text: Due diligence is performed prior to onboarding all third parties with access to the Company's information assets to ensure such parties maintain security controls contractually required by the Company as part of its Third Party Risk Management Program. The Company provides ongoing monitoring, including cybersecurity maturity assessments, of third parties using a risk-based approach to determine the extent and frequency of periodic assessments. Semi-annual cybersecurity maturity assessments are conducted by the Company's Corporate Information Security team on its information systems using industry-standard guidelines and tools, including the National Institute of Standards Cybersecurity Framework, the Federal Financial Institutions Examination Council Cybersecurity Assessment Tool, and the Center for Internet Security Critical Security Controls.

companyName: WEBSTER FINANCIAL CORP

ticker: WBS


text: Our business is highly dependent on information technology. In the ordinary course of our business, we store sensitive data, including our proprietary business information and that of our business partners, and non-public personally identifiable information of mortgage borrowers, on our networks. The secure maintenance, processing and transmission of this information is critical to our operations. Computer malware, viruses, ransomware and phishing attacks remain widespread and are increasingly sophisticated. We are frequently the target of attempted cyber threats, as are many other organizations within the financial servicing industry. We continuously monitor and develop our information technology networks and infrastructure to help prevent, detect, address and mitigate the risk of unauthorized access, misuse, computer viruses, and other events that could have a security impact. Despite these security measures, our information technology and infrastructure may be vulnerable to attacks by hackers or breached due to employee error, malfeasance or other disruptions. Any such breach could compromise our networks and the information stored there could be accessed, publicly disclosed, lost or stolen. Such access, disclosure or other loss of information could result in legal claims or proceedings, liability under laws that protect the privacy of personal information, regulatory penalties, disruption to our operations or trading activities or damage to our reputation, all of which could have a material adverse effect on our business, results of operations and financial condition. For additional information on these risks, see Item 1A, "Risk Factors".

companyName: Korth Direct Mortgage Inc.

secItem: Item 1C


text: Our Board, in coordination with the Audit Committee, oversees our ERM process, including the management of risks from cybersecurity threats. The Board and the Audit Committee receive regular presentations and reports on cybersecurity risks from our CISO, which address a wide range of topics including recent developments, evolving standards, security effectiveness, vulnerability assessments, third-party and independent reviews, the threat environment, incident response planning, remediation efforts, employee training and awareness (including the results of our annual cybersecurity training), technological trends and information security considerations arising with respect to our peers and third parties. On a quarterly basis, our Audit Committee discusses our approach to cybersecurity risk management with our CISO and other members of management, including planned initiatives to help the Board evaluate the effectiveness of our cybersecurity program. One of our independent directors, Ms. Hammoud, a seasoned software executive, participates in Audit Committee meetings during cybersecurity sessions and provides direct guidance to our CISO outside of regularly scheduled Board meetings on cybersecurity matters.

companyName: PROS Holdings, Inc.


text: Under the supervision of our chief technology officer, we employ a multi-layered approach to cybersecurity, deploying a suite of technologies to protect our endpoints, applications, data, and network. We in corporate various security controls and technologies such as firewalls, encryption mechanisms, next-generation anti-virus, multi-factor authentication and access controls. Furthermore, we invest in threat detection and prevention solutions to proactively identify and mitigate continuously changing cyber threats.

companyName: GSE SYSTEMS INC


text: The Company conducts periodic assessments of the Company's policies, standards, processes and practices. Summary results of such assessments are evaluated by the CISO to assist the Company in adjusting its cybersecurity policies, standards, processes and practices; the CISO reviews critical results with the TIS Committee.

companyName: ALTISOURCE PORTFOLIO SOLUTIONS S.A.

ticker: ASPS


text: Our Chief Financial Officer and head of IT provide periodic briefings to the audit committee regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. Our audit committee provides updates to the board of directors on such reports.

companyName: Oric Pharmaceuticals, Inc.

ticker: ORIC


text: We expect that cybersecurity will become an important part of our risk management processes and an area of focus for our Board of Directors and management. We expect that our Board of Directors will be responsible for the oversight of risks from cybersecurity threats. We expect our senior management will provide our Board of Directors updates on at least an annual basis regarding matters of cybersecurity. This is expected to include existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any) and status on key information security initiatives. We expect that our Board members will also engage in periodic conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.

companyName: LIBERTY STAR URANIUM & METALS CORP.

ticker: LBSR


text: The Company's Chief Information Security Officer ("CISO") is responsible for developing and implementing our cybersecurity program and reporting on related matters to our Board of Directors. The CISO has over a decade of experience leading cybersecurity functions and over two decades in cybersecurity. The CISO leads a global team of highly trained experts covering all major cybersecurity functions including Technical Engineering and Architecture, Governance Risk and Compliance, Security Operations and Incident Response, Threat and Vulnerability Management and Security Awareness. The technologies, policies and processes associated with these functions are tested by third parties at least annually to ensure continued effectiveness and identify any opportunities for improvement. These tests and assessments are useful tools for maintaining a robust cybersecurity program to protect our investors, customers, employees, vendors and intellectual property.

companyName: GXO Logistics, Inc.

ticker: GXO


text: Our board of directors and senior management recognize the critical importance of maintaining the trust and confidence of our clients, business partners and employees. Our management, led by our Chief Executive Officer and Chief Financial Officer, are actively involved in oversight of our risk management efforts, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM"). Our cybersecurity processes and practices are fully integrated into the Company's ERM efforts.

companyName: Clean Energy Technologies, Inc.

ticker: CETY


text: • the CIO and the CISO also meet with the full Board on an annual basis as part of the overall enterprise risk management review; and • the CISO, as a member of the Disclosure Committee, meets with other members of the Disclosure Committee to discuss materiality and disclosure with respect to cybersecurity matters.

companyName: Fortive Corp

ticker: FTV


text: We maintain an Incident Response Plan that includes processes and procedures for reviewing and responding to cybersecurity incidents. We periodically test our readiness to respond to a cybersecurity incident through various scenario-based drills at technical and executive levels and incorporate external resources and advisors, as needed. The Incident Response Plan includes processes for escalation to the CISO, the Executive Leadership Team, including the CEO and General Counsel, the Audit Committee and the Board. Our Incident Disclosure Committee has defined processes to determine whether a cybersecurity incident is material and may require disclosure in SEC filings.

companyName: CINTAS CORP

ticker: CTAS


text: We have a continuous monitoring program to detect and respond to potential cybersecurity threats in real-time. Log data from our technical controls are collected, aggregated, and correlated in a Security Information and Event Management (SIEM) system that identifies and categorizes events, as well as analyzes them. If the SIEM system identifies a potential security event, it can direct other controls to stop the activity and also generate alerts for detection and response. These alerts are monitored by a managed security service provider that augments a dedicated internal Security Operations Center team.

companyName: Phillips 66

ticker: PSX


text: Senior leadership, including our CDIO and CISO, routinely update and report to the Board, the Audit Committee, and the Compliance and Risk Committee, as applicable, on our cybersecurity and information security risks and the management of such risks, our data governance and usage, our technology infrastructure, our training and compliance efforts, and implications for our business strategy. In addition to the information provided in these meetings, members of our Board have access to continuing education, which includes topics relating to cybersecurity risks.

companyName: Cencora, Inc.

ticker: COR


text: A formal process exists through our enterprise risk management matrix developed by the management team of the Company that tracks the Company's material risks, associated mitigation and remediation strategies and direct accountability which is submitted quarterly to the Audit Committee of the Board of Directors for review and oversight.

companyName: CSP INC /MA/

ticker: CSPI


text: The information security team's background includes information technology governance, risk management & compliance, security controls, and enterprise application security, ensuring our systems align with best practices and regulatory standards. As a control owner for Information Technology General Controls ("ITGCs"), they oversee security reviews, change management processes, and system integrity for critical applications, such as enterprise resource planning ("ERP") and enterprise software solutions. Additionally, they have played a key role in architecting and managing secure operational workflows, leading ERP implementations, and ensuring compliance with internal controls over financial reporting, pursuant to Section 302 of the Sarbanes-Oxley Act, and audit requirements.

companyName: ExchangeRight Income Fund


text: Our Board of Directors has delegated to the Audit Committee the responsibility for reviewing our processes and policies with respect to risk assessment, risk management and risk acceptance, including our processes and policies with respect to information security and cybersecurity. The Audit Committee receives quarterly reports from the CTO and CISO, which include information on the broader information security and cybersecurity threat landscape, the information security program's strategic priorities, progress made in respect of those priorities and summaries of cybersecurity incidents and related remediation efforts. Our Chief Audit Executive reports to the Audit Committee with respect to our key risks, including information security and cybersecurity risks, which are monitored pursuant to our SRM program.

