk Factors—Risks Related to Our General Business Operations and Our Corporate Structure—Cybersecurity risks and cyber incidents may adversely affect our business by causing a disruption to our operations or the operations of the Advisor, the Dealer Manager, our transfer agent or any other party that provides us with services essential to our operations which could negatively impact our business, financial condition and operating results."

companyName: Ares Real Estate Income Trust Inc.

ticker: ZARE


text: Although cybersecurity threats are an inherent part of the digital landscape, we stand resilient. While past incidents have been swiftly addressed without material impact on our operations or financial standing, we remain vigilant. Our Enterprise Risk Management program recognizes the ongoing nature of cybersecurity risks and our commitment to mitigating potential impacts on our operations, business strategy, and financial health.

companyName: Barnes & Noble Education, Inc.

ticker: BNED


text: Our management team, including our Chief Information Officer ("CIO"), CISO and the General Counsel, is responsible for assessing and managing material risks from cybersecurity threats, including supervision of our internal security incident response team and our Disclosure Committee comprised of certain of our employees (including any applicable subcommittees thereof). Our management team has relevant expertise in the following:(i) understanding of cybersecurity risks in enterprise operations, including information technology, information security, product security, physical security and legal, (ii) experience in overseeing risk management and understanding risks faced by enterprise operations and (iii) significant operating experience allowing them to provide insight into developing, implementing and assessing our operating plan. In addition, our CISO has over 30 years of broad cybersecurity and information technology risk management experience, is a Certified Information Security Manager ("CISM") and holds a Master's Degree in computer science and information systems.

companyName: CADENCE DESIGN SYSTEMS INC

ticker: CDNS


text: Juniata leverages internal and external auditors and independent external partners to periodically review its processes, systems, and controls, including with respect to its information security program, to assess their design and operating effectiveness and make recommendations to strengthen its information security and risk management programs. Regular internal monitoring is integral to the Company's risk assessment process, which includes regular testing of internal key controls, systems, and procedures. In addition, independent third-party penetration testing of the effectiveness of security controls and preparedness measures is conducted at least annually or more often, if warranted by the risk assessment or other external factors. Management determines the scope and objectives of the penetration analysis.

companyName: JUNIATA VALLEY FINANCIAL CORP

ticker: JUVF


text: The Company regularly assesses industry best practices, frameworks, and standards, and leverages them to advance its cybersecurity risk management maturity. These frameworks include the International Society of Automation and the International Electrotechnical Commission standards for industrial automation (ISA 62443) and information security (ISO 27001), as well as the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF).

companyName: Air Products & Chemicals, Inc.

ticker: APD


text: The Bank's risk management program and strategy are regularly reviewed and updated to ensure that they are aligned with the Bank's business objectives.

companyName: GUARANTY BANCSHARES INC /TX/


text: We manage risks associated with cybersecurity threats first and foremost through our information security program. We have implemented a comprehensive, layered security approach, across our computing environment, that is designed to facilitate the reduction of cybersecurity risk through the establishment of technical, physical and administrative controls oriented towards the maintenance of the confidentiality, integrity and availability of our information and technical assets. The structure of the information security program is informed by the National Institute of Standards and Technology Cybersecurity Framework, and the program includes controls designed to facilitate the compliance of our cardholder data environments with the PCI DSS.

companyName: GLOBAL PAYMENTS INC

ticker: GPN


text: For a discussion regarding risks from cybersecurity threats that are reasonably likely to affect the Company, see "Part I, Item 1A – Risk Factors – Our use of information technology and third party service providers exposes us to cybersecurity breaches and other interruptions that could disrupt our business operations and adversely impact our reputation and results of operations" and "If we fail to comply with data privacy and personal data protection laws, we could be subject to adverse publicity, government enforcement actions and/or private litigation, which may negatively impact our business and operating results."

