text: Our cybersecurity processes align with the National Institute of Standards and Technology (NIST CSF) Framework. The Company conducts regular risk assessments on systems and applications to help detect potential risks, threats, and vulnerabilities. Additionally, annual assessments are conducted to evaluate the effectiveness of controls. Risk assessment, risk-based analysis, and judgment are used to select security controls to address risks. During this process, the following factors, among others, are considered: likelihood and severity of risk, impact on the Company and others if a risk materializes, feasibility and cost of controls, and impact of controls on operations and others. Several controls are employed to differing extents, encompassing but not restricted to endpoint threat detection and response (EDR), identity and access management (IAM), privileged access management (PAM), logging and monitoring utilizing security information and event management (SIEM), multi-factor authentication (MFA), firewalls, intrusion detection, and prevention, as well as vulnerability and patch management.

companyName: WK Kellogg Co


text: Our cybersecurity program emphasizes: • Threat Awareness and Risk Identification: Engaging with industry groups and third-party experts to stay ahead of emerging threats. • Employee Training: Conducting annual training and phishing simulations to reinforce best practices. • Advanced Safeguards: Deploying comprehensive technical measures, including firewalls, intrusion detection systems, penetration tests, anti-malware, encryption, and access controls to secure our systems and data. • Vendor Management: Requiring contractual data protection safeguards and screening vendors for compliance during onboarding. • Incident Response: Maintaining up-to-date response and recovery plans, validated through regular tabletop exercises. • Compliance Standards: Adhering to recognized standards such as HITRUST, NIST CSF, ISO 27001, and PCI DSS. • Insurance: Partnering with leading insurers to maintain cyber liability coverage.

companyName: MASIMO CORP

ticker: MASI

secItem: Item 1C


text: Our management team, led by our CIO, is responsible for assessing and managing our significant risks from cyber security threats. The team has primary responsibility for our overall cybersecurity risk management program. Our management team's experience includes multiple team members with 56 collective years of relevant experience with Douglas Emmett, Inc. The team has extensive knowledge of the technologies and applications addressed by the cybersecurity risk management program.

companyName: Douglas Emmett Inc

ticker: DEI


text: Risk assessment is an ongoing process within our organization. We routinely perform assessments to identify, analyze, and prioritize cybersecurity risks. The outcomes of these assessments directly inform our cybersecurity strategy and guide the allocation of resources.

companyName: MONARCH CASINO & RESORT INC

ticker: MCRI


text: To identify, assess and manage material risks from cybersecurity threats, our enterprise risk management program considers cybersecurity threat risks alongside other company risks as part of our overall risk assessment process. Our enterprise risk management committee, a multidisciplinary committee that includes our Chief Financial & Operating Officer and Chief Revenue Officer and is chaired by our Chief Legal Officer, collaborates with internal subject matter specialists in an effort to gather information for identifying, assessing and managing material cybersecurity risks, such as information related to their severity, likelihood of occurrence and potential mitigation strategies. At least quarterly, our Chief Information Officer and Senior Director, Information Security, meet with our enterprise risk management committee to present and discuss a cybersecurity risk assessment. Key cybersecurity risks are then incorporated into our enterprise risk management framework. To help inform our cybersecurity risk identification, assessment and management, we also employ a range of tools and services, including network and endpoint monitoring, vulnerability assessments, periodic penetration testing, bug bounty program and tabletop exercises.

companyName: LEGALZOOM.COM, INC.

ticker: LZ


text: We periodically engage assessors, consultants, auditors, or other third parties in connection with our risk assessment processes. These service providers assist us to design, implement, or assess our cybersecurity policies and procedures, as well as to monitor and test our safeguards. We work with our third-party suppliers and service providers to address the use of appropriate security measures in connection with their work with us.

companyName: MICRON TECHNOLOGY INC

ticker: MU


text: In addition, to aid its own security, the Company has adopted a number of cybersecurity policies including an Incident Response Plan, an Acceptable Use Policy for employees and a Service Provide Cybersecurity Management Policy (the "Cybersecurity Policies"), through which the Company ensures that key vendors with access to sensitive information have contractual terms obligating their compliance with the Company processes, policies and procedures.

companyName: Chatham Lodging Trust

ticker: CLDT


text: Incident Response Plan. We maintain an incident response plan to respond to and mitigate the effects of an information security incident. The plan provides for the formation of a multi-functional incident response team led by the Chief Information Officer ("CIO") and comprised of IT, legal, corporate communications, internal audit, and operational personnel.

companyName: ADVANCED ENERGY INDUSTRIES INC

ticker: AEIS


text: All employees of the Company have ownership in managing cybersecurity and data privacy risks, however, oversight responsibility is shared by our BOD, Audit Committee and cybersecurity management team. The Audit Committee is responsible for our cybersecurity policies and provides regularly updates to the BOD Our cybersecurity management team, in conjunction with our third-party chief information security officer ("CISO"), conduct regular assessment and management of material risks from cybersecurity threats, including review with our internal cybersecurity management team. All employees and consultants are directed to report to our cybersecurity management team any irregular or suspicious activity that could indicate a cybersecurity threat or incident.

companyName: Nuvera Communications, Inc.

ticker: NUVR


text: Depending on the environment, systems, and data, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example, incident detection and response processes, vulnerability management policy, disaster recovery and business continuity plans, risk assessments, encryption of certain data, data segregation for certain data, network security and access controls, physical security controls, asset management, tracking and disposal, monitoring for certain systems, vendor risks management processes, penetration testing, employee training, cybersecurity insurance, and dedicated cybersecurity staff.

companyName: Lionsgate Studios Corp.

ticker: LION


text: EOG's cybersecurity team leadership, Senior Vice President and Chief Information and Technology Officer and other members of senior management are responsible for the day-to-day management of cybersecurity risks and cybersecurity leadership. Such senior management team regularly reports to EOG's Audit Committee and Board of Directors (Board) regarding cybersecurity matters, including the assessments performed regarding EOG's cybersecurity technologies, controls and procedures.

companyName: EOG RESOURCES INC

ticker: EOG


text: Our process of assessing, identifying and managing material risks from cybersecurity threats is integrated into our overall enterprise risk management ("ERM") process. The audit committee of the board of directors (the "Audit Committee") oversees our ERM framework, including cybersecurity and other information technology risks. This involves collaboration with key personnel, including the Chief Financial Officer ("CFO"), the Chief Information Security Officer ("CISO"), IT operational management and Internal Audit. We also have a cross-functional team led by the CISO, which meets weekly with a fixed agenda to discuss mitigation and action-items related to ERM cyber risk updates, cyber statistics dashboards and threat vectors. Our CISO has a comprehensive background in various enterprise-wide information technology and cybersecurity leadership roles within the global energy and oil and gas sectors and strategy consulting. The Audit Committee receives a report from our Director of Internal Audit on the ERM risk register at least three times a year.

companyName: Great Lakes Dredge & Dock CORP

ticker: GLDD


text: The Company has implemented a comprehensive, cross-functional approach to assessing, identifying and managing material cybersecurity threats and incidents. The Company's program includes controls and procedures to properly identify, classify and escalate certain cybersecurity incidents to provide management visibility and obtain direction from management as to the public disclosure and reporting of material incidents in a timely manner.

companyName: Kayne Anderson BDC, Inc.

ticker: KBDC


text: Our Head of Information Security & Compliance and IT Department implement processes around security monitoring and vulnerability testing. Our Head of Information Security & Compliance reports at least twice annually to the Audit Committee and such reporting will include topics such as our risk assessment, risk management and control decisions, service provider arrangements, test results, security incidents and responses and recommendations for changes and updates to policies and procedures.

companyName: KinderCare Learning Companies, Inc.

ticker: KLC


text: During the course of normal business operations, the Company collects, stores, and processes personal data. Being cognizant of the importance of protecting personal data and respecting the rights of individuals to have control over their personal information, the organization implements a data privacy program designed to comply with U.S. data privacy regulations and incorporates data privacy into its risk management program.

companyName: CROSS COUNTRY HEALTHCARE INC

ticker: CCRN


text: We have in place, and seek to continuously improve, a comprehensive system of security controls, managed by a dedicated staff. From time to time, we engage reputable third parties to perform a variety of services, including managed network security services, incident response or management services, cyber-forensic investigation services, and periodic security penetration testing which we utilize to update our security controls based on any findings. In addition, we are subject to independent assessment and review by regulators, as well as an annual audit of our security controls by our independent internal audit team. We also provide regular security risk education awareness and training sessions for all staff. Additionally, we maintain an ongoing internal third-party cybersecurity risk assessment program to oversee and identify potential cybersecurity threats associated with our use of third-party service providers, and consider these assessments when selecting and engaging service providers.