companyName: Paramount Global


text: Engage Third-Parties on Risk Management We typically engage third party auditors in connection with our risk assessment processes. These service providers assist us with designing and implementing our cybersecurity policies and procedures, as well as with monitoring and testing our safeguards at different levels. To address and mitigate potential risks associated with our use of such third parties, we require each third-party service provider to ensure that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company.

companyName: GRID DYNAMICS HOLDINGS, INC.

ticker: GDYN


text: Plan and Training In the event of the detection of a potentially significant cybersecurity incident or threat, an escalation of cybersecurity threat, or changes with respect to a current incident, the Company has processes in place to notify relevant employees who assist in the response, as well as third-party vendors. Our ITG and management, in consultation with the Company's third-party legal counsel and accountants, will assess materiality, informed by ongoing discussions about what criteria would constitute potential materiality considerations. The Audit Committee and necessary directors will be informed of all material events.

companyName: FTI CONSULTING, INC

ticker: FCN


text: The Company's cybersecurity risk management program is supervised by the Managing Director of Enterprise Security who reports directly to the CISO. The CIO and CISO regularly update senior leadership and the executive committee on cybersecurity risks.

companyName: CANADIAN PACIFIC KANSAS CITY LTD/CN

ticker: CP


text: Our associates and contractors play a vital role in the safeguarding of systems and data. Associates and contractors complete mandatory annual security awareness training to ensure they stay abreast of the latest best practices and related cyber threats. Additionally, we conduct routine phishing exercises to help associates and contractors identify and responsibly respond to suspicious emails. Throughout the year, we target supplemental training and education to higher-risk individuals and teams.

companyName: JACK HENRY & ASSOCIATES INC

ticker: JKHY


text: The Corporation's cybersecurity risk management policies include physical, administrative and technical safeguards, as well as plans and procedures designed to help the Corporation seek to prevent and effectively respond to cybersecurity threats and incidents, including threats or incidents that may impact us or RCM. In addition, our cybersecurity risk management program includes periodic identification and testing of our vulnerabilities and cybersecurity awareness training. Finally, our Chief Compliance Officer conducts an annual due diligence review, including as to cybersecurity matters, of those third-party service providers that have possession of the Corporation's material non-public information and reports the results of those assessments to the Board.

companyName: RAND CAPITAL CORP

ticker: RAND


text: Given the size of our company and the nature of our operations, we do not believe that we face significant cybersecurity risk.

companyName: FORMATION MINERALS, INC.


text: Processes for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats Our monitoring capabilities, including our internal auditing procedures, internal control over financial reporting and corporate compliance programs, are designed in part to inform management about our material risks, including those related to cybersecurity risks. In the event of an incident which jeopardizes the confidentiality, integrity, or availability of our information assets, and our risk management systems, we maintain a regularly tested incident response program. Pursuant to the incident response program and its escalation protocols, designated personnel are responsible for assessing the severity of the incident and associated threat, containing the threat, remediating the threat, including recovery or data and access to systems, analyzing the reporting and disclosure obligations associated with the incident, and performing post-incident analysis and program improvements. Although the particular personnel assigned to an incident response team will depend on the particular facts and circumstances, the team is generally led by the CIO or another member of the cybersecurity executive steering committee and will include other information technology and legal personnel. For incidents that meet certain characteristics under the program, the incident response team will escalate and update both the Company's Board and members of senior management, including the Chief Executive Officer, Chief Financial Officer and Chief Legal Officer.

companyName: INTEGRA LIFESCIENCES HOLDINGS CORP

ticker: IART


text: The level of each identified risk is determined by the Company' Chief Financial Officer, considering the impact of the risk itself and the likelihood of the risk materializing.

companyName: Raphael Pharmaceutical Inc.

ticker: RAPH


text: The Company has programs in place for the ongoing assessment of cybersecurity threats and risks, has data security programs designed to prevent and detect threats, attacks, incursions and breaches, and processes in place for the management, mitigation and remediation of potential, and any actual, cybersecurity and information technology risks and breaches. The Company maintains a robust vendor management program to oversee and identify material risks stemming from third-party service providers. Information technology staff regularly participates in relevant education opportunities and attends industry events that include cybersecurity matters. The Bank is a member of the Financial Services Information Sharing and Analysis Center (FS-ISAC) and is a participant in the Federal Financial Institutions Examination Council (FFFIEC) Cybersecurity Assessment Tool. Information security training is required for all employees no less than annually.

companyName: First Bancorp, Inc /ME/

ticker: FNLC


text: There can be no assurance that such measures will be sufficient to prevent, mitigate or remediate cybersecurity incidents or breaches. Although we have experienced cyberattacks as discussed in "Item 1A, Risk Factors" above, based on the information available as of the date of this Annual Report on Form 10-K, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect BD. Despite our efforts in implementing and maintaining our cybersecurity risk management program, there can be no assurance that we, or the third parties with which we interact, will not experience a cybersecurity incident or breach in the future that may materially affect us. For further discussion of how our business, results of operations, financial condition and cash flows could be materially adversely affected by risks from cybersecurity threats, see "Item 1A, Risk Factors."

companyName: BECTON DICKINSON & CO

ticker: BDX


text: Aptar has a detailed incident response plan that provides the process and workflow of communication for escalation of incidents to executive leadership to determine if there is a breach that would warrant further action. We also have a cyber incident materiality committee, which is a cross functional team that includes various departments across the Company including Finance, Public Relations, Accounting/Controller, Legal and the Chief Information Security Officer. Our Information Security Department, in conjunction with the cyber incident materiality committee, review each incident under our materiality framework to assess whether further escalation and reporting is required and if the incidents could constitute a material breach. Periodically, our incident response team participates in a tabletop exercise or cybersecurity preparedness led by a third-party incident response provider.

companyName: APTARGROUP, INC.

ticker: ATR


text: Our cybersecurity risk is actively managed through our Cybersecurity Steering Committee, which has established Company-wide policies and standards concerning cybersecurity matters. These policies directly or indirectly relate to cybersecurity and include antivirus protection, remote access, multifactor authentication, containment of confidential information and the use of the internet, email and wireless devices. The Company's Chief Information Security Officer (CISO) is responsible for developing and implementing our information security program and regularly reports on cybersecurity matters to executive management and the Board of Directors. The CISO has over 25 years of experience supporting cybersecurity and information technology and is a board member of a local Cyber Threat Response Alliance organization. Led by our CISO, team members who support our information security program have relevant educational and industry experience.

companyName: GENERAC HOLDINGS INC.

ticker: GNRC


text: Howmet has implemented a multi-faceted cybersecurity risk management framework, which includes progressing toward alignment with cybersecurity standards published by the National Institute of Standards and Technology and achievement of the Department of Defense (DoD) Cybersecurity Maturity Model Certification, which will require companies like Howmet that do business with the DoD to obtain specific third-party certifications relating to specified cybersecurity standards to be eligible for new contract awards. We deploy and operate preventive and detective controls and processes to mitigate cybersecurity threats, including monitoring our network for known vulnerabilities and signs of unauthorized attempts to access our data and systems. Our approach includes conducting internal vulnerability assessments, external penetration testing, and attack simulation. In addition, the Company subscribes to third-party managed security service providers that continuously monitor the Company's systems to assist with early cybersecurity threat detection and protection. Howmet conducts cybersecurity risk assessments of key vendors and other counterparties for any potential risks. Risk-based action plans are further developed to take into account evolving threats, which result in recommendations for new protocols and infrastructure. The Company has a robust program of employee education on the prevention of unauthorized access to Company information and systems.

companyName: Howmet Aerospace Inc.

ticker: HWM


text: The Company's board of directors is responsible for overseeing the Company's risk management program and has designated its Audit & Finance Committee with specific responsibility for overseeing cybersecurity risks, among other risks. The Company's cybersecurity organization is led by our Director of Information Security ("DOIS"), who is responsible for assessing and managing material risks that result from cybersecurity threats, and reports to the Senior Vice President and Chief Information Officer ("CIO"). The CIO and the Audit & Finance Committee monitor the prevention, detection, mitigation and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including regular communication with our DOIS and regular communication with and reporting from an outsourced third party cybersecurity firm and operation of the Company's cybersecurity incident response plan, which includes escalation to the Cyber Incident Committee.