companyName: Monster Beverage Corp

ticker: MNST


text: We have established a multilayer cyber threat defense program that enables us to identify, protect, detect, respond, and recover from cyber threat findings, taking appropriate action to prevent these threats from turning into risk. Part of this security program is an incident response plan, the goal of which is to provide a timely response, mitigate any damage, restore services, preserve evidence, evaluate risk impact, communicate effectively to all stakeholders, and ultimately reduce the likelihood of an incident recurrence through proper containment and retrospective.

companyName: Cottonwood Communities, Inc.


text: Our Audit Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity. Our Board of Directors also receives briefings from management on our cybersecurity risk management program. Board members receive presentations on cybersecurity topics from information security management, internal security staff, our internal audit group and external experts as part of our Board of Director's continuing education on topics that impact public companies.

companyName: EXPAND ENERGY Corp

ticker: EXE


text: Management Role and Board Oversight The cybersecurity programs are supervised by the Bank's Chief Information Security Officer (" CISO ") reporting to the Chief Risk Officer ("CRO") and dotted line to the Chief Information Officer. The Chief Risk Officer has reporting responsibility to the Board's Risk and Compliance Committee while the Chief Information Officer has reporting responsibility to the Board's Information Technology Committee. The Risk and Compliance Committee consists of eight directors, seven of whom are independent, while the Information Technology Committee consists of three directors, two of whom are independent and members of the Risk and Compliance Committee. The Company Board includes members who have expertise in cybersecurity, fraud, and risk management. Cybersecurity risks are primarily assessed, monitored, and remediated by the CISO who has a Ph. D. in Information Technology with a concentration in Information Assurance and experience in the information technology and cybersecurity fields and maintains advanced cybersecurity centric certifications. The CISO's knowledge and experience in the cybersecurity field are key to executing our cybersecurity program. Our CISO oversees proactive initiatives, remediation plans of known risks, compliance with regulations and standards and disaster recovery, business continuity, and incident response efforts. Additionally, the Bank's CRO who leads the management risk function, has extensive experience in risk management.

companyName: FLUSHING FINANCIAL CORP

ticker: FFIC


text: While we believe that our business, financial condition, or results of operations have not been materially adversely affected by any cybersecurity incidents, cybersecurity threats are common and pervasive and, we, as well as our customers, regulators, and service providers, have experienced and will likely continue to experience a significant increase in information security and cybersecurity threats and attacks, see "Our information systems are exposed to cybersecurity threats and may experience interruptions and security breaches that could adversely affect our business and reputation" in Item 1A. Risk Factors. We continuously assess the risks and changes in the cyber environment and update our information security program to reflect the results of risk assessments and the key controls necessary to safeguard customer information and ensure the proper disposal of customer information. The program is updated considering changes in technology, the sensitivity of our customer information, internal or external threats to information, and our own changing business environment which can include mergers and/or acquisitions, outsourcing arrangements, and changes in customer information systems which may have material impact on the program. We also leverage control testing of key controls, systems, and procedures of our information security program performed by internal and external auditors and external partners, that is periodically completed to assess their design and operating effectiveness and make recommendations to strengthen our risk management program.

companyName: Amerant Bancorp Inc.

ticker: AMTB


text: The Company (or third parties it relies on) may not be able to fully, continuously, and effectively implement security controls as intended. We utilize a risk-based approach and judgment to determine and prioritize the security controls and measures utilized. In addition, security controls and measures, no matter how well designed or implemented, may only mitigate and not fully eliminate risks. And events, when detected by security tools or third parties, may not always be immediately understood or acted upon.

companyName: iHeartMedia, Inc.

ticker: IHRT


text: Related to Cybersecurity Risks Our head of information technology ( IT), who reports to the Chief Financial Officer (collectively, IT Leadership), has primary responsibility for the strategic leadership and management of our cybersecurity program. Our head of IT has over 25 years of experience building and leading information technology and security teams. Our IT Leadership works alongside other functions to maintain and implement our cybersecurity strategy. Our IT Leadership meets as circumstances warrant with other members of our management, including executive leadership, to review and update incident response procedures and other aspects of our cybersecurity program.

companyName: Sionna Therapeutics, Inc.