companyName: RENAISSANCERE HOLDINGS LTD

ticker: RNR


text: We have adopted an Incident Response Plan that applies in the event of a cybersecurity threat or incident (the "IRP") to provide a standardized framework for responding to security incidents. The IRP sets out a coordinated approach to investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate. The IRP applies to all Company personnel (including third-party contractors, vendors and partners) that perform functions or services that require access to secure Company information, and to all devices and network services that are owned or managed by the Company. As an additional measure to facilitate our timely and comprehensive response to any security incident, we engage a third-party vendor on retainer to assist in such incidents.

companyName: DAWSON GEOPHYSICAL CO

ticker: DWSN


text: Zero trust principles" drive the Company's information security architecture, and the Company deploys a "defense in-depth" strategy to protect against cybersecurity threats, layering multiple levels of information security and technology controls within business processes for information assets and relationships with third parties based on the National Institute of Standards and Technology Special Publication 800-53 Framework. The Company's information systems and risk management are also subject to regulatory requirements and examination by federal banking regulators.

companyName: WEBSTER FINANCIAL CORP

ticker: WBS


text: Identifying, assessing, and managing cybersecurity risk is integrated into our overall risk management systems and processes, and we have in place cybersecurity and data privacy training and policies designed to (a) respond to new requirements in global privacy laws and (b) prevent, detect, respond to, mitigate and recover from identified and significant cybersecurity threats.

companyName: Blaize Holdings, Inc.

ticker: BZAI


text: The CISO implements and oversees policies and processes for the regular monitoring of our information systems. This includes the deployment of additional security measures, including defensive infrastructure, and regular system audits to identify potential vulnerabilities. If the CISO, the IRT and/or management believe a cybersecurity incident is potentially material, the CISO, the CRO or another member of the team can convene the IMT to further assist in the Company's remediation and response efforts. Following the remediation of the cybersecurity incident, the IRT and/or IMT will review the effectiveness and appropriateness of the Company's response in order to identify and implement potential enhancements to the Company's security infrastructure and the broader risk management framework.

companyName: Metropolitan Bank Holding Corp.

ticker: MCB


text: Governance and Oversight of Cybersecurity Risks GECM's cybersecurity program is managed by Great Elm IT Management. The members of the IT Management team collectively have years of experience helping to oversee the information technology infrastructure and processes at GECM and other asset managers. Great Elm IT Management is responsible for supervising and interfacing with providers to implement GECM's monitoring and alert response processes, vulnerability management, changes made to its critical systems, including software and network changes, and various other technological and administrative safeguards.

companyName: Great Elm Capital Corp.

ticker: GECC


text: The Audit Committee exercises its risk oversight function by carefully evaluating information and cybersecurity reports they receive from management; assessing the priorities and roadmap of the cybersecurity program; and making inquiries of management with respect to areas of particular interest to the Board. Senior leadership, including our chief digital officer ("CDO") and our chief information security officer, periodically briefs the Audit Committee on our cybersecurity and information security programs and reviews relevant cybersecurity incidents.

companyName: GOODYEAR TIRE & RUBBER CO /OH/

ticker: GT


text: We review cybersecurity risk as part of our overall risk-management program. This ensures that cybersecurity risk management remains a meaningful priority in our business strategy and operations. Our risk management strategy for cybersecurity generally includes: Identification: We aim to proactively identify the manners in which our business could be materially impacted by cybersecurity risks.

companyName: SUI Group Holdings Ltd.

ticker: SUIG


text: We maintain a Written Information Security Program, or WISP, that defines our organization's cybersecurity policies and procedures. This covers all aspects of cybersecurity, including but not limited to risk management, third party security assessments, security awareness training, acceptable use, endpoint security, patch management, log management, backup and recovery.

companyName: Amylyx Pharmaceuticals, Inc.

ticker: AMLX


text: Our management team, including our CTO and Director of Information Security, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for the day-to-day operation and implementation of our overall cybersecurity risk management program and supervises both our internal cybersecurity team and our retained external cybersecurity consultants. Our management team, including our CTO and Director of Information Security, also supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in the IT environment.

companyName: FIGS, Inc.

ticker: FIGS


text: As a Company with new technology, the Company may be a significant target of attack by competitors, foreign governments and other interested and malicious parties particularly as the knowledge of the potential impact of Company's iTDE Technology becomes more widely known.

companyName: NEXT-ChemX Corporation.

ticker: CHMX


text: Key features of our cybersecurity risk management program include: • Designated security governance, risk and compliance team. Our security governance, risk and compliance team is responsible for maintaining Okta, Inc.'s cybersecurity risk management framework and risk assessments, and for tracking risk mitigation efforts. This team, together with our enterprise risk management team, monitors and regularly reports on our cybersecurity risk profile. Our internal audit team partners with these teams to provide input on the overall effectiveness of Okta, Inc.'s security risk governance and management processes. • Risk assessments. We periodically perform security risk assessments to stay informed about relevant security risks. Functional teams across the business assess risks associated with their specific activities, following an established framework with supervision by the security governance, risk and compliance team. Okta, Inc. has a management-level risk oversight committee, led by internal audit and security risk management personnel, that meets quarterly with other internal business leaders to review the results of these security risk assessments and evaluate the adequacy of any proposed mitigation plans. • Incident response planning. Our cybersecurity incident response plan outlines the processes and procedures for responding to, remediating and resolving a security incident, and defines the roles and responsibilities of company personnel and third-party service providers who may assist in responding to such incidents. In fiscal 2025, we conducted tabletop exercises involving multiple operational teams, as well as an executive preparedness simulation with members of our management team, to educate personnel on their roles in response scenarios. • Security awareness training. We require our employees and contractors to complete general cybersecurity awareness training at least annually. These training sessions advise on employee responsibilities and relevant policies designed to protect us, our information systems and data, as well as our customers' systems and data. From time to time we may also require supplemental cybersecurity training for certain members of our workforce depending on their job responsibilities. • Third-party risk management. We require high risk third-party vendors, suppliers and service providers to undergo a cybersecurity risk assessment prior to contracting with Okta, Inc. Certain third parties are monitored and reassessed on an ongoing basis, depending on their level of risk or in the event of changes to their products or services.

companyName: Okta, Inc.

ticker: OKTA


text: As part of our enterprise information security program, we regularly assess and deploy technical safeguards designed to detect cybersecurity threats and protect our information systems from these threats. In addition, we maintain incident response and recovery plans, the effectiveness of which is tested and evaluated on a regular basis. We also provide privacy and security training, including quarterly phishing education campaigns, to enhance employee awareness of how to detect and respond to cybersecurity threats.

companyName: MKS INC

ticker: MKSI


text: Dow management responsible for developing and executing its cybersecurity policies is comprised of individuals with either formal education and degrees in information technology or cybersecurity, or with experience working in information technology and cybersecurity, including relevant experience in security related industries. Additionally, leaders in Dow's information technology function receive periodic training and education on cybersecurity related topics. Certain leaders also obtain industry certifications, such as Certified Information Systems Security Professional or Certified Information Security Manager.

companyName: UNION CARBIDE CORP /NEW/


text: Security audits and assessments We perform periodic security audits and assessments to test our cybersecurity program. These efforts span across our cybersecurity program, including but not limited to audits, assessments, tabletop exercises, vulnerability scanning and penetration tests. We regularly engage third parties to assess our cybersecurity program, including cybersecurity maturity assessments, penetration testing, and independent review of our security control environment and operating effectiveness. The results of the assessments are included for review by the Security Steering Committee and the Audit and Finance Committee of the Board. We believe our cybersecurity program is enhanced with the results of the audits, assessments and reviews performed.

companyName: PENTAIR plc

ticker: PNR


text: Our information security team consists of dedicated personnel who are experienced information systems security professionals and information security managers with many years of experience across a variety of technology sub-specialties. In particular, our chief information security officer has extensive experience in the management of cybersecurity risk management programs, having served in various roles in information technology and security for over 20 years, including having previously served as the chief security officer of two other publicly traded technology companies. In addition, six of the ten members of our board of directors have expertise in overseeing cybersecurity and information security management.

companyName: Palo Alto Networks Inc

ticker: PANW


text: Our CISO leads our enterprise information security, privacy, and cybersecurity program, which is designed to (i) ensure the security, confidentiality, integrity and availability of our information and information systems; (ii) protect against any anticipated threats or hazards to the security, confidentiality, integrity or availability of such information and information systems; and (iii) protect against unauthorized access to or use of such information or information systems that could result in substantial harm or inconvenience to us, our partners or our customers. We have implemented an industry adopted cybersecurity framework, which is continuously improving. We continuously test and assess our cybersecurity posture, including through third-party risk assessments performed by reputable assessors, consultants, and auditors. Additionally, we perform an annual evaluation of our cybersecurity program.