companyName: Westrock Coffee Co

ticker: WEST


text: Our CISO, who reports to the Chief Information Officer and has over twenty years of experience managing information technology and cybersecurity matters, together with our senior leadership team, is responsible for assessing and managing cybersecurity risks. The CISO receives regular reports prepared by experienced information security officers on cybersecurity threats, based on data from the Information Security Department and, in conjunction with management, regularly reviews risk management measures implemented by the Company to help identify and mitigate data protection and cybersecurity risks. Certain risk topics, such as cybersecurity and compliance, are discussed at Enterprise Risk Management Committee (consisting of executive management) meetings, and are included in reports to the Board and Audit Committee.

companyName: loanDepot, Inc.

ticker: LDI


text: (ii) compliance with the Company's ITI access protocol; (iii) confirmation that in the reporting period that there were no cyber security incidents; (iv) the assessment and identification of any gaps in the Company's cyber security risk management protocol; and (v) confirmation that we continue to be compliant with our cyber security certifications and no action or omission has caused this certification to be invalid. run monthly cybersecurity awareness training with our employees, and this is documented in our internal periodic reporting.

companyName: Coda Octopus Group, Inc.

ticker: CODA


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition. For more information, see the section titled "Risk Factor—Risks Related to Data Privacy and Cybersecurity—Cyberattacks or other failures in our telecommunications or information technology, or IT, systems, or those of our collaborators, contract research organizations, third-party logistics providers, distributors or other contractors or consultants, could result in information theft, data corruption and significant disruption of our business operations."

companyName: Praxis Precision Medicines, Inc.

ticker: PRAX


text: The Company has established polices, processes, controls and systems designed to identify, assess, measure, manage, monitor and report risks related to cybersecurity and help prevent or limit the effect of possible cybersecurity threats and attacks. As cybersecurity threats continue to evolve, the Company expects to continue to expend significant resources to modify or enhance its measures to detect and prevent cybersecurity attacks or to investigate and remediate any information security vulnerabilities that become known. The risks faced by the Company from cybersecurity threats that could materially affect the Company, including its business strategy, results of operations or financial condition, are discussed in Part I, Item 1A, "Risk Factors" as part of this Annual Report on Form 10-K.

companyName: M&T BANK CORP

ticker: MTB


text: Management Personnel in Cybersecurity Primary responsibility for assessing, monitoring and managing our risks from cybersecurity threats rests with our Chief Information Security Officer, Mr. Eric Brown, Vice President of Information Technology. With over 10 years of experience in the field of cybersecurity and over 20 years of experience in IT more broadly, Mr. Brown brings a wealth of expertise to his role. His background includes extensive experience as an enterprise Chief Information Security Officer. His in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies. Our Chief Information Security Officer has overall responsibility for the Company's IT department and operations, including oversight over the cybersecurity team to ensure efforts to contain and remediate security incidents are sufficient and effective.

companyName: CYTOKINETICS INC

ticker: CYTK


text: We engage an experienced consultant to oversee the day-to-day functions of cybersecurity management, including proactive reviews of activity logs, regular vulnerability scans, and, where applicable, effective incident response. Our expert consultant has over 30 years of experience in the cybersecurity space, and reports to the chief financial officer. We also engage a highly qualified third-party cybersecurity assessor to conduct annual threat assessments and penetration tests. To date, we have not encountered cybersecurity incidents that have materially impacted our operations or financial standing.

companyName: Terns Pharmaceuticals, Inc.

ticker: TERN


text: We rely on a multidisciplinary team (including from management and third-party service providers) to assess how identified cybersecurity threats could impact our business. These assessments may leverage, among other processes, industry tools and metrics designed to assist in the assessment of risks from such cybersecurity threats. Management also conducts periodic and on-demand assessments of our cybersecurity risks.

companyName: Streamex Corp.

ticker: STEX


text: The COO is responsible for managing our information security function and overseeing our third-party information technology service providers. The COO is also responsible for helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, communicating key priorities to relevant personnel, and approving budgets. Our outsourced Chief Technology Officer, who has over 20 years in executive-level IT and cybersecurity roles, is responsible for developing and implementing our technology environment and cybersecurity framework, helping the Company prepare for cybersecurity incidents, approving and implementing certain cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: Minerva Neurosciences, Inc.

ticker: NERV


text: The Company also maintains an IT Steering Committee as part of its control environment, which meets regularly to address matters pertaining to the Company's information technology systems. The IT Steering Committee is led by the Company's three IT directors, one of which is the Director of Cybersecurity and IT Governance, and is represented by leaders from corporate departments and operations. In each meeting, the Director of Cybersecurity and IT Governance provides an overview of cybersecurity matters, including status update on threat reduction initiatives undertaken by the Company and future initiatives under consideration.

companyName: Core Laboratories Inc. /DE/

ticker: CLB


text: As of the date of this Annual Report, the Company is not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.

companyName: CDT Equity Inc.

ticker: CDT


text: Our board of directors has an important role in the oversight of the Company's cybersecurity risk management and strategy and has delegated certain components of such oversight related to the security of and risks related to computerized information and technology systems across the company, as well as by risk area (including privacy, data security, and cybersecurity matters), to the audit committee, which regularly interacts with our Vice President of Cybersecurity ("VP of Cybersecurity") and Chief Risk Officer ("CRO"). We also regularly engage external parties to assist in the review of our cybersecurity risk oversight processes.

companyName: iRhythm Holdings, Inc.

ticker: IRTC


text: an outsourced security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents;

companyName: TREVENA INC


text: Our IT Manager and our IT Administrator oversee our information security program and lead our information security team. Our IT Manager has primary responsibility for assessing and managing our cybersecurity threat management program, informed by over ten years of experience leading cross-functional organizations in the development and operation of large-scale systems.

companyName: Laser Photonics Corp

ticker: LASE


text: Role of Management While our Board of Directors has overall responsibility for the oversight of our enterprise-wide risk management, of which cybersecurity risk management is one component, our management team is responsible for day-to-day risk management, including the implementation of our cybersecurity risk management program.

companyName: CENTENE CORP

ticker: CNC


text: We work with government, customer, industry and/or supplier partners to gather and develop policies and standards and share information to address cyber threats. We conduct information security assessments of partners before sharing or allowing the hosting of data in computing environments managed by third parties. We require our employees to complete phishing and other awareness training to help identify, avoid and mitigate cybersecurity threats.

companyName: AAR CORP

ticker: AIR


text: Our board and audit committee oversee risk for our company and are generally responsible for the oversight of risks from cybersecurity threats. Our management will promptly report to our board and audit committee any cybersecurity incidents impacting us and the measures that may be taken to mitigate such incidents. In the event of a cybersecurity incident, we intend to follow an incident response plan, which outlines the steps to be followed from incident identification, mitigation, recovery and notification to legal counsel and our board and audit committee. It is possible that the occurrence of any cybersecurity incidents, or a combination of them, could lead to corruption or misappropriation of our assets, proprietary information and sensitive or confidential data and could have a material adverse effect on our business, financial condition or reputation. We have not encountered any cybersecurity incidents since our initial public offering.

companyName: CF Acquisition Corp. VII


text: Board Oversight Role Our Board of Directors oversees our risk management process, including as it pertains to cybersecurity risks, directly and through its committees. The Audit Committee (the Committee) of the Board of Directors oversees our cybersecurity and data privacy. The Committee meets periodically to review and discuss with management risks relating to significant cybersecurity matters and concerns involving the company, including information security, data privacy, backup of information systems and related regulatory matters and compliance. The Committee regularly reports to the Board of Directors with respect to the Committee's activities and recommendations, including those relating to cybersecurity matters and concerns. The company provides reports to the Committee on information security matters, including the adequacy and effectiveness of the company's information security policies and practices and the internal controls regarding information security, and notifies the chairperson of the Committee as soon as practicable of significant information security matters and concerns as they arise on a periodic basis.

companyName: AXIM BIOTECHNOLOGIES, INC.