ticker: SION


text: Cyber advisors are a key part of Synovus' cybersecurity infrastructure, and we partner with leading cybersecurity companies and organizations to leverage third-party technology and expertise as appropriate. We engage and retain independent third parties to review and assess our information security program on a regular basis and to perform annual penetration tests against our network. We maintain computer forensics, legal, and security firms on retainer in case of a cyber security incident. In addition, we are members of financial sector organizations, including the Financial Services Information Sharing and Analysis Center (FS-ISAC), which facilitates the sharing of cyber and physical threat, vulnerability, and incident information for the good of the membership and for improvement in industry best practices. We also perform comprehensive cybersecurity due diligence and ongoing oversight of third-party relationships, including vendors, and require third-party service providers with access to personal, confidential, or proprietary information to implement and maintain comprehensive cybersecurity practices consistent with applicable legal standards and industry best practices.

companyName: SYNOVUS FINANCIAL CORP

ticker: SNV


text: Identity and Access Management (IAM) – Littelfuse has implemented user authentication controls on its systems, devices, data, and applications. In addition, multi-factor authentication is implemented for all personnel who remotely access or have privileged account access to Littelfuse systems and networks.

companyName: LITTELFUSE INC /DE

ticker: LFUS


text: The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The Audit Committee receives briefings from management on our cyber risk management program and receive presentations on cybersecurity topics from management, our internal auditors IT personnel or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: Global Net Lease, Inc.

ticker: GNL


text: We have strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cyber risk awareness. Our Vice President, Information Technology and our information technology group endeavor to evaluate and address cyber risks in alignment with our business objectives, operational needs and industry-accepted standards, such as the National Institute of Standards and Technology (NIST) and Center for Internet Security (CIS) Critical Security Controls frameworks.

companyName: LGI Homes, Inc.

ticker: LGIH


text: The Audit Committee provides a regular report to the full Board on key aspects of management's presentations on cybersecurity and broader technology risks. All members of the Board have access to written cybersecurity reports that are provided to the Audit Committee. Audit Committee conversations on cybersecurity topics are open to any member of the Board.

companyName: HERTZ GLOBAL HOLDINGS, INC

ticker: HTZ


text: Our cybersecurity incident response processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our Executive Director of IT and General Counsel, who works with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response process includes reporting to the Audit Committee of the Board of Directors for certain cybersecurity incidents.

companyName: Adverum Biotechnologies, Inc.

ticker: ADVM


text: Our risk management team collaborates with our Chief Information Security Officer, or CISO and our Head of Legal to evaluate and address cybersecurity risks in alignment with our business objectives and operational needs. We have processes to detect potential vulnerabilities and anomalies through technical safeguards and have adopted policies and procedures around internal and external notification of cybersecurity incidents.

companyName: iTeos Therapeutics, Inc.


text: regular training for our employees regarding cybersecurity threats as a means to equip them with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices;

companyName: Bio Green Med Solution, Inc.

ticker: BGMS


text: Our board of directors is responsible for overseeing Company management's execution of its cybersecurity responsibilities, including our approach to cybersecurity risk management. Our board of directors executes this oversight in coordination with our Audit Committee, which pursuant to its charter, assists the Board with risk assessment and risk management policies as they relate to cybersecurity risk exposure (among other risk exposures), as well as part of its regularly scheduled meetings and through discussions with Company management on an as needed basis.

companyName: Angi Inc.

ticker: ANGI


text: Threat Management: Upon identification of a potential threat, our managed service provider's dedicated incident response team takes immediate action to mitigate any adverse impacts. Our threat management procedures include: Immediate isolation of affected systems to prevent the spread of threats; Application of appropriate remediation measures, such as patches and software updates; Conducting a thorough investigation to understand the breach's nature and scope; and Implementing enhancements to prevent future occurrences.