companyName: CORVEL CORP

ticker: CRVL


text: Key elements of our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems and information; • a formal IT Risk Register documenting and mitigating identified risks, reviewed by management on a quarterly basis; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the regular use of external service providers to independently assess and test security posture, as well as to otherwise assist with aspects of our security processes on an as needed basis; • cybersecurity awareness training of our employees, including incident response personnel and senior management; • a written cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; • tabletop exercises conducted by outside counsel periodically to evaluate our incident response plan and response capabilities; and • a third-party risk management process for key service providers based on our assessment of their criticality to our operations and respective risk profile.

companyName: ALLEGRO MICROSYSTEMS, INC.

ticker: ALGM


text: The Company's cybersecurity risk management program is integrated into the overall risk management framework, including risk identification, assessment, and mitigation across all business areas. We have collaborated with external consultants and built a cybersecurity program designed to protect and safeguard the integrity of our information systems, which aligns with industry best practices and regulatory requirements. To continually enhance the effectiveness of the practice, we regularly assess the program's measures, contractual obligations, and compliance with industry standards. Additionally, we maintain cyber insurance coverage, including protection against social engineering fraud, to further mitigate potential financial losses from cybersecurity incidents.

companyName: HOOKER FURNISHINGS Corp

ticker: HOFT


text: In 2023, Unisys engaged a leading cybersecurity firm to consult on several technical matters relating to cyber resiliency. This resulted in significant changes to our security technical stack and improvements to our processes and organization.

companyName: UNISYS CORP

ticker: UIS


text: The Audit and Compliance Committee of the Board of Directors oversees the Company's cybersecurity risk program and the process employed to monitor and mitigate cybersecurity risks. Members of the management team provide periodic updates to the Audit and Compliance Committee on the status of the Company's cyber risk management program. In addition, cybersecurity risks are reviewed by the Board of Directors as part of the Company's ongoing enterprise risk management program.

companyName: Gaming & Leisure Properties, Inc.

ticker: GLPI


text: The Bank's Technology Steering Committee provides oversight and governance of the Bank's technology program and the information security program. Members of this committee include executive management, our Chief Information Officer, and our Information Security Officer. This committee meets monthly to provide oversight of the risk management strategy, standards, policies, practices, controls, and mitigation and prevention efforts employed to manage security risks. The Chief Operating Officer regularly reports summaries of key issues that would include cybersecurity incidents or other related information from the Technology Steering Committee to the Bank Board.

companyName: PEOPLES BANCORP OF NORTH CAROLINA INC

ticker: PEBK


text: The Company's CISO is responsible for developing and managing the cybersecurity program, including security incident response, remediation, and setting security policy and standards required by applicable law or regulation. The CISO holds a dual-accredited Executive MBA, and Certified Information Security Manager (CISM), Certified Information Systems Auditor (CISA), Certified Data Privacy Solutions Engineer (CDPSE) certifications. The security team holds multiple certifications including but not limited to CISSP, CRISC, CCSFP, and AWS CP, a bug bounty hall of fame member, and a range of experience with different firms. The CISO is informed by the cybersecurity team about the prevention, detection, mitigation, and remediation of cybersecurity incidents through general communications, and reporting. The cybersecurity team is made aware of security risks and incidents by various means including our SIEM, assessments, audit, threat feeds, and security team connections and network.

companyName: CLOVER HEALTH INVESTMENTS, CORP. /DE

ticker: CLOV


text: Material Cybersecurity Risks, Threats and Incidents Due to evolving cybersecurity threats, it has and will continue to be difficult to prevent, detect, mitigate, and remediate cybersecurity incidents.

companyName: FORUM ENERGY TECHNOLOGIES, INC.

ticker: FET


text: (a) As discussed in Item 1A, Risk Factors, we face risks associated with security breaches and other significant disruptions of our IT networks and related information systems, which are essential to our business operations. Due to our Defense/IT strategy and the nature of the customers and activities it serves, we may have a heightened likelihood of being targeted for cyber-attacks or -intrusions, including by governments, organizations or persons hostile to the USG.

companyName: COPT DEFENSE PROPERTIES

ticker: CDP


text: Our board of directors oversees the Company's risk management process. It has delegated to our Audit Committee the primary responsibility for executing oversight of our cybersecurity risk management processes. In performing this role, the Audit Committee receives regular reports from our CISO and other members of management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents, including material security risks and information security vulnerabilities. The Audit Committee also considers regular updates from management on our cybersecurity risk profile based on risk assessments, progress of risk reduction initiatives, third-party auditor feedback, control maturity assessments, and relevant internal and industry cybersecurity incidents. The Audit Committee reports quarterly to our board of directors regarding the Audit Committee's activities in overseeing cybersecurity risk management.

companyName: Elastic N.V.

ticker: ESTC


text: Our cybersecurity risk management program is part of our overall approach to enterprise risk management. Our cybersecurity risk management program seeks to protect our information systems by managing and reducing material risks from cybersecurity threats and by responding to and mitigating cybersecurity incidents. We have designed our cybersecurity risk management program using certain industry practices and frameworks as a guide, including those established by the International Organization for Standardization and the National Institute of Standards and Technology, although we may not meet all technical standards, specifications, or requirements. We employ a cross-functional approach to preserving the confidentiality, security and availability of the employee, customer, supplier, and partner information that we collect and store.

companyName: Silvaco Group, Inc.

ticker: SVCO


text: Cyber Risk Management and Strategy We have developed and maintain an information security program designed to assess, identify, and manage risks from cybersecurity threats. As part of this program, we conduct periodic assessments of our assets to evaluate the effectiveness of applicable security controls. These assessments are informed by industry standard frameworks and include a review of our information security controls to assess cybersecurity maturity compared to our peers and other highly regulated industries. The results of these assessments are reported to the board of directors as part of a cybersecurity update report conducted at least annually.

companyName: Deciphera Pharmaceuticals, Inc.


text: Our board of directors is responsible for oversight and risk management in genera. Our board of directors receives periodic updates from our management team regarding the overall state of our technology management strategy and any relevant risks from cybersecurity threats and cybersecurity incidents.

companyName: MAGELLAN COPPER & GOLD Corp

ticker: MAGE


text: We use third -party service providers to perform a variety of functions throughout our business, such as third party content providers, application providers and contract manufacturing organizations.

companyName: PlayAGS, Inc.


text: Our policies and procedures collectively help execute a risk management approach that accounts for cybersecurity threats specifically targeting us, as well as those that may arise from our engagement with business partners, customers, service providers and other third parties. For example, we have processes designed to oversee and identify material risks from cybersecurity threats associated with our use of third-party service providers. The procedures, capabilities and processes established under our policies are subject to regular review by the Chief Information Security Officer ("CISO") and Chief Technology Risk Officer ("CTRO"). See "Governance" below for more information.

companyName: CAPITAL ONE FINANCIAL CORP

ticker: COF


text: In the event of a cybersecurity incident, our Cybersecurity Incident Response team will act according to our incident management plans to communicate with our executive leadership team and coordinate the response. Our Chief Executive Officer, Chief Financial Officer, General Counsel, Chief Technology and Digital Officer, CISO, and Chief Compliance Officer are responsible for assessing such incidents for materiality, ensuring that any required notification or communication occurs, and determining whether any prohibition on the trading of our common stock by insiders should be imposed before disclosing information about a material cybersecurity event. We maintain cybersecurity insurance coverage to cover costs resulting from cyberattacks, although this coverage may not reimburse us for all losses.

companyName: DELUXE CORP

ticker: DLX


text: Science and Technology Committee specifically assists the Board in its oversight of risks related to cybersecurity. To help ensure effective oversight, the Science and Technology Committee receives reports on information security and cybersecurity from the Company's information technology managers at least four times a year.

companyName: NORTECH SYSTEMS INC

ticker: NSYS


text: Our cybersecurity and risk management program is intended to protect the confidentiality, integrity, and availability of our critical information systems and the data resident on them. Due to the nature of our business and our customers, we face cybersecurity challenges and threats, including attempts to gain unauthorized access to our intellectual property, trade secrets, codebase, proprietary or confidential information, denial-of-service attacks, attacks from foreign nations, as well as threats to our identity and personnel. We have designed our IT systems and processes with the intention that our solutions should defend against the ever-evolving threat landscape while remaining agile to keep up with such threats.

companyName: USBC, Inc.