ticker: AXIM


text: In an effort to mitigate the impact of cybersecurity events, we conduct mandatory information technology and cybersecurity training for all employees upon hire and at least annually thereafter, and regularly test our employees for information security awareness and adherence to our information technology and cybersecurity policies, which are reviewed at least annually. We also provide our employees with access to educational newsletters and articles regarding relevant information technology and cybersecurity matters on a regular basis. Additionally, we utilize third-party experts to review and test our information technology infrastructure, including constant monitoring for suspicious activity, routine penetration testing of our networks, and an annual security assessment of the effectiveness of our informational technology environment to identify potential vulnerabilities. For example, our VP, Information Systems & Solutions and Director, Information Technology receive periodic reporting from our managed security service provider and meet regularly to discuss reported activity and assess any recommendations. The Company also receives a quarterly cyber risk rating from an external enterprise risk management service provider and our VP, Information Systems & Solutions and Director, Information Technology meet to discuss the rating and potential enhancements to our cybersecurity program. The cyber risk rating reports are also shared with the Audit Committee on a quarterly basis. Our third-party service providers of technology services are generally required to provide us with system and organization controls (SOC) reports prior to formal engagement and annually thereafter. The reports are reviewed by our VP, Internal Audit and our VP, Information Systems & Solutions, or their designee(s), to assess and monitor compliance with cybersecurity best practices.

companyName: Broadstone Net Lease, Inc.

ticker: BNL


text: To date, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and we believe are not reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including " If our information technology systems or those of the third parties upon which we rely, are or were compromised, we could experience adverse consequences resulting from such compromise, including, but not limited to, significant fines or other liability; regulatory investigations or actions; disruptions of our development programs or business operations; harms to our reputation, and other adverse consequences."

companyName: Vaxcyte, Inc.

ticker: PCVX


text: The Board and ITC regularly review the identification and management of product cybersecurity risks and review regular reports from management on risks and mitigation strategies in effect to reduce product cybersecurity risk. The ITC also reviews our guidelines and policies with respect to risk assessment and management of product security risks, including both our approach toward a secure systems development lifecycle and product security incident response.

companyName: Aptiv PLC

ticker: APTV


text: Additional controls include vulnerability scanning, identity and access management, mobile device management and other various security controls. We also conduct periodic phishing tests and social awareness training for all employees, which include how to report and escalate suspected incidents.

companyName: Sterling Bancorp, Inc.


text: In addition, cybersecurity risk is a fundamental risk of the Company which is overseen by the Risk Committee of the Board, including Directors with experience in risk management, internal audit, cybersecurity and/or the operations of financial service companies. In particular, the Chair of the Board, Eric E. Stickels, has experience with the risks associated with operating a financial institution based upon his prior service as the President of Oneida Financial Corp. In addition, Lead Director Susan E. Skerritt, the former Chief Executive Officer and President of Deutsche Bank Trust Company Americas, as well as director Kerrie D. MacPherson have received the Cyber-Risk Oversight Certification issued by the National Association of Corporate Directors ("NACD"), and utilize their business experience and cyber-risk expertise to assist the Risk Committee in its evaluation of management's cybersecurity systems. Directors Knauss and Singh also serve as Board representatives on the Company's IT Steering Committee and provide valuable oversight and insight to the committee based on their respective roles as (i) the former CEO of a digital marketing firm and (ii) current CEO of PAR Technology Corporation ("PAR"), a global food service technology company providing leading omnichannel cloud-based software and hardware solutions to the restaurant and retail industries.

companyName: COMMUNITY FINANCIAL SYSTEM, INC.

ticker: CBU


text: The board of directors now has formal oversight of risks from cybersecurity threats. At the end of 2023, it is important to note that, as discussed in Part III of this filing, our board of directors was comprised solely of Messrs. Danzik, Kitchen and Westbrook. As such, pursuant to the information provided below, all risks from cybersecurity threats our immediately shared with the board of directors.

companyName: flooidCX Corp.


text: The Audit Committee of our Board oversees our cybersecurity risk program and receives periodic presentations from management regarding the Company's efforts to monitor and mitigate cybersecurity risks. The Board is composed of members with diverse expertise including risk management and technology, equipping them to oversee cybersecurity risks effectively. The cybersecurity program is reviewed by our Board, at least annually. In addition to scheduled briefings, ad hoc discussions regarding emerging or potential cybersecurity risks ensure the Board remains informed and engaged in strategic decision-making related to cybersecurity.

companyName: NCS Multistage Holdings, Inc.

ticker: NCSM


text: Reporting to Board of Directors The Audit Committee receives reports from the Chief Operations Officer, IT Manager or Enterprise Risk Manager and briefings on our information security and enterprise risk management programs at least quarterly, including the results of any external audits, bank regulatory examinations and evaluations, as well as maturity assessments of our information security program.

companyName: UWHARRIE CAPITAL CORP

ticker: UWHR


text: Our Chief Information Officer and Information Security Officer, along with their departments, are accountable for managing our enterprise information security and delivering our information security program. Their responsibilities include cybersecurity risk assessment, defense operations, incident response, vulnerability assessment, threat intelligence, identity access governance, third-party risk management, and business resilience. Their departments, as a whole, consists of information security professionals with varying degrees of education and experience. Certain individuals within their departments are generally subject to professional education and certification requirements. In particular, our Chief Information Officer and Information Security Officer have relevant expertise in the areas of information security and cybersecurity risk management.

companyName: PEOPLES BANCORP OF NORTH CAROLINA INC

ticker: PEBK


text: Cybersecurity incidents have the potential to disrupt our business operations, lead to the loss of critical and confidential information, and damage our reputation and financial performance.

companyName: Japan Food Tech Holdings, Inc.


text: The CIO is a member of the Company's Risk Management and Compliance Committee (RMCC). The RMCC is comprised of members from the senior leadership team and is responsible for overseeing enterprise-wide risk management across all categories, including cybersecurity. The RMCC is overseen by the Company's Management Committee, which is comprised of the President and Chief Executive Officer, Senior Vice President and Chief Financial Officer, Senior Vice President, Utility Operations, Senior Vice President, General Counsel & Corporate Secretary, Senior Vice President, Human Resources, and Senior Advisor. The CIO provides regular cybersecurity updates to the Audit Committee of the Board of Directors and the Management Committee. These updates address prevention, detection, mitigation, and remediation of cybersecurity incidents, as well as risks, threats, and the threat landscape.

companyName: ATMOS ENERGY CORP

ticker: ATO


text: Our vice president, information operations works collaboratively across our company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity threats in accordance with our incident response and recovery plans. To facilitate the success of our cybersecurity risk management program, multidisciplinary teams are deployed to address cybersecurity threats and respond to cybersecurity incidents. Through ongoing communications with these teams, our vice president, information operations monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to executive management when appropriate. Our vice president, information systems has served in such role since October 2021 and in various roles in information security and information technology for over 25 years.

companyName: LEXICON PHARMACEUTICALS, INC.

ticker: LXRX


text: Evaluating the materiality of the cybersecurity incident, determining whether there are disclosure obligations under applicable securities laws, and external reporting, as required.

companyName: PERPETUA RESOURCES CORP.

ticker: PPTA


text: Key elements of our cybersecurity risk management program include but are not limited to: • risk assessments designed to help identify material risks from cybersecurity threats to our critical systems and information; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, including incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for key service providers based on our assessment of their criticality to our operations and respective risk profile.

companyName: P3 Health Partners Inc.

ticker: PIII


text: The Company's Senior Director of IT ("SDIT") oversees the Company's incident response plan and related processes designed to assess and manage material risks from cybersecurity threats. The SDIT is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents pursuant to criteria set forth in the Company's incident response plan and related processes. The experience of the Company's Response Team includes cybersecurity incident response, in-depth security assessments and security evaluation exercises to evaluate security profile, security research, education and outreach, and security tool development.

companyName: Charlotte's Web Holdings, Inc.

ticker: CWBHF


text: The Cummins Enterprise Cybersecurity function, which is responsible for the administration of our enterprise cybersecurity program, is led by the Chief Information Security Officer, who has more than 25 years of information technology, IT architecture and operations experience in the industrial manufacturing industry. The Chief Information Security Officer reports to our Chief Information Officer. These leaders provide regular updates to the Audit Committee of the Board on cybersecurity risks. Through these updates, the Audit Committee receives a cybersecurity dashboard illustrating the status of key cybersecurity activities such as email phishing, event logging and data encryption. Information regarding relevant cybersecurity training is provided as well.

companyName: CUMMINS INC

ticker: CMI


text: We have not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our business strategy, results of our operations, or financial condition. However, we have been the target of cyber-attacks and expect them to continue as cybersecurity threats have been rapidly evolving in sophistication and becoming more prevalent in the industry. We cannot eliminate all risks from cybersecurity threats or provide assurances that we have not experienced an undetected cybersecurity incident in the past or that we will not experience such an incident in the future. For more information on the risks from cybersecurity threats and incidents that we face, refer to Part I, "Item 1A. Risk Factors."

companyName: CORPAY, INC.