companyName: ODYSSEY MARINE EXPLORATION INC

ticker: OMEX


text: Morgan Stanley's Cybersecurity Program is regularly assessed by the Morgan Stanley Internal Audit Department ("IAD") through various assurance activities, with the results reported to the Audit Committee of the MS Board ("BAC") and the BOTC and, as applicable to the Board of Directors of the Company. Annually, key elements of the Cybersecurity Program are subject to a review by an independent third-party, the results of which, including opportunities identified for improvement and related remediation plans, are reviewed with the BOTC. The Cybersecurity Program is also examined regularly by the Firm's prudential and conduct regulators within the scope of their jurisdiction.

companyName: T Series Middle Market Loan Fund LLC


text: We have policies and processes for assessing, identifying, and managing material risk from cybersecurity threats and have integrated these processes into our overall risk management systems and processes. We assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: CEMTREX INC

ticker: CETX


text: Our CIO is a member of InfraGard, ISC2 and ISACA and serves as Adjunct Professor of Cyber Security at Lone Star College and San Jacinto College.

companyName: W&T OFFSHORE INC

ticker: WTI


text: As of January 31, 2024, we had not identified an indication of a cybersecurity incident that would have a material impact on our business and consolidated financial statements.

companyName: REX AMERICAN RESOURCES Corp

ticker: REX


text: The Company did not experience a material cybersecurity incident in fiscal year 2024. Any incident assessed as potentially being or becoming material will immediately be escalated for further assessment and reported to designated members of our executive leadership team and, if deemed necessary, the Board of Directors. Additionally, we plan to consult with outside counsel, as appropriate, on our materiality determinations, our disclosure requirements, and other compliance decisions. We also plan to keep our independent public accounting firm informed of such incidents, as appropriate. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. Although our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. See Item 1A. "Risk Factors" for a discussion of cybersecurity risks applicable to the Company.

companyName: REV Group, Inc.


text: We engage a third-party consultant to assist us with our cybersecurity risk management framework, including the monitoring and detection of cybersecurity threats and responding to any cybersecurity threats or incidents. Our third-party consultant team is managed by our Chief Financial Officer who reports to the audit committee or board, as appropriate.

companyName: ALTEROLA BIOTECH INC.

ticker: ABTI


text: Our Senior Vice President of Product, who has extensive cybersecurity knowledge from over 20 years of experience in leadership roles at technology companies ranging in maturity from various startups to Sony, a large billion dollar corporation, leads the team responsible for overseeing, managing, and assessing our material cybersecurity risks, and works in close coordination with other members of leadership, infrastructure, and information technology, and our external professional providers to maintain cybersecurity risk management and data protection.

companyName: Leafly Holdings, Inc. /DE


text: During the year ended December 31, 2024, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected our operations, business strategy, results of operations or financial condition. However, we will continue to face certain risks from ongoing cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition. See Disruptions to our information technology systems or our failure to adequately protect critical data, sensitive information and technology systems could materially affect our business or result in harm to our reputation in Item 1A. Risk Factors in Part I of this Annual Report."

companyName: QUANTA SERVICES, INC.

ticker: PWR


text: We maintain a cybersecurity program to manage the confidentiality, integrity and availability of our data and information systems that support our business. The program is aligned with the National Institute of Standards and Technology Cybersecurity Framework 2.0 and is integrated into our overall risk management program. It is designed to develop appropriate strategies for preserving the confidentiality, integrity and availability of our data and information systems that can evolve with the changing cybersecurity threat landscape. We have implemented policies, procedures and technological tools to prevent, detect and mitigate cybersecurity risks posed by third parties.

companyName: CLEANSPARK, INC.

ticker: CLSK


text: The Company recognizes the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. Therefore, we have established a cybersecurity and risk management framework, which includes regular cybersecurity risk assessments to identify and evaluate potential cyber-attack threats and information security weakness that may affect our business. The data we collect during our operations primarily includes publicly available operational information from port websites. Additionally, we utilize a third-party software vendor to handle any personally identifiable information directly uploaded by truck drivers via a secure portal. We implement two-factor authentication for accessing emails and software, and enforce user role-based security with periodic password updates and login activity tracking. We plan to implement additional preventive measures, including firewalls, cyber-attack detection systems, and data encryption, to safeguard confidential information and data. We will regularly conduct cybersecurity awareness training for employees to enhance their awareness of potential cybersecurity threats and ensure they take appropriate preventive measures.