ticker: USBC


text: To drive readiness, we perform periodic adversarial testing of our cybersecurity posture through penetration testing, using both internal resources and external expertise, as well as table-top and "red team" exercises to understand where processes or controls may be insufficient based on adversarial techniques. We have also implemented technical security controls, maintenance of certain backup and protective systems, physical and system securities measures, and data security protocols.

companyName: TORO CO

ticker: TTC


text: We have adopted a Written Information Security Program (WISP) designed to align with the guidelines recommended by the National Institute of Standards and Technology (NIST). We have made ongoing continuous improvements to our information security program; specifically in the implementation of secure remote access solutions with multifactor authentication, next-generation endpoint detection and remediation, cloud-based security controls, automated scanning and outside validation of security controls. Additionally, we require employees to complete cybersecurity training at least annually. When a specific cyber threat is identified, we may create additional trainings with targeted content for our employees. As part of our efforts to manage our cybersecurity risks, we have engaged an independent firm to assist with conducting penetration tests and provide advice on our information security program. We also carry insurance to mitigate losses from cyber events.

companyName: UNITED FIRE GROUP INC

ticker: UFCS


text: Starbucks assesses, measures, and reports on cybersecurity risk at operational, program or management, and strategic or executive oversight levels. We maintain and periodically update written cybersecurity policies, standards, and controls, which are reviewed by a cross-functional management-level committee and designed to align with business objectives, regulatory requirements, and industry best practices. We train our employees through annual cybersecurity awareness training, phishing simulations, and periodic communications about timely cybersecurity topics and threats. We also implement a variety of tools to monitor our systems and network activity, and we conduct various simulated attacks and penetration tests to assess the effectiveness of these tools.

companyName: STARBUCKS CORP

ticker: SBUX


text: As we have increased our remote workforce in recent years, the Audit and Risk Committee and management have focused on enhancing the security of remote access with trusted devices, endpoint security controls and infrastructure resiliency. As part of this process, we enhanced our security incident response procedures to address risks specific to remote working conditions. We continue to monitor and take reasonable actions intended to improve our security posture with process improvement, testing, simulation training and investments where necessary and appropriate for us.

companyName: Grocery Outlet Holding Corp.

ticker: GO


text: Our cybersecurity risk management program is integrated into our overall risk oversight strategy and utilizes common reporting channels and governance processes that apply across other risk areas. We have a dedicated Chief Information Security Officer ("CISO"), who leads our Information Security team responsible for managing our cybersecurity processes, strategy and controls. Certain members of our Information Security team hold cybersecurity certifications, including the Certified Information Systems Security Professional ("CISSP") and the Certified Information Systems Auditor ("CISA") designations.

companyName: CADENCE DESIGN SYSTEMS INC

ticker: CDNS


text: Management of the Company is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Company, including through the receipt of notifications from service providers and reliance on communications with Bain Capital's CISO, as well as other risk management, legal, information technology, and/or compliance personnel of Bain Capital.

companyName: Bain Capital Specialty Finance, Inc.

ticker: BCSF


text: We believe cybersecurity is critical to advancing our business securely. We face a multitude of cybersecurity threats, have experienced, and will continue to experience, cyber incidents in the normal course of business. Such cybersecurity threats could have a material adverse effect on our business, financial condition, operations, results of operations, performance, cash flows or reputation. Our Sponsor and affiliates and other business contacts may face similar cybersecurity threats, and a cybersecurity incident impacting these persons or entities could materially adversely affect our operations, performance and results of operations.

companyName: OceanTech Acquisitions I Corp.


text: The Partnership's cybersecurity program is designed to safeguard the confidentiality, integrity and availability of data and systems within the Company's environment to effectively support our business objectives and customer needs. Our commitment to cybersecurity focuses on enhancing our prevention, monitoring, and detection response capabilities to identify and respond to evolving threats. We believe cybersecurity is the responsibility of every employee of the Hamilton Company, and it is prioritized each year. We regularly test, educate, and share best practices with employees of the Hamilton Company to raise awareness of cyber threats through a comprehensive security awareness training program. Our Managed Service Provider is responsible for testing our ability to restore our critical infrastructure on a quarterly basis. Additionally, our incident response and disaster recovery plans are reviewed and updated annually. During 2023, we have not encountered cybersecurity challenges that have materially impaired our operations, business strategy or financial condition.

companyName: NEW ENGLAND REALTY ASSOCIATES LIMITED PARTNERSHIP

ticker: NEN


text: We engage external parties, including consultants, independent privacy assessors, computer security firms and risk management and governance experts, to enhance our cybersecurity oversight. For example, we have engaged an outside consulting firm with expertise in the field to help us assess our systems, monitor risk and implement best practices and to support the internal audit of our cyber security programs and we regularly consults with industry groups on emerging industry trends. In addition, as part of our overall risk mitigation strategy, we also maintain cyber insurance coverage. Our cybersecurity policies, standards and procedures include cyber and data breach response plans, which are periodically assessed against the National Institute of Standards and Technology Cybersecurity Framework.

companyName: Ameresco, Inc.

ticker: AMRC


text: We have made significant investments in modernizing, streamlining, and simplifying our technology footprint to both enhance customer experience and strengthen our internal security controls.

companyName: Greenlane Holdings, Inc.

ticker: GNLN


text: Our Board of Directors oversees the Company's risk management process, including cybersecurity risks, directly and through its committees. The Audit Committee of the Board of Directors oversees the Company's risk management program, which focuses on the most significant risks the Company faces in the short-, intermediate-, and long-term timeframes. The Company's CSO regularly updates each of the Board of Directors and the Audit Committee at least twice a year. Such updates include a review of cybersecurity risks affecting the company, related metrics, and any incidents or issues that require attention from the Board of Directors.

companyName: NetApp, Inc.

ticker: NTAP


text: Vistra's Chief Information Officer (CIO) ensures Information Security is built into the Company's larger technology strategy and oversees our Chief Information Security Officer (CISO). Our CISO and his Information Security team are responsible for leading the enterprise-wide information security strategy, policy, standards, architecture, and processes and our Cyber Incident Response Teams under the CISO are responsible for monitoring and analyzing the Company's cybersecurity posture in partnership with Risk and Legal.

companyName: Vistra Corp.

ticker: VST


text: During fiscal 2024, the Audit Committee received regular briefings regarding cybersecurity matters from the Chief Information Officer, who has primary management oversight of cybersecurity matters. The topics reported by the Chief Information Officer include updates on cybersecurity threats, the status of projects to strengthen our information security systems, assessments of the cybersecurity program, and the emerging threat landscape, as well as the results of any third-party and internal assessments conducted. Through the completion of the Transactions, the topics reported included matters relating to the operation of the Company's business as appropriate.

companyName: Treasure Holdco, Inc.


text: Technical Safeguards The Company deploys technical safeguards that are designed to protect Company's data and information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.

companyName: Amalgamated Financial Corp.

ticker: AMAL


text: Further, our corporate audit function is responsible for assessing risk and testing whether, and the extent to which, our information security policies and practices are being implemented effectively within our business and by third party providers. Findings from such reports and related corrective action plans are shared with our CDT team, Company leadership, and the Audit Committee and Corporate Responsibility and Compliance Committee (CRCC) of our Board of Directors. In addition to leveraging the Company's own information technology resources, our Incident Response and Cyber Threat Intelligence teams engage, as needed, third-party cybersecurity risk assessors and consultants to assist in recognizing threats, identifying security vulnerabilities, and evaluating the impact of cybersecurity attacks and incidents when they occur. On a biennial basis, our DTI organization also engages external third-party experts to assess the Company's cybersecurity control maturity across the organization and develops plans to address such experts' recommendations.

companyName: AMGEN INC

ticker: AMGN


text: On a quarterly basis, the Audit Committee discusses with senior management, and internal audit, if applicable, the Company's processes for assessing, identifying, and managing material risks from cybersecurity threats and the state of the Company's cybersecurity processes. The Audit Committee also receives updates on, and monitors, the Company's prevention, detection, mitigation and remediation of cybersecurity incidents.

companyName: Akari Therapeutics Plc

ticker: AKTX


text: We have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations or financial condition. However, as discussed under "Risk Factor — Risks Related to our Business and Managing Growth" in Part I, Item 1A of this Form 10-K, cybersecurity threats could pose multiple risks to us. As cybersecurity threats become more frequent, sophisticated, and coordinated, it is reasonably likely that we will be required to expend greater resources to continue to modify and enhance our protective measures.

companyName: Akebia Therapeutics, Inc.

ticker: AKBA


text: Our Information Technology General Controls are firmly established based on the National Institute of Standards and Technology ("NIST") cybersecurity framework and cover areas such as risk management, data backup, and disaster recovery. We have utilized an outsourced information technology consultant to reduce and monitor security threats and vulnerabilities. As part of our gap analysis, identified vulnerabilities have been, and will continue to be, promptly addressed with our senior business leadership and our Board of Directors.