ticker: CPAY


text: Also as part of our cybersecurity program, we partner with a third-party information technology firm to support and evaluate our cybersecurity and informational security program. This third-party service includes product and software security for data protection and cyber defense, to monitor, detect, prevent, and protect our Company against potential cybersecurity threats.

companyName: Enservco Corp

ticker: ENSV


text: Our Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated to our Audit Committee (Committee) oversight of cybersecurity and other information technology risks. The Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the Committee as necessary, regarding any significant cybersecurity incidents.

companyName: Douglas Emmett Inc

ticker: DEI


text: As part of our enterprise risk management program, which is overseen by the audit and risk committee, we identify and review risks related to cybersecurity on a regular basis, including risks related to third-party access to our information technology systems. We conduct periodic enterprise risk assessments and report the results to the executive team and the audit and risk committee.

companyName: COMPASS Pathways plc

ticker: CMPS


text: 2). Safeguard of Information: Our business communication and document sharing are mainly conducted via online platforms such as Amazon Web Service (AWS) and various Google Services, which each has its only cybersecurity measurements. All the important business information and documents have offline backup storage as well for safekeeping.

companyName: Glidelogic Corp.

ticker: GDLG


text: Periodically, the Company has its cybersecurity programs audited by independent third parties using the NIST Cybersecurity Framework, which provides guidance to organizations on how to identify, prevent, detect, respond, and recover from cybersecurity threats.

companyName: FMC CORP

ticker: FMC


text: Our cybersecurity risk management program is part of our overall risk management program and shares similar governance processes and reporting channels that apply across the risk management program to financial, legal, compliance, and other operational risk areas.

companyName: Amplitude, Inc.

ticker: AMPL


text: Our ISC facilitates communications between executive, business/process level and the implementation/operations level to coordinate the implementation of our cybersecurity risk program. The ISC team meets on a regular basis, at least quarterly and more frequently as needed, to discuss significant initiatives, critical metrics and address certain risk responses.

companyName: ICU MEDICAL INC/DE

ticker: ICUI


text: Regular reporting channels between the Director of Information Security, the Chief Information Officer, and the Chief Financial Officer facilitate a cohesive, well-informed approach to managing cybersecurity risks. These reports include detailed analyses of potential threats, incident response readiness, and the effectiveness of existing cybersecurity measures.

companyName: ALBANY INTERNATIONAL CORP /DE/

ticker: AIN


text: The Company's management supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by it; and alerts and reports produced by security tools deployed in the IT environment.

companyName: PARK AEROSPACE CORP

ticker: PKE


text: Management Expertise Adient's global information operations security leader has over 30 years of experience in IT with a focus on cybersecurity for the past 26 years, reporting into Adient's Chief Information Officer, who has over 25 years of IT related experience and who further reports into Adient's Executive Vice President of Global IT & Business Services and Sustainability as well as the senior executive team and the Audit Committee and the Board, as necessary.

companyName: Adient plc

ticker: ADNT


text: The Company's board of directors delegates authority to the Risk Oversight Committee to assist the board in carrying out its duties of risk oversight, including with respect to cybersecurity risk. The Risk Oversight Committee provides primary oversight of the Company's enterprise-wide risk posture and the processes established to identify, measure, and monitor the Company's risk level, including in regards to cybersecurity risk. This oversight includes reviewing and approving the Company's risk appetite, including with respect to cybersecurity risk, risk related policies, and reviewing quarterly reporting from management on monitoring of performance of the Company against its risk appetite, including in regards to cybersecurity risk. The Risk Oversight Committee is responsible for the oversight, implementation, and maintenance of the Information Security Policy and Program and has delegated to it specific responsibility for the implementation of the program and reviewing management reports in this area. Quarterly reports are provided to the Company's board of directors that describe the overall status of the Information Security Policy and Program, including, but not limited to: • Decisions about risk management and control; • Results of testing, including regular external and internal penetration testing; • Security breaches or violations and management's responses; and • Recommendations for changes to the Information Security Policy and Program.

companyName: WILSON BANK HOLDING CO

ticker: WBHC


text: We recognize our recent acquisition of Inmarsat represents an opportunity to build on the existing cybersecurity risk programs incorporating and integrating the strengths of both legacy cybersecurity organizations. The Inmarsat Cybersecurity Team has historically been guided by the NIST Cybersecurity Framework. The legacy Viasat and Inmarsat cybersecurity organizations will report to Viasat's CISO and are actively integrating the two legacy companies' cybersecurity policies, processes, and operations, as well as combining the cybersecurity functions into a single organization, with appropriate focus on the overall Viasat and Inmarsat satellite service network integration activities.

companyName: VIASAT INC

ticker: VSAT


text: 4. Third Party and Vendor Management – The Company’s Information Security team has established policies and processes to identify and oversee cybersecurity risks associated with using third party service providers and vendors. These include the following elements: • Access Control: The principle of least privilege is applied to manage user’s access of Company’s resources. User access is reviewed at least quarterly. • Vendor Management: One of the Company’s Information Security policies is its Vendor Management Policy. This policy includes conditions for vendor evaluation, how the Company performs its evaluation, and steps for monitoring thereafter. • Privacy Impact Assessments: The Company’s employees are trained to submit a Privacy Impact Assessment for review when there may be new access by a third-party to certain data or the Company may share information in a new way. The Privacy Impact Assessment is reviewed by the Information Security team to assess whether the proposed practices are manageable within the Company’s cybersecurity environment.

companyName: QUINSTREET, INC

ticker: QNST


text: The Board oversees our risk management process and receive regular updates and information on cybersecurity risks, if any, which address recent developments, evolving standards, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties. The Board also receive timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.

companyName: Raphael Pharmaceutical Inc.

ticker: RAPH


text: Over the past year, we have made significant progress in strengthening our cyber defense capabilities. Our Security Operations Center and Managed Detection and Response services continue to evolve and improve daily. This progress is driven by real-time incident response, continuous team development, and the incorporation of lessons learned from both internal experiences and external industry intelligence. To complement these efforts, we have implemented an advanced cyber threat intelligence process that enhances our ability to detect threat actors, anticipate emerging risks, and align our detection and prevention strategies with global threat trends. Monthly cybersecurity training for all users; Bi-weekly phishing simulations; and A monthly interactive cyber awareness magazine.

companyName: PHIBRO ANIMAL HEALTH CORP

ticker: PAHC


text: Our cybersecurity risk management program also includes: a continuous vulnerability management process to monitor and identify threats in our environment, including our IT networks and legacy systems, that could potentially have a materially adverse impact on our critical systems, information and broader enterprise IT environment;

companyName: CORNING INC /NY

ticker: GLW


text: Our cybersecurity program incorporates a robust process for the assessment, identification, and management of material risks from cybersecurity threats. This begins with our threat intelligence program that integrates several methods to identify potential threats to the Company, including paid/unpaid threat feeds, custom threat alerts, keeping abreast of the latest threats to the technologies that exist within our information systems and daily dialogue with industry peers to the threats to the hospitality industry as a whole.

companyName: WYNDHAM HOTELS & RESORTS, INC.

ticker: WH


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not, to date, materially affected us, including our business strategy, results of operations or financial condition. If we were to experience a material cybersecurity incident in the future, such incident may have an adverse effect, including on our business operations, operating results, or financial condition. For more information regarding cybersecurity risks that we face and the related potential impacts on our business, see the risk factor titled "Security breaches, loss of data and other disruptions to our or our third-party service providers' data systems could compromise sensitive information related to our business or prevent us from accessing critical information and expose us to liability, which could adversely affect our business and our reputation."

companyName: VERACYTE, INC.

ticker: VCYT


text: Members of our Cybersecurity Management identify and assess risks from cybersecurity threats by monitoring our threat environment and the Company's enterprise risk profile using various manual and automated tools as well as by: (i) utilizing shared information about vulnerabilities and exploits from professional security organizations, reports or other services that identify cybersecurity threats and through the use of external intelligence feeds; (ii) analyzing reports of threats and actors; (iii) conducting periodic vulnerability scans of the Company's IT environment; (iv) evaluating our and our industry's risk profile; (v) evaluating threats that are reported to us; (vi) coordinating with law enforcement concerning threats; (vii) conducting internal and external audits of our information security control environment and operating effectiveness; and (viii) conducting threat assessments for internal and external threats, including through the use of third party threat assessments and vulnerability threat assessments.

companyName: COHEN & STEERS, INC.