companyName: Toppoint Holdings Inc.

ticker: TOPP


text: TIAA's cybersecurity team periodically reports to the Company's management on cybersecurity matters, primarily through presentations. Such reporting will include updates on TIAA's cybersecurity program as it relates to the Company, the external cybersecurity threat environment, and TIAA's programs to address and mitigate the risks associated with the evolving cybersecurity threat environment. These reports also include updates on TIAA's preparedness, prevention, detection, responsiveness and recovery with respect to cybersecurity incidents.

companyName: Nuveen Churchill Direct Lending Corp.

ticker: NCDL


text: We believe that cybersecurity is a critical component of our enterprise risk management process, and as such, we have implemented a cybersecurity program to assess, identify, and manage risks from cybersecurity threats that may result in adverse effects on the confidentiality, integrity, and availability of our information systems.

companyName: NPK International Inc.

ticker: NPKI


text: We have not identified any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of our operations, or financial condition. However, we have been the target of cyber-attacks and expect them to continue as cybersecurity threats have been rapidly evolving in sophistication and becoming more prevalent in the industry. We cannot eliminate all risks from cybersecurity threats or provide assurances that we have not experienced an undetected cybersecurity incident in the past or that we will not experience such an incident in the future. For more information on the risks from cybersecurity threats that we face, refer to Part I, "Item 1A. Risk Factors."

companyName: CORPAY, INC.

ticker: CPAY


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, internal operational risks; system security risks; data protection; risks to proprietary business information; intellectual property theft; fraud; extortion; harm to employees, partners, or customers; violation of privacy or security laws and other litigation and legal risk; and reputational risks. We have implemented several cybersecurity processes, technologies, and controls to aid in our efforts to identify, assess, and manage such material risks.

companyName: JUNIPER NETWORKS INC


text: Risk from Cybersecurity Treats We recognize that individual employees are frequent targets of threat actors. We regularly train employees on the importance of protecting our information, and also regularly communicate with our customers and employees. If specific threats are identified, management may communicate those threats directly to employees for heightened awareness. Our cybersecurity program requires employees to review and acknowledge information security and privacy policies annually, complete multiple cybersecurity training courses throughout the year, and participate in mock phishing campaigns regularly.

companyName: BYLINE BANCORP, INC.

ticker: BY


text: SoundHound has a dedicated Information Security Management committee responsible for overseeing risks from cybersecurity threats. The committee's charter outlines its specific responsibilities related to cybersecurity risk oversight, and assists senior management in fulfilling its oversight responsibilities by creating, implementing, overseeing and maintaining SoundHound's Information Security Management System. The purpose of the ISMS is to protect the Company's information systems and assets, taking into account the potential for external threats, internal threats, and threats arising from transactions with trusted third parties and vendors. The board of directors is informed of cybersecurity risks, at least annually, through established processes, including periodic briefings, reports, and updates on the evolving landscape of cybersecurity threats.

companyName: SOUNDHOUND AI, INC.

ticker: SOUN


text: Monitor Cybersecurity Incidents The Technology Committee established the Information Technology and Information Security Working Group (the "IT/IS Working Group"), which is comprised of the CDO, the Head of Information Technology Infrastructure, the CISO, the Information Security Officer, the Information Security Assurance Program Manager and certain other members of the Company's information technology engineering staff. The mission of the IT/IS Working Group is to foster the sharing of information among departments regarding existing and emerging threats and risks related to cybersecurity and related compliance issues in order to better integrate cybersecurity risk management and increase awareness of cybersecurity threats throughout the Company. This group meets on a weekly basis to discuss, among other things, vulnerability management, threat and risk analysis and the status of our continued enhancements to the Company's information security infrastructure that are intended to further manage and mitigate future risks.

companyName: Metropolitan Bank Holding Corp.