companyName: UNITED GUARDIAN INC

ticker: UG


text: Our business is dependent upon our computer systems, devices and networks to collect, process and store the data necessary to conduct almost all aspects of our business. We maintain a cybersecurity risk management program, which includes internal and external human resources, processes, controls and technology designed to identify, protect, detect, respond to and manage reasonably foreseeable cybersecurity risks and threats.

companyName: NATURAL HEALTH TRENDS CORP

ticker: NHTC


text: As part of its cybersecurity program, the Company deploys measures to deter, prevent, detect, respond to and mitigate cybersecurity threats, including firewalls, anti-malware, intrusion prevention and detection systems, identity and access controls, software patching protocols, and physical security measures. The Company periodically assesses and tests the Company's policies, standards, processes, and practices that are designed to address cybersecurity (including artificial intelligence-related) threats and incidents, including by assessing current threat intelligence, and conducting tabletop exercises and vulnerability and security testing. The Company has a process to report material results of such testing and assessments to the board, and periodically adjusts the Company's cybersecurity program based on these exercises. The Company engages third parties to conduct part of such testing, including hiring consultants and third parties to conduct our threat assessments and supplement the monitoring of such threats by utilizing online data tools. The Company identifies and oversees cybersecurity risks presented by third parties and their systems from a risk-based perspective. The Company also conducts cybersecurity training for employees (including mandatory training programs for system users).

companyName: Digital Brand Media & Marketing Group, Inc.

ticker: DBMM


text: In addition, we use a combination of technology, policies, procedures, training, and monitoring to promote security awareness and prevent security incidents.

companyName: COMMUNITY WEST BANCSHARES /


text: The Company also maintains a cybersecurity insurance policy that we believe is appropriate for a company of our size and risk profile, but it is possible that it may not fully cover the costs associated with a cybersecurity incident.

companyName: Portillo's Inc.

ticker: PTLO


text: Our cybersecurity risk management extends to risks associated with our use of third-party service providers. For instance, we conduct risk and compliance assessments of third-party service providers that request access to our information assets.

companyName: IDT CORP

ticker: IDT


text: Our Chief Information Security Officer ("CISO") plays a pivotal role in informing the Audit Committee on cybersecurity risks. He provides comprehensive briefings to the Audit Committee on a quarterly basis or more frequently as needed. These briefings encompass a broad range of topics, including emerging threats, the status of ongoing cybersecurity initiatives, and incident reports and learnings from any cybersecurity events. The Audit Committee actively participates and offers guidance in strategic decisions related to cybersecurity. This involvement helps ensure that cybersecurity considerations are integrated into our broader strategic objectives.

companyName: AUTONATION, INC.

ticker: AN


text: Our systems periodically experience directed attacks intended to lead to interruptions and delays in our service and operations as well as loss, misuse, or theft of personal information (of third parties and employees) and other data, confidential information, or intellectual property. To date, we have not identified any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents. For additional information about these risks, see Part I, Item 1A, "Risk Factors" in this Annual Report.

companyName: GRIID Infrastructure Inc.


text: In connection with our use of third party service providers, we have certain processes in place to oversee and identify cybersecurity risks from threats and incidents. To date, we have not been materially impacted by risks from cybersecurity threats or incidents and we are not aware of cybersecurity threats or incidents that are reasonably likely to materially affect our business. However, there could be cybersecurity threats or incidents in the future that may adversely affect our business.

companyName: NETWORK-1 TECHNOLOGIES, INC.

ticker: NTIP


text: Risk Management and Strategy Standard BioTools regularly assesses risks from cybersecurity threats; monitors our information systems for potential vulnerabilities; and tests those systems pursuant to our cybersecurity policies, processes, and practices, which are integrated into our overall risk management program. To protect our information systems from cybersecurity threats, we use various security tools that are designed to protect against cyber security incidents, as well as to identify, escalate, investigate, resolve, and recover from security incidents in a timely manner. As part of this program, we conduct periodic assessments of our assets to evaluate the effectiveness of applicable security controls. These assessments are informed by industry standard frameworks (NIST, ISO) and include a review of our information security controls, policies and procedures to assess cybersecurity maturity against industry standards. In accordance with our IT Risk Management Program, we actively identify and assess risks based on the probability and potential impact to key business systems and processes. All risks identified are assessed to identify the range of possible outcomes and risks are prioritized by their level of importance. Each risk is assigned to a risk owner who will track, monitor, and report on the status with a risk response aligned to the probability and impact of occurrence. Risks that are considered high are incorporated into our corporate risk management program overseen by the Audit Committee of our Board of Directors (the "Audit Committee") and our Board of Directors.

companyName: STANDARD BIOTOOLS INC.

ticker: LAB


text: The audit committee receives reports from management on our cybersecurity risks at least annually. In addition, management updates the audit committee regarding all material cybersecurity incidents, as well as any incidents with lesser impact potential that management, in its discretion, determines may be relevant for audit committee review. The audit committee reports to the full board regarding its activities, including those related to cybersecurity.

companyName: Nuvalent, Inc.

ticker: NUVL


text: Our suppliers, subcontractors and third-party service providers are subject to cybersecurity obligations and controls as aligned with DFARS and U.S. Federal Acquisition Regulations ("FARS") requirements. We are making strides to ensure suppliers, subcontractors and third-party service providers are knowledgeable and aligned with DFARS and FARS requirements. We are also developing an enhanced program for our suppliers, subcontractors, and third-party service providers to agree to cybersecurity-related contractual terms and conditions of purchase to ensure their commitment to the mandates. Many of these contractors, suppliers or third parties are also subject to regulatory requirements in mandatory government procurement clauses, including those contained in the DFARS and FARS, which obligate adherence to a generally accepted cybersecurity framework, such as NIST, and occasional assessment of their implementation of cybersecurity controls as a condition of contract award or during contract performance. Finally, we require these third parties to notify us of cybersecurity incidents that impact us.

companyName: COMTECH TELECOMMUNICATIONS CORP /DE/

ticker: CMTL


text: In the event of a cybersecurity incident, our response and mitigation efforts are guided by the Incident Response Plan ("IRP"), which provides guidance on how to respond to, and recover from, a material cyber incident requiring an organized response. We conduct tabletop exercises testing the principles and procedures set forth in our IRP based on lessons learned.

companyName: Symbotic Inc.

ticker: SYM


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K, to protect the confidentiality, integrity and availability of our critical systems and information. Our enterprise risk management program considers cybersecurity threats as part of our overall risk assessment process. We perform these risk assessments to inform our risk mitigation strategies and prioritize cybersecurity initiatives. Our cybersecurity risk assessment process includes network and endpoint monitoring, vulnerability assessments, and penetration testing, and we believe helps identify our cybersecurity threat risks by aligning our processes to standards set by the National Institute of Standards and Technology ("NIST"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST standards as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. The results of our cybersecurity assessments are regularly shared with senior management and the Board of Directors. Additionally, we have implemented technologies, controls and processes to aid in our efforts to assess, identify, manage, and monitor material cybersecurity risks, their severity, and potential mitigation. We regularly review and update our cybersecurity processes to help address the evolving cybersecurity landscape and legal requirements, providing clear guidelines for our employees and third-party service providers.

companyName: SunCoke Energy, Inc.

ticker: SXC


text: We and the Manager engage an independent cybersecurity vendor to review, assess, and make recommendations regarding our information security program and information technology strategic plan. We recognize that third-party service providers introduce cybersecurity risks. In an effort to mitigate these risks, before engaging with any third-party cybersecurity service provider, we conduct due diligence to evaluate their cybersecurity capabilities. Additionally, we endeavor to require third-party service providers with access to personally identifiable information to adhere to our security standards and protocols.

companyName: Granite Ridge Resources, Inc.

ticker: GRNT


text: News Corp's Board of Directors oversees the Company's processes for identifying, assessing and managing significant risks facing the Company, and each of the Board's standing committees assists the Board within the areas delegated to that committee. The Board of Directors has delegated to the Audit Committee primary responsibility for overseeing risks related to cybersecurity, including reviewing with management the Company's major cyber-related risk exposures and the steps that have been taken to monitor and control such exposures. The Audit Committee generally receives reports at least quarterly from the CTO and CISO on the Company's cybersecurity program covering various topics, including incident reporting, a review of the global cyber risk-map, updates on NIST maturity assessments, employee training and technology solutions and other practices designed to minimize the risks associated with cybersecurity threats, and updates the Board of Directors as appropriate.