ticker: CNS


text: We are committed to protecting Company information and the confidential information of our employees, customers, partners, and suppliers. To that end, we have in place various policies, procedures, and processes to identify, assess, manage, and prevent potential cybersecurity risks, and to timely detect the occurrence, and mitigate the effects of cyberattacks and data breaches. Our Chief Information Officer ("CIO"), who has more than 25 years of information security and cybersecurity experience, manages cybersecurity, and oversees a team of dedicated cybersecurity personnel with various experience and certifications in information security and cybersecurity. Our personnel, along with external parties engaged to assess the sufficiency of our risk management processes (e.g., through penetration testing), continuously work to maintain and improve our cybersecurity program and the security and integrity of our information systems and infrastructure through our ongoing risk management program, including (i) by conducting cybersecurity assessments and audits to address threats and to stay in step with emerging malicious trends, and (ii) by performing due diligence on partners and suppliers to ensure similar values and appropriate security standards and safeguards are maintained by such partners and suppliers with respect to our information security assets and to third-party systems on which we rely. In addition, our Incident Response Team is trained to identify, quarantine, and remediate cybersecurity threats, and all of our employees are regularly trained to increase awareness of threats and to identify how to spot and avoid them.

companyName: Ryerson Holding Corp

ticker: RYZ


text: The Risk Committee receives annual reports from management on our cybersecurity risks. In addition, management updates the Risk Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential. The Risk Committee reports to the full board of directors regarding its activities.

companyName: BEYOND MEAT, INC.

ticker: BYND


text: Processes for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats Our cybersecurity program has four components: (1) prevention and preparation, (2) detection and analysis, (3) containment, eradication, recovery, and reporting, and (4) post-incident analysis and program enhancements.

companyName: American Homes 4 Rent

ticker: AMH


text: The Board actively supports strategy and oversees risk management, drawing on a diverse range of experiences, skills, qualifications, and backgrounds. This includes oversight of cybersecurity matters. The Audit Committee, composed entirely of independent Board members, receives quarterly updates on the Company's cybersecurity program, which includes recent developments, program improvements, risk analysis, and an annual update on the scenario-based cybersecurity exercise. The Audit Committee also receives periodic updates, as needed, including any cybersecurity events that would require notification to the Audit Committee. The Audit Committee provides quarterly updates to the Board on key cybersecurity activities, and cybersecurity is also reviewed at least annually with the Board. In addition, two of our Audit Committee members, including the Chair, hold a CERT Certificate in Cybersecurity Oversight from the National Association of Corporate Directors.

companyName: J M SMUCKER Co

ticker: SJM


text: We believe we are appropriately staffed (as supported by our outsourced IT provider) to support a healthy cybersecurity posture given our size and scope.

companyName: Safe Pro Group Inc.

ticker: SPAI


text: The Audit Committee of our Board of Directors oversees and reviews the Company's cybersecurity risks and the steps management has taken to protect against threats to the Company's information systems and security. The senior leadership team, including our Chief Financial Officer and Chief Executive Officer, provides periodic reports to our Board and the Audit Committee, as applicable.

companyName: Benitec Biopharma Inc.

ticker: BNTC


text: We use third-party service providers to perform a variety of functions throughout our business, such as hosting companies and application providers. We have a vendor management program to manage cybersecurity risks associated with our use of certain of these providers. The program includes a risk assessment and security questionnaire for certain providers, review of security assessments for certain providers, and review of System and Organization Controls reports for certain providers. Depending on the nature of the services provided, the sensitivity of the information systems and data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.

companyName: SPORTSMAN'S WAREHOUSE HOLDINGS, INC.

ticker: SPWH


text: Protecting our business information, intellectual property, customer and employee data, and technology systems is crucial for our business continuity, regulatory compliance, and stakeholder trust. We have implemented enterprise cybersecurity risk mitigation and governance processes, detailed in our Information Security Protection Program ("Security Plan"). Our strategy is guided by the Security Plan's principles, which involve monitoring threats and vulnerabilities, assessing and monitoring related controls, and supporting the Chief Information Security Officer (CISO). Our cybersecurity policies, standards, processes, and practices are integrated into our overall risk management system to enhance our ability to protect our operations and information. This includes annual cybersecurity reporting to the board of directors by senior leadership.

companyName: EGAIN Corp

ticker: EGAN


text: We take a comprehensive approach to cybersecurity and prioritize the security and integrity of our data, including those of our residents and other stakeholders, as a top priority. Our board of directors and our management are actively involved in the oversight of our risk management program, of which cybersecurity represents an important component. As described in more detail below, we have established policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats. We have devoted significant resources to implement and maintain security measures to meet regulatory requirements and stakeholder expectations, and we intend to continue to make appropriate investments to maintain the security and integrity of our data. There can be no guarantee that our established policies, standards, processes and practices will be properly followed in every instance or that they will be effective at mitigating all cybersecurity threats. Although our risk factors include further detail about the material cybersecurity risks we face, we believe that risks from cybersecurity threats, have not materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business, results of operations, or financial condition.

companyName: Strategic Student & Senior Housing Trust, Inc.

ticker: STSR


text: We are committed to protecting our information systems against cybersecurity threats. Any cybersecurity incident can adversely affect our business and disrupt our operations as described in greater detail in our Risk Factors relevant to cybersecurity risks. Our senior leadership, in consultation with our board of directors, has assigned responsibilities for ensuring and overseeing the operation of our information security program to the Marchex Information Security Committee (the "ISC") comprised of senior representatives of departments across our organization.

companyName: MARCHEX INC

ticker: MCHX


text: To strengthen our cybersecurity risk management practices and oversight, we engage external consultants with expertise in information security, incident response, and governance. Additionally, we evaluate the internal risk oversight programs of third-party service providers before engaging them in order to help protect us from any related vulnerabilities.

companyName: Voyager Therapeutics, Inc.

ticker: VYGR


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program. The Audit Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential. Our management team is responsible for assessing and managing our material risks from cybersecurity threats.

companyName: Presurance Holdings, Inc.

ticker: PRHI


text: Risk management and strategy NetScout has implemented and maintains information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information, and the information of our customers and employees ("Information Systems and Data").

companyName: NETSCOUT SYSTEMS INC

ticker: NTCT


text: Our Chief Information Officer ("CIO") leads our global information security organization responsible for overseeing the Company's information security program. Our Chief Information Security Officer ("CISO") is primarily responsible for identifying, assessing, monitoring, and managing cybersecurity threats to our overall enterprise. Our CIO has over 25 years of industry experience, including serving in similar roles leading and overseeing cybersecurity programs at other public companies. Our CISO, who reports directly to the CIO, has over 30 years of information technology infrastructure and security experience, including developing and leading cybersecurity risk management programs for a variety of companies. Additionally, the team supporting the CISO has relevant educational and professional information technology security experience, including holding similar positions at other large companies. The CISO receives information regarding cybersecurity incidents and threats primarily from our third-party cybersecurity providers. The CISO then provides periodic reports to the CIO, including reporting on significant cybersecurity incidents, strategy, results of employee trainings, and any other notable cybersecurity matters.

companyName: Krispy Kreme, Inc.

ticker: DNUT


text: The Ares cybersecurity risk management and awareness programs include periodic identification and testing of vulnerabilities, regular phishing simulations and annual general cybersecurity awareness and data protection training, including for all of the employees of Ares. Ares' cybersecurity training programs also include annual certification requirements for employees of Ares with respect to certain policies supporting the cybersecurity program including the Information Security and Electronic Communications policy, Data Protection policy and Privacy Policy. Ares undertakes periodic internal security reviews of its information systems and related controls, including systems affecting personal data and the cybersecurity risks of Ares' and our critical third-party vendors and other partners. Ares also completes periodic external reviews of its cybersecurity program and practices, which include assessments of relevant data protection practices and targeted attack simulations.

companyName: ARES INDUSTRIAL REAL ESTATE INCOME TRUST Inc.


text: Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected, and we do not believe are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, the risk of cybersecurity threats could be significant if the cyber-attack disrupts the Company's critical operations, service or financial systems. See Item 1A. "Risk Factors, Risks Related to Our Business and the Single-Family Rental Housing Market, We are highly dependent on information technology and security breaches or systems failures could significantly disrupt our business" and "Breaches of our data security could materially harm our business and reputation."

companyName: VINEBROOK HOMES TRUST, INC.


text: Due to the sensitivity of the personal information, including protected health information, or PHI, that the Company and its subsidiaries store and transmit, in the ordinary course of business, identifying, assessing, and managing material cybersecurity risks is an important component of the Company's overall cybersecurity and enterprise risk management program.