ticker: MCB


text: The Company is in the process of evaluating our cybersecurity needs and developing appropriate measures to enhance our cybersecurity posture. This includes considering the engagement of external cybersecurity experts to advise on best practices, conducting vulnerability assessments, and developing an incident response strategy. Our goal is to establish a cybersecurity framework that is commensurate with our size, complexity, and the nature of our operations, thereby reducing our exposure to cybersecurity risks.

companyName: Toughbuilt Industries, Inc


text: The CSGC leads the enterprise-wide cybersecurity strategy and policy development to ensure alignment and best practices informed by industry established frameworks. The Cybersecurity Program emphasizes continuous improvement by actively engaging with internal and external stakeholders, striving to stay ahead of emerging threats, adapting to the evolving cybersecurity landscape, and fortifying our defenses against potential risks. The Cybersecurity Program undergoes regular evaluations conducted by both internal and external experts to assess the strength of our Cybersecurity Program. Regular penetration tests are performed as well as simulated cybersecurity events to test our defenses and responses to unmitigated penetrations. The results of these evaluations are reported to the CSGC and Audit Committee of the Board of Directors. We have also deployed an information security training program for our employees that includes training on matters such as phishing and email security best practices as well as required training on data privacy.

companyName: PLIANT THERAPEUTICS, INC.

ticker: PLRX


text: Our business is not dependent on the internet. Accordingly, we believe that the Company has minimal risks related to cybersecurity. Developing a program to identify, detect, prevent and remediate potential cybersecurity vulnerabilities, including those arising from third-party hackers, hardware or software, is extremely costly and time consuming. Management believes that the minimal risk does not justify the significant expense needed to develop a program which will identify, detect, prevent or remediate cybersecurity risks.

companyName: UNIVERSAL SAFETY PRODUCTS, INC.

ticker: UUU


text: As of the date of this report, we are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition.

companyName: Lantern Pharma Inc.

ticker: LTRN


text: We maintain a cyber-risk management program which is intended to assist in assessing, identifying, and managing material risks from cybersecurity threats to our data and information systems. This program is to ensure that cybersecurity considerations are included in decision-making processes throughout the Company.

companyName: Scienture Holdings, Inc.

ticker: SCNX


text: Our cybersecurity efforts are part of our broader risk management approach. To date, we have not experienced any cybersecurity events that have had a material impact on our business or operations. Our management oversees cybersecurity risks.

companyName: Zentrum Holdings, Inc.


text: To date, we are not aware of risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, results of operations or financial condition. Refer to the risk factors under "Operational Risks" in Part I, Item 1A. "Risk Factors" for additional description of cybersecurity risks and potential related impacts on the Company.

companyName: Argo Group International Holdings, Inc.


text: Our Board of Directors oversees our risk management process, including risks from cybersecurity threats. Our Board of Directors reviews strategic risk exposure, and members of our management are responsible for addressing the material risks we face on a day-to-day basis. Our Board of Directors administers its cybersecurity risk oversight function directly as a whole as well as through our Audit Committee. Our Board and our Audit Committee receive updates from time to time from our management as appropriate on cybersecurity.

companyName: GENCO SHIPPING & TRADING LTD

ticker: GNK


text: The Company, through its Chief Information Security Officer ("CISO"), other Company employees experienced in information network security, and the use of third-party expertise, references various recognized cybersecurity frameworks. These frameworks are used to benchmark and tailor the Company's cybersecurity strategies and program to our risk profile and specific operational needs and goals. Our core cybersecurity strategy focuses on five key pillars: identification, protection, detection, response, and recovery, each tailored to meet the specific challenges and needs of our business. The primary goal of this strategy is to proactively safeguard the confidentiality, security, and availability of the information we collect and store. This proactive approach includes identifying, preventing, and mitigating cybersecurity threats, as well as preparing to respond to cybersecurity incidents quickly and efficiently to minimize their impact. Under the leadership of our CISO and CRC, we are committed to a continuous evaluation and enhancement of our cybersecurity practices to facilitate adaptation to the constantly evolving landscape of cybersecurity threats.

companyName: REGENCY CENTERS LP