companyName: NEWS CORP

ticker: NWSA


text: We use third-party service providers to perform a variety of other functions throughout our business, such as application providers, hosting companies, and supply chain resources (such as shipping). We have a vendor management program to manage cybersecurity risks associated with our use of these providers. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve risk assessments, data privacy and security questionnaires, risk assessments, and imposition of cybersecurity-related contractual obligations on the vendor.

companyName: NETSCOUT SYSTEMS INC

ticker: NTCT


text: Role of Management Pursuant to our ERM Program charter, our Executive Committee is responsible for assessing and managing the Company's exposure to enterprise risks. The Executive Committee is composed of the CEO and his direct reports, including the CDIO. Our CISO and the cybersecurity teams are primarily responsible for identifying, assessing, monitoring and managing our cybersecurity threats. They receive information regarding cybersecurity incidents and threats from the SOC and through internal escalation procedures detailed in the CIRP. The CISO then provides periodic reports to the Executive Committee, including reporting on significant cybersecurity incidents and resulting remedial actions, the cybersecurity team's strategic plan, the results of associate trainings, and any other notable cybersecurity matters.

companyName: Ferguson Enterprises Inc. /DE/

ticker: FERG


text: Under the Cybersecurity Program, cybersecurity matters are generally managed by a combination of functional groups that report to CNH N.V.'s global leadership team, as appropriate, on matters such as enterprise level cybersecurity initiatives, threat intelligence and product cybersecurity risks and remediations.

companyName: CNH Industrial Capital LLC


text: The Company employs a multi-layered approach in an effort to assess, identify and manage risks from cybersecurity threats:

companyName: REPUBLIC BANCORP INC /KY/

ticker: RBCAA


text: Material Cybersecurity Threat Risks The Company has not experienced any material losses relating to cybersecurity threats or incidents for the year ended June 30, 2024. We are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. Although we have a robust cybersecurity program that is designed to assess, identify, and manage material risks from cybersecurity threats, we cannot provide absolute surety that we have properly identified or mitigated all vulnerabilities or risks of incidents. The Company, and the third parties that the Company engages, are subject to constant and evolving threats of attack and cybersecurity incidents may be more difficult to detect for periods of time.

companyName: Kentucky First Federal Bancorp

ticker: KFFB


text: The Company has implemented a risk-based, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. At the management level, our Cybersecurity Risk Management Committee, composed of senior personnel representing functional and business areas, including Information Technology, Financial Reporting and Legal, has broad oversight of the Company's risk management processes. The Cybersecurity Risk Management Committee meets periodically to discuss the risk management measures implemented by the Company to identify and mitigate data protection and cybersecurity risks and report on ongoing training and cybersecurity matters. The committee works closely with the Information Technology and Legal departments to oversee compliance with legal, regulatory and contractual security requirements. The Cybersecurity Risk Management Committee members annually attend the Board's Audit Committee meeting, and more frequent meetings if appropriate, to report on any material developments.

companyName: SILVERBOW RESOURCES, INC.


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") oversight of cybersecurity and other information technology risks. The Committee oversees implementation of our cybersecurity risk management program by management and out external information technology service provider.

companyName: eFFECTOR Therapeutics, Inc.

ticker: EFTR


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity and availability of our critical systems and information, including our customers', vendors', partners' and employees' data, including personal information.

companyName: CADENCE DESIGN SYSTEMS INC

ticker: CDNS


text: Our management and Board of Directors recognize the importance of maintaining the capacity, reliability, and security of our information technology environment and data security infrastructure. Both management and the Board of Directors are actively involved in our enterprise risk management process, which specifically identifies cybersecurity as a key risk to us. To address cybersecurity risk, we have instituted policies, processes, and internal controls aligned with the framework established by the Secure Controls Framework, a meta-framework that reflects the standards of multiple security frameworks including those of the National Institute of Standards and Technology ("NIST") and International Organization for Standardization ("ISO"). The focus of our cybersecurity program is to preserve the confidentiality, security, and availability of our systems and data, mitigate cybersecurity threats, and effectively respond to and recover from cybersecurity incidents when they occur.

companyName: ACUITY INC. (DE)

ticker: AYI


text: We have a cybersecurity Incident Response Plan (IRP) that sets forth a process to obtain information, coordinate activities, assess results, and communicate applicable developments to our employees, law enforcement, other external parties and agencies, and our Board. The IRP includes the following major components: preparation, detection and analysis, containment, eradication, notification, recovery, reporting, and lessons learned. Specific incident response playbooks have also been prepared for data breaches, malware, unauthorized remote access, and ransomware, which include applicable legal protocols. We have also retained certain third-party experts to assist us with various aspects of incident assessment and response in the event those services become necessary or useful.

companyName: VALERO ENERGY CORP/TX

ticker: VLO


text: Invesco’s information security program is led by its Chief Information Security Officer (CISO) who reports directly to the GCSO and has extensive experience in information security and risk management. Invesco’s information security program is designed to oversee all aspects of information security risk and seeks to ensure the confidentiality, integrity, and availability of information assets, including the implementation of controls aligned with industry guidelines and applicable statutes and regulations to identify threats, detect attacks and protect its and our information assets. The cybersecurity program includes the following: • Proactive assessments of technical infrastructure and security resilience are performed on a regular basis which include penetration testing, offensive testing and maturity assessments. • Conducting due diligence on third-party service providers regarding cybersecurity risks prior to on-boarding, periodic assessment of cybersecurity risks for third-party service providers and continuous monitoring for new third-party cybersecurity incidents. • An incident response program that includes periodic testing and is designed to restore business operations as quickly and as orderly as possible in the event of a cybersecurity incident at Invesco or third-party. • Mandatory annual employee security awareness training, which focuses on cyber threats and security in general. • Regular cyber phishing tests throughout the year to measure and raise employee awareness against cyber phishing threats.

companyName: Invesco Galaxy Bitcoin ETF

ticker: BTCO


text: Education, training and preparedness efforts. Education, training and preparedness are an important part of our information security program. In connection with our education and training efforts, we have developed and implemented a set of Company-wide policies and procedures regarding cybersecurity matters that impose responsibility on our employees through the course of their work to: (i) protect our systems, technology, infrastructure and data from cybersecurity threats, (ii) quickly report known or suspected cybersecurity incidents or other suspicious activity through designated channels and respond effectively to such events and (iii) use Company and personal information technology in a secure manner. In addition, we generally mandate information security training for our employees and our software developers generally receive additional technical training, each on an annual basis. In connection with our preparedness efforts, we periodically conduct tabletop exercises with the goal of helping management effectively respond to cybersecurity incidents that may occur. We also maintain documented incident response policies to help ensure that our response activities are consistent and appropriate. Governance. See the disclosure under the caption "Cybersecurity Governance" below.

companyName: IAC Inc.

ticker: IAC


text: We engage third parties in connection with our risk assessment processes. We require all external service providers who may impact our cybersecurity risks to certify that they can set up and maintain proper security consistent with all applicable laws, manage security effectively for their work with us, and quickly inform us if they think their security has been breached.

companyName: Revolve Group, Inc.

ticker: RVLV


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, our Director of IT along with management evaluates material risks from cybersecurity threats against our overall business objectives and reports to the Board, which evaluates our overall enterprise risk.

companyName: DELCATH SYSTEMS, INC.

ticker: DCTH


text: Our Board of Directors has established a Risk Committee to assist the Board in its oversight of risk. As part of its responsibilities, the Risk Committee oversees management's implementation of our cybersecurity and risk management program.

companyName: JANUS HENDERSON GROUP PLC

ticker: JHG


text: When engaging third-party vendors, operating subsidiaries are directed to use cybersecurity screening and risk assessment measures and to include appropriate data security privacy terms and conditions in vendor agreements, including, as necessary for certain vendors, a duty to report certain security incidents to the Company's information technology team. Third-party engagement procedures generally include (1) the identification and risk assessment of third-party service providers; (2) minimum cybersecurity practices required to be met by such third-party service providers in order for them to do business with the Company; (3) due diligence processes used to evaluate the adequacy of cybersecurity practices of such third-party service providers; and (4) periodic assessment of such third-party service providers based on the risk they present and the continued adequacy of their cybersecurity practices.

companyName: OLD REPUBLIC INTERNATIONAL CORP

ticker: ORI


text: Third-Party Risk Management Advisors Recognizing the complexity and the evolving nature of cybersecurity threats, we engage with a range of external experts, including cybersecurity assessors, consultants, and auditors in evaluating and testing our cybersecurity program and practices. This ecosystem enables us to leverage specialized knowledge and insights, ensuring our cybersecurity program and practices remain attuned to our Company's particular needs and vulnerabilities. Our collaboration with these third-parties includes annual penetration tests on externally facing systems, annual external and internal risk assessments and subject matter expertise consultation on risk remediation and security enhancements.