companyName: CLOVER HEALTH INVESTMENTS, CORP. /DE

ticker: CLOV


text: We have an established governance model to provide mechanisms to identify and escalate material risks from cybersecurity threats. This includes management processes across the information security program designed to monitor the prevention, detection, mitigation, and remediation of cyber risks and incidents. Risk escalation and reporting paths are in place, including review of cybersecurity risks by management committees such as the Operational Risk Committees and Enterprise Risk Management Committees chaired by SHUSA's Chief Operational Risk Officer and Chief Risk Officer, respectively. The Company also maintains a dedicated Information Security and Data Management Committee chaired by SHUSA's Chief Technology Officer, which includes the CEO, the heads of the Company's businesses, representatives of the Company's second LOD, and an Internal Audit team among its members. The members of the Board of Directors are senior individuals that are experienced in identifying and managing risks including running companies with IT functions, inclusive of cybersecurity, reporting to them.

companyName: Santander Holdings USA, Inc.


text: Our cybersecurity risk management includes continuous monitoring of networks and systems for potential signs of suspicious activity. We have deployed managed detection and response for all corporate production systems (servers, desktops, and laptops). This managed service includes 24x7x365 monitoring, threat hunting, remediation, and escalation to help maintain a secure environment. We also provide mechanisms and training for employees to report to the IT Department any unusual or potentially malicious activity they observe for proper identification and analysis.

companyName: COMPASS MINERALS INTERNATIONAL INC

ticker: CMP


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition.

companyName: CADENCE DESIGN SYSTEMS INC

ticker: CDNS


text: The Company engages in the periodic assessment and testing of the Company's policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. The Company has also engaged third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results and findings of these exercises are reported to the Audit and Compliance Committee, who in turn updates the Board as appropriate. Management will then evaluate such findings and, with input from the Audit and Compliance Committee, take the appropriate steps to adjust the Company's cybersecurity policies, standards, processes and practices, as may be applicable, to strengthen or address any weaknesses, gaps or findings as the case may be.

companyName: AMICUS THERAPEUTICS, INC.

ticker: FOLD


text: This regular reporting to the Audit & Risk Committee also includes a cybersecurity dashboard that contains information on cybersecurity governance processes, and from time to time, also includes the status of projects to strengthen internal cybersecurity, ongoing prevention and mitigation efforts, security features of the products and services we provide our customers, or the results of security events during the period. The Audit & Risk Committee also reviews and discusses recent cyber incidents affecting the industry and the emerging threat landscape.

companyName: NASDAQ, INC.

ticker: NDAQ


text: Members of the Global Information Security Team possess expertise in various disciplines that are key to effectively managing our information security program. Team members represent relevant functions within the organization (e.g., Risk and Compliance, Security Operation Center & Network Engineering and Operational Technology). Each Global Information Security Team member has more than 15 years of experience working for large enterprises in the information technology and information security space. This includes, but is not limited to, expertise in data infrastructure, operations and information security and risk and compliance. In addition, our CIO and certain members of the Global Information Security Team are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity incidents through their participation in incident response protocols.

companyName: AMKOR TECHNOLOGY, INC.

ticker: AMKR


text: The Company maintains a cyber insurance policy as part of its overall risk management strategy to mitigate financial losses in the event of a cybersecurity incident. The Bank also retains third-party experts to conduct intrusion and penetration testing on an annual basis. All risk and security assessment results are shared with the Board of Directors.

companyName: BayCom Corp

ticker: BCML


text: We are planning to establish an appropriate confidentiality framework and document management system in order to safeguard sensitive information in addition to the safeguards provided by our third-party service providers. Such confidentiality framework may include the use of third-party information technology experts to manage and oversee our sensitive information and to work directly with our management in overseeing cybersecurity risks and appropriate responses thereto. In addition, we plan to consult with outside advisors and experts, when appropriate, to assist with assessing and identifying cybersecurity risks, including to anticipate future threats and trends, and their impact on our risk environment.

companyName: PALISADE BIO, INC.

ticker: PALI


text: The potential impact of risks from cybersecurity threats on the Fund are assessed on an ongoing basis, and how such risks could materially affect the Fund's business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, the Fund did not identify any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Fund, including its day-to-day operations, financial condition, and business strategies. In conjunction with Fidelity's Enterprise Cybersecurity, the Fund participates in regular testing of applicable incident response processes to ensure appropriate escalation, mitigation, communication and reporting processes are in place.

companyName: Fidelity Private Credit Co LLC


text: We have developed and implemented a cybersecurity risk management program led by the Company's Vice President, IT, that is designed to protect the confidentiality, integrity, and availability of the Company's data and systems. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: BEYOND MEAT, INC.

ticker: BYND


text: The incident had a significant negative impact on our 2025 operating results. Various revenue lines were impacted, certain operating expenses were higher than they were prior to the incident, and many projects underway were significantly delayed.

companyName: LEE ENTERPRISES, Inc

ticker: LEE


text: In fiscal 2025, the Company developed a Cybersecurity Incident Materiality Policy (the "Policy") to guide the Company through the materiality decision making framework, SEC reporting and disclosures obligations, disclosure controls and procedures related to a cybersecurity incident, and a communication protocol to escalate material incidents to the Board and supplements the Company's Cybersecurity Incident Response Plan. In addition to the Policy, the Company also formed a Cyber Incident Disclosure Committee, which includes key stakeholders whose role will be to determine whether an incident is material and, therefore, requires public disclosure.

companyName: EDGEWELL PERSONAL CARE Co

ticker: EPC


text: Our board of directors has established management committees including the Information Technology Steering Committee, which focuses on technology and business impact, and the Operational Risk Management Committee, which focuses on the identification, monitoring, assessment, and management of risk associated with our cyber and information security programs. These committees provide oversight and governance of the technology program and the information security program and are chaired by the Chief Information Officer and Chief Operational Risk Management Officer, respectively, and include the Chief Information Security Officer and other key departmental managers from throughout the entire company. The Information Technology Steering Committee meets monthly and the Operational Risk Management Committee meets at least quarterly to provide oversight of the risk management strategy, standards, policies, practices, controls, and mitigation and prevention efforts employed to manage security risks. More frequent meetings occur from time to time in accordance with the Incident Response Plan to facilitate timely informing and monitoring efforts. The Chief Information Security Officer reports summaries of key issues, including significant cybersecurity incidents, discussed at committee meetings and the actions taken to the Innovation and Technology Committee of our board of directors on a quarterly basis (or more frequently as may be required by the Incident Response Plan).

companyName: Northwest Bancshares, Inc.

ticker: NWBI


text: Over his 17-year career, the Company's Chief Information Officer has served in multiple Information Technology and Cybersecurity roles, such as Senior Engineer, responsible for implementing hardened infrastructure for both physical and cloud applications; Solutions Architect, designing infrastructures for highly regulated industries including Financial Services, Local/State Government and Healthcare; Director of Service Delivery, overseeing engineering, solutions architecture and maintaining the System and Organization Controls (SOC) program prior to joining Unity Bank. During his tenure at Unity Bank, he is a member of various Risk and Cybersecurity Committees of the New Jersey Bankers Association, is a member of FS-ISAC, The Independent Community Bankers of America and our primary banking vendors advisory and risk management committees. The Company's Chief Compliance Officer was appointed as the Company's Information Security Officer in 2016.

companyName: UNITY BANCORP INC /NJ/

ticker: UNTY


text: Our enterprise risk team consists of cross-functional professionals who collaborate with subject matter specialists, as necessary, including an independent third-party expert we have retained to functionally serve as a virtual chief information security officer ("CISO"), to identify and assess material risks from cybersecurity threats, their severity, and potential mitigation steps. The CISO is primarily responsible for leading our cybersecurity risk assessment and management processes. This expert has experience having served as the chief information security officer for an international commercial real estate services company and currently serves as chief information security officer of a cybersecurity firm focused on commercial real estate. He is supported by an internal cross-functional management team of IT and internal audit personnel who regularly review and assess cybersecurity initiatives, including our incident response plan, as well as cybersecurity compliance, training and risk management efforts.

companyName: HEALTHPEAK PROPERTIES, INC.

ticker: DOC


text: Engaging Third-Parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity threats, our Chief Experience Officer periodically evaluates and tests our risk management systems. Our Chief Experience Officer has specialized knowledge and insights, ensuring our cybersecurity strategies and processes remain at the forefront of industry best practices.

companyName: Strive, Inc.

ticker: ASST


text: In the last fiscal year, Matson has not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected the Company, but the Company faces certain ongoing cybersecurity risks threats that, if realized, are reasonably likely to materially affect the Company. For more information on the risks and impacts of these matters to Matson, see Part I, Item 1A. Risk Factors – "The Company's information technology systems have in the past and may in the future be exposed to cybersecurity risks and other disruptions that could impair the Company's ability to operate and adversely affect its business. "

companyName: Matson, Inc.

ticker: MATX


text: HighPeak Energy maintains a cybersecurity program that aims to protect the confidentiality, integrity, and availability of data required by our business to be stored, analyzed, transported, and/or processed. The Company has implemented various internal and external controls and processes, including internal risk assessment and policy implementation, to incorporate a risk-based cybersecurity framework to monitor and mitigate security threats and other strategies to increase security for our information, facilities, and infrastructure.

companyName: HighPeak Energy, Inc.

ticker: HPK


text: We have integrated governance processes into our overall risk management framework to enable the Board of Directors to oversee cybersecurity risk. The Audit Committee oversees management's policies and procedures related to cybersecurity risk management and periodically reports to the Board of Directors. The Chairman of the Audit Committee acts as the lead with respect to direct oversight of management.

companyName: FIVE BELOW, INC

ticker: FIVE


text: Our CISO, reporting to our CFO, leads our cybersecurity program. Our CISO has more than 20 years of cybersecurity experience and holds CISSP (2002) and CISM (2009) certifications. The cybersecurity team reporting to our CISO is staffed by highly skilled cybersecurity professionals, including both internal staff and external partners. Many team members have one or more industry recognized cybersecurity certifications such as Certified Information Systems Security Professional (CISSP), Global Information Assurance Certification (GIAC), Certified Information Security Manager/Auditor (CISM/CISA). In addition, our CEO, CFO and GC each hold undergraduate and graduate degrees in their respective fields, and each have extensive experience managing risks at Crane NXT and at similar companies.

companyName: Crane NXT, Co.

ticker: CXT


text: We use a risk-based approach with respect to our use and oversight of third-party service providers, tailoring processes according to the nature and sensitivity of the data accessed, processed, or stored by such third-party service provider. We use a number of means to assess and manage cyber risks related to our third-party service providers, including conducting due diligence in connection with onboarding new vendors and seeking to include appropriate security terms in our contracts where applicable.

companyName: Phio Pharmaceuticals Corp.

ticker: PHIO


text: The Company's Information Technology Manager has an over 26-year career in Information Technology, the prior 13-years of which have been in Information Technology, Security and Cybersecurity, working primarily in regulated industries.


text: In the last three fiscal years, management has determined there were no cyber security threats that have materially affected Innospec and that the expenses incurred relating to cyber incidents have been immaterial. The Company is not aware of any threats that are reasonably likely to materially affect its business strategy, results of operations or financial condition for the foreseeable future.

companyName: INNOSPEC INC.

ticker: IOSP


text: A 24/7 monitored intrusion prevention system, internal intrusion detection system, and firewalls to assist in the identification of unauthorized system access is in place. Network and application security reports are reviewed by Bank personnel and used to help in the detection process.

companyName: River Financial Corp

ticker: RVRF


text: There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or are effective in protecting our systems and information. We are not currently aware of risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.

companyName: CHEESECAKE FACTORY INC

ticker: CAKE


text: Engage Third-parties on Risk Management Periodic external reviews, including penetration tests and security framework assessments, are conducted by auditors, external assessors, and/or consultants to assess and ensure compliance with the Company's information security programs and practices. Internal and external auditors assess the Company's information technology general controls on an annual basis.

companyName: MDU RESOURCES GROUP INC

ticker: MDU


text: The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.

companyName: CHUY'S HOLDINGS, INC.


text: As detailed in our risk factors included in Item 1A, Chubb recognizes the significant risks posed by cybersecurity and data protection challenges, which could adversely affect our business, financial condition, and results of operations. We have implemented a risk-based approach to identify and assess the cybersecurity threats that could affect our business and information systems, and we evaluate changes and enhancements to our technology environment as well as conduct third party assessments to confirm that they meet our information security control requirements. Our cybersecurity program and control environment incorporate appropriate industry standards and best practices, such as the National Institutes of Standards and Technology Cyber Security Framework (NIST CSF), and is designed to comply with numerous U.S. federal and state and international laws, rules and regulations governing the protection of personal and confidential information of our clients and employees. We use various tools and methods to assess, identify and manage cybersecurity risk that are tested regularly, including the following:

companyName: Chubb Ltd

ticker: CB


text: Information Security Policies and Procedures We manage our cybersecurity risk in accordance with our Information Security Program (the "Information Security Program"), which is applicable to all users of our information technology assets, information assets, and facilities, including our employees, contractors, vendors, volunteers, and agents. The Information Security Program includes an Information Security Incident Response Policy (the "Incident Response Policy"), which sets forth the rules and requirements for identifying, investigating, validating, prioritizing, and responding to information security incidents, and addresses the response portion of security monitoring. The Information Security Program also includes: (i) an Information Security Incident Response Procedure (the "Incident Response Procedure"), which delineates the processes for reporting, classifying, investigating, planning, containing, eradicating, recovering, documenting, and communicating information security incidents, as well as post-incident activities; and (ii) a Security Monitoring Policy, which establishes the rules and requirements for enabling, logging, alerting, and monitoring real time security alerts and security logs (automated or manual), as well as various condition monitoring tests and reviews, and documentation requirements in connection with security incident identification.

companyName: FIVE STAR BANCORP

ticker: FSBC


text: Technical Safeguards We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.

companyName: Theravance Biopharma, Inc.

ticker: TBPH


text: In the event of a possible cybersecurity incident, we would immediately implement our crisis management plan, which includes the following steps: (1) Internal reporting and review of the incident or development (2) Gathering and assessing information (3) Developing and implementing a communications strategy (4) Monitoring and evaluating a response

companyName: BALCHEM CORP

ticker: BCPC


text: The Board actively supports strategy and oversees risk management, drawing on a diverse range of experiences, skills, qualifications, and backgrounds. This includes oversight of cybersecurity matters. The Audit Committee, composed entirely of independent Board members, receives quarterly updates on the cybersecurity program, which includes recent developments, program improvements, risk analysis, and an annual update on the Company's scenario-based cybersecurity exercise. The Audit Committee also receives periodic updates as may be needed, including any cybersecurity events that would require notification to the Audit Committee. The Audit Committee provides quarterly updates to the Board on key cybersecurity activities, and cybersecurity is also reviewed at least annually with the Board. In addition, two of our Audit Committee members, including the Chair, hold a CERT Certificate in Cybersecurity Oversight from the National Association of Corporate Directors.

companyName: J M SMUCKER Co

ticker: SJM


text: At GCI, there is an Enterprise Security Office ("ESO"), led by the Chief Information Security Officer ("CISO"), which is responsible for day-to-day management and oversight of subsidiary cybersecurity, including assessing, monitoring and mitigating cybersecurity risk. The CISO provides regular reporting to GCI executive management and the ISSC.

companyName: Liberty Broadband Corp

ticker: LBRDA


text: In connection with our InfoSec risk management processes, we engage third-party assessors and outside counsel. Our program includes review and assessment by external, independent third parties, who assess and report on our overall InfoSec program and identify areas for continued focus and improvement. Our CIO, CISO and GC oversee our technology risk management and privacy teams, which work in partnership with our Internal Audit team to review IT-related controls as part of the overall internal controls process and regulatory requirements. We consult with outside counsel to advise our team and our Board of Directors on best practices for InfoSec oversight, and the evolution of that oversight over time. InfoSec employees regularly speak at and attend industry events to ensure awareness of evolving threats and innovative prevention and remediation techniques. Further, our InfoSec risk management processes extend to the oversight and identification of threats associated with our use of third-party service providers through relationship due diligence, InfoSec assessments and contractual provisions.

companyName: INTERNATIONAL FLAVORS & FRAGRANCES INC

ticker: IFF


text: Murphy USA relies on numerous third-parties to deliver the goods and services offered to our customers. We maintain a third-party risk management program to evaluate, prioritize, mitigate and remediate cybersecurity risks associated with third-parties; however, we rely on those third-parties to implement cybersecurity programs commensurate with their risk and we cannot ensure in all circumstances that their efforts will be successful. See Item 1A. "Risk Factors" for a discussion of cybersecurity risks. For the 2024 period presented within this Annual Report, Murphy USA is not aware of any threats or cybersecurity incidents that have or are reasonably likely to materially affect our strategy, results of operations or financial condition.

companyName: Murphy USA Inc.

ticker: MUSA