companyName: Atlas Energy Solutions Inc.

ticker: AESI


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. "Risk Factors" in this Annual Report, including "If our information technology systems or those of third parties with whom we work, or our data are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; and other adverse consequences."

companyName: Syndax Pharmaceuticals Inc

ticker: SNDX


text: Oaktree maintains a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. This program is integrated into Oaktree's overall risk management processes and focuses on the corporate information technology environment.

companyName: Brookfield Oaktree Holdings, LLC

ticker: OAK-PA


text: Our CISO is responsible for the overall administration and execution of the information security program and reports to our Chief Risk Officer ("CRO"). Our CISO has over thirty years of experience working in information security for a variety of companies and organizations, including multiple financial institutions. The CISO monitors the security of, among other things, systems, applications, tools, databases, computers, websites, cloud infrastructure, vendor tools, and user access systems. The CISO performs an annual information security risk assessment, which, among other things, documents inherent risk levels and controls in place to manage those risks. The information security risk assessment is presented to the Board annually.

companyName: EAGLE BANCORP INC

ticker: EGBN


text: The Chief Information Security Officer ("CISO") regularly updates the Audit Committee and Allstate Board on Information Security Program status, cybersecurity risk management, the control environment, emerging threat intelligence and key risk and performance measurements. In addition, the CISO provides updates to senior leadership, the Audit Committee and the Allstate Board, as appropriate.

companyName: ALLSTATE CORP

ticker: ALL


text: Our IT department and Information Security Office, supported by our Global Privacy Office, regularly evaluate cybersecurity risks. Cybersecurity risks are considered within our ERM framework, which are assigned risk owners to develop and manage mitigation programs. Our annual ERM program is reviewed and overseen by the Audit Committee and is presented to the Board annually. We maintain an internal Privacy and Security Steering Committee, co-chaired by our CISO and Global Privacy Officer and made up of members from IT, legal, privacy and international operations, and which is tasked with review of, and oversight over, our privacy and data security programs, policies and strategy. Our Governance, Risk and Compliance Committee, made up of members of legal, operations, human resources and internal audit as well as our CISO, provides additional support for enterprise risk management assessment and governance by monitoring our ERM program, and engaging with compliance functions across the organization to identify gaps, support corrective action plans and promote best practices. Our internal control over financial reporting, including key business process controls and IT general controls, are reviewed and tested by our Internal Audit function annually.

companyName: BRIGHT HORIZONS FAMILY SOLUTIONS INC.

ticker: BFAM


text: The Executive Team, comprised of chief-level officers, annually reviews and provides recommendations on the Enterprise Security Policy, Security Incident Response Plan, and the Business Resiliency Management Policy. The President and Chief Executive Officer (CEO) annually approves each policy for submission to the board of directors for its consideration and ultimate approval. In addition to the board of directors and management committees, we have an Information Security Working Group (ISWG). Membership in the ISWG consists of leadership and business partners from a cross section of areas, including operational risk, information security, information technology, legal, operations, and others throughout FHLBank. The breadth and depth of experience of members of the ISWG allows for detailed discussions on information security trends and emerging risks which can be elevated to the Technology Committee for action or further discussion, as necessary and appropriate.

companyName: Federal Home Loan Bank of Topeka


text: While the Board of Directors has overall responsibility for risk oversight, our Audit Committee oversees cybersecurity risk matters. The Audit Committee is responsible for reviewing, discussing with management, and overseeing our data privacy, information technology and security and cybersecurity risk exposures. On at least an annual basis, the ED, IT & IS reports to the Audit Committee on information security and cybersecurity matters, including significant information technology risks, material threats (and the potential impact of those exposures on our business, financial results, operations and reputation) and the steps implemented by management to monitor and mitigate exposures. He also apprises the Audit Committee promptly of any high priority cybersecurity incidents, consistent with our Incident Management and Response Policy, and provides updates to the full Board as needed.

companyName: Arbutus Biopharma Corp

ticker: ABUS


text: We also identify our cybersecurity threat risks by comparing our processes to standards set by NIST, as well as by engaging experts to attempt to infiltrate our information systems. To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and protect against and respond to cybersecurity incidents, we undertake the following activities: • monitor emerging data protection laws and implement changes to our processes that are designed to comply with such laws; • through our policies, practices and contracts (as applicable), require employees, as well as third parties that provide services on our behalf, to treat confidential information and data with care; • employ technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence; • provide regular, mandatory training for our employees and contractors regarding cybersecurity threats as a means to equip them with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices; • conduct regular phishing email simulations for all employees and contractors with access to our email systems to enhance awareness and responsiveness to possible threats; • conduct at least annual cybersecurity management and incident training for employees involved in our systems and processes that handle sensitive data; • conduct annual tabletop exercises facilitated by a third party to simulate a response to a cybersecurity incident and use the findings to improve our processes and technologies; • review and revise our incident response plan at least annually to ensure that it is current with respect to our technology and current risks; • leverage the NIST incident handling framework to help us identify, protect, detect, respond and recover when there is an actual or potential cybersecurity incident; • carry information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident; • review privileged network and application accounts every three (3) months for appropriate access privileges, and review user accounts every six (6) months; and • review and test our disaster recovery plan annually to confirm effective and efficient recovery processes are in place to support business continuity in the event of a disaster.

companyName: G1 Therapeutics, Inc.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain company management, including our Head of IT, who holds a Microsoft Certification, and our Chief Operating Officer, who earned a Cybersecurity for Directors certificate from the Corporate Governance Institute.

companyName: Equillium, Inc.

ticker: EQ


text: Security Tools and Technologies: We utilize advanced security tools and technologies, along with control policies and active review procedures, to strengthen authentication and access protection. This includes implementing multi-factor authentication, encryption, and continuous monitoring of network activities.

companyName: CALAVO GROWERS INC

ticker: CVGW


text: from Cybersecurity Threats have not encountered cybersecurity challenges that have materially impaired our operations or financial standing during the fiscal year ended December 31, 2024.

companyName: Ainos, Inc.

ticker: AIMD


text: Oversight of Risk Management Generally Our Board has extensive involvement in the oversight of risk management related to us and our business. The Board accomplishes this oversight both directly and through its Audit Committee, Compensation Committee, Nominating and Corporate Governance Committee, and Privacy, Security and Technology Committee, each of which assists the Board in overseeing a part of our overall risk management and regularly reports to the Board. The Audit Committee represents the Board by periodically reviewing our accounting, reporting and financial practices, including the integrity of our financial statements, the oversight of administrative and financial controls, our compliance with legal and regulatory requirements and our policies with respect to risk assessment and risk management. Through its regular meetings with management, including the finance, legal and internal audit functions, the Audit Committee reviews and discusses significant areas of our business and related risks and summarizes for the Board areas of risk and any mitigating factors. The Compensation Committee considers, and discusses with management, management's assessment of certain risks, including whether any risks arising from our compensation policies and practices for our employees are reasonably likely to have a material adverse effect on us. The Nominating and Corporate Governance Committee oversees and evaluates programs and risks associated with Board organization, membership and structure, succession planning and corporate governance. In addition, our Board receives periodic detailed operating performance reviews from management. The Privacy, Security and Technology Committee represents the Board by periodically reviewing and discussing with Company management the Company's major risk exposures relating to privacy, cybersecurity, and technology, and the steps the Company takes to detect, monitor, and actively manage such exposures.

companyName: ZoomInfo Technologies Inc.

ticker: GTM


text: Our enterprise risk management framework considers cybersecurity risk alongside other applicable risks as part of our overall risk assessment process. Within our comprehensive enterprise risk management framework, our cybersecurity risk management program is focused on assessing, identifying, and managing risks arising out of our use of information technology ("IT") including the risk of cybersecurity incidents and threats. The program is informed by recognized frameworks such as the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). Our cybersecurity team utilizes a variety of tools, processes and outside resources to continue to raise and maintain its maturity across the elements of NIST CSF.

companyName: HAIN CELESTIAL GROUP INC

ticker: HAIN


text: TIAA actively monitors the current cyber threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Company in connection with its day-to-day commercial real estate, investment, and other operations.

companyName: Nuveen Global Cities REIT, Inc.


text: We regularly engage consultants, auditors, and other third parties to assist in developing, maintaining, and enhancing our cybersecurity risk assessment program. These third-party engagements supplement our internal capabilities and help ensure the robustness of our program. Examples of these engagements include penetration testing of our customer facing domains, quarterly cybersecurity briefings with outside counsel, and an annual assessment of our overall cybersecurity program. We maintain policies and procedures to identify and monitor cybersecurity risks associated with these third-party service providers, particularly those with access to customer, employee, or other sensitive data. Our selection and oversight of these providers includes diligence reviews, contractual protections, and other measures to mitigate these risks over the entire lifecycle of the relationship, including through implementation of the CIS Critical Security Controls. In addition to these prevention measures, we work proactively to detect and minimize the impact of cybersecurity incidents. We have a written incident response plan designed to ensure the appropriate internal and, if necessary, external resources are employed to promptly and effectively respond to potential breaches, minimize any related damage, and avoid disruption to our operations. We routinely test our incident response process through simulated incidents. No risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. While we have not experienced any cybersecurity incidents or threats that have materially impacted us or our business, we have encountered incidents in the past, which we have used to improve our program and defenses. Since it is possible we could experience a material cybersecurity incident in the future, we remain diligent in maintaining and continuously improving our program in an effort to prevent such incidents and, if one was to occur, to manage it effectively.

companyName: NEOGEN CORP

ticker: NEOG


text: We have developed and implemented a cybersecurity and information security risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. We regularly assess risks from cybersecurity threats; monitor our information systems for potential vulnerabilities; and test those systems pursuant to our cybersecurity policies, processes, and practices, which are integrated into our overall risk management program.

companyName: NEOGENOMICS INC

ticker: NEO


text: Our Board of Directors oversees the execution of our cybersecurity strategy and the assessment of cybersecurity risks, along with the actions that we take seeking to mitigate and address those cybersecurity risks. Our Chief Information Officer (CIO) oversees our cybersecurity activities and leads our team of cybersecurity professionals responsible for our cybersecurity program and is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents as part of our cybersecurity programs. Our CIO and other cybersecurity professionals provide periodic updates regarding cybersecurity risks to our Cyber Incident Response Steering Committee and Board of Directors.

companyName: Fat Brands, Inc

ticker: FATAQ


text: Processes and Risk Assessment We rely on the cybersecurity program implemented by GECM. In order to assess, identify and manage material risks from cybersecurity threats, GECM has implemented a cybersecurity program for GEG and its subsidiaries, which is focused on (i) protecting the confidentiality of business, client, fund investor and employee information; (ii) maintaining the security and availability of its systems and data; (iii) supporting compliance with applicable laws and regulations; (iv) documenting cybersecurity incidents and its responses; and (v) notification of cybersecurity incidents to, and communications with, appropriate internal and external parties.

companyName: Great Elm Group, Inc.

ticker: GEG


text: Our executive team is informed about and monitors the prevention, detection, evaluation, mitigation, and remediation of key cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external advisors engaged by us, and alerts and reports produced by security tools deployed in the IT environment.

companyName: Mersana Therapeutics, Inc.


text: Valkyrie will maintain reasonably up-to-date versions of system security agent software which must include malware protection and reasonably up-to-date patches and virus definitions, installed the extent technically feasible, personal information stored on portable devices, such as laptops or tablets, must be password protected, as must all records and files transmitted across public networks or wirelessly, to the extent technically feasible. computer systems must be monitored for unauthorized use of or access to personal information.

companyName: CoinShares Bitcoin ETF

ticker: BRRR


text: The Company proactively manages its cybersecurity and data privacy risks with organizational and technical controls including a comprehensive set of policies and procedures for assessing, identifying, and managing material risks from cybersecurity threats which have been integrated into the Company's overall risk management strategy and processes. The Company seeks to address cybersecurity risks through a comprehensive approach that is focused on implementing robust protective measures, promoting user awareness and education, continuously monitoring for potential threats, and swiftly responding to any security incidents to ensure the confidentiality, integrity, and availability of sensitive information.

companyName: Perimeter Solutions, Inc.

ticker: PRM


text: One of the key functions of our Board of Directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board of Directors administers its cybersecurity risk oversight function primarily through the Audit Committee. Our CIO provides periodic briefings to the Audit Committee regarding our cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity policies and procedures, activities of third parties, and the like.

companyName: GrowGeneration Corp.

ticker: GRWG


text: The Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the Committee, where it deems appropriate, regarding any cybersecurity incidents it considers to be potentially significant.

companyName: PUMA BIOTECHNOLOGY, INC.

ticker: PBYI


text: Employees and Training Employees are an integral part in the line of defense against cybersecurity risks. Every employee is responsible for protecting Company and client information. Accordingly, employees complete formal training including regular simulated phishing assessments designed to sharpen threat detection and reporting capabilities. Our employees are supported with solutions designed to identify, prevent, detect, respond to, and recover from incidents. Notable technologies include firewalls, intrusion detection systems, managed endpoint security automation and response capabilities, user behavior analytics, multi-factor authentication when available, encrypted data backups, and business continuity applications. Notable services include 24/7 security monitoring and response, real-time vulnerability scanning, third-party monitoring, and threat intelligence.

companyName: CFSB Bancorp, Inc. /MA/

ticker: CFSB


text: Related to Cybersecurity Risks Our director of information technology ("Director of IT") is responsible for the strategic leadership and direction of the Company's information technology organization. The Director of IT has helped organizations define and implement information technology strategies for over twenty years. Prior to joining the Company, he served in senior information technology roles for several biotechnology companies. Along with members of our finance, legal, and operations teams, the Director of IT sits on a newly-formed cyber subcommittee ("subcommittee"). The subcommittee reports to the Chief Operating Officer ("COO") and Chief Financial Officer ("CFO"), and outputs from the Committee are provided by the COO and CFO to the Company's executive team and the board.

companyName: X4 Pharmaceuticals, Inc

ticker: XFOR


text: We have engaged a third-party consultant in connection with our risk management and assessment processes. Our consultant assists us in the design and implementation of our cybersecurity policies and procedures, as well as the monitoring and testing of our safeguards. In the event of an incident, our incident response plan outlines the steps to be followed from incident detection to mitigation, recovery and notification, and involves notifying senior management, our legal department, and the board of directors and/or our audit committee, if appropriate, and mitigation and remediation steps by our third-party consultant.

companyName: TECOGEN INC.

ticker: TGEN


text: We believe we are appropriately staffed (as supported by our outsourced IT provider) to support a healthy cybersecurity posture given our size and scope. Our Chief Financial Officer, who reports to the Chief Executive Officer, is directly responsible for IT functions.

companyName: Autonomix Medical, Inc.

ticker: AMIX


text: The Board is responsible for the oversight of cybersecurity risk management, as well as the selection of a Chief Information Security Officer ("CISO"), the management official responsible for administering and executing the information security program. The Board's Technology Oversight Committee ("TOC") assists the Board in its oversight of the information security program. The TOC reviews information security metrics, oversees significant instances of non-compliance with the information security policy and monitors remediation of those instances, and reviews the appointment of the CISO for recommendation to the Board.

companyName: EAGLE BANCORP INC

ticker: EGBN


text: Seaboard recognizes the importance of maintaining the trust and confidence of its customers, business partners, employees and other stakeholders. The Board is involved in the oversight of Seaboard's enterprise risk management program, of which cybersecurity is a component. Seaboard's information security program includes cybersecurity policies, standards, processes and practices that are based on recognized frameworks established by the Center for Internet Security ("CIS") and other applicable industry standards. Seaboard seeks to address cybersecurity risks through a comprehensive, company-wide information security program that is focused on preserving the confidentiality, integrity and availability of the information that Seaboard collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: SEABOARD CORP /DE/

ticker: SEB


text: Dime has processes to oversee and identify material risks from reported cybersecurity threats from any third-party service providers or vendors. The Bank's Third-Party Risk Management Program requires an initial due diligence, on-going monitoring, and annual recertification of third-party cybersecurity controls.

companyName: Dime Community Bancshares, Inc. /NY/

ticker: DCOM


text: During 2021, we identified malware on our system resulting from a cyberattack. We successfully quarantined the malware without disruption to our operations. However, this quarantine required a rebuild of a triple-redundant server. While moving one of our critical systems to a newly rebuilt server, we experienced a server outage that resulted in approximately 1,700 flight cancellations. We estimate the impact of the outage negatively impacted our 2021 financial results by approximately $16 million (pre-tax). Approximately half of the loss we incurred in 2021 from this incident was recovered through our cyber insurance policy during the year ended December 31, 2023. Based on our assessment, we do not believe the incident has or will materially affect us, including our operations, business strategy, results of operations, or financial condition. For the year ended December 31, 2023, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – Cybersecurity incidents, hardware or software failures or other information technology disruptions may negatively impact our operations, reputation and financial condition."

companyName: SKYWEST INC

ticker: SKYW