text: In 2024, t he Board of Directors (the "Board") assumed direct oversight of our cybersecurity program and management of the associated risks. The Board periodically receives updates regarding our cybersecurity program through meetings with and reports from our CIO and CISO (or their designees).

companyName: HERC HOLDINGS INC

ticker: HRI


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, security management works with senior management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business, and reports to the audit committee of the board of directors, which reviews our overall risk management framework and programs.

companyName: Confluent, Inc.

ticker: CFLT

secItem: Item 1C


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board of Directors and management. Our Board of Directors is responsible for general cybersecurity risk oversight and stays informed on data privacy and information security issues and vulnerabilities that may be applicable to the Company. Our Board of Directors reviews and evaluates management's evaluation and mitigation of cybersecurity risks as part of its oversight of the Company's risk management program. Management periodically reviews cybersecurity risks and risk mitigation plans and activities with the Board of Directors. We outsource most aspects of our information technology management and these third-party providers are available to address any cybersecurity issues that may arise.

companyName: STREAMLINE HEALTH SOLUTIONS INC.


text: We have established policies and processes for assessing, identifying and managing material cybersecurity risks, and have integrated these processes into our overall risk management processes. We have also established policies and processes for managing and responding to material cybersecurity incidents.

companyName: Identiv, Inc.

ticker: INVE


text: Our Board of Directors, as a whole and through its committees, has oversight responsibility over the Company's strategy and risk management, including our response to critical risks related to cybersecurity threats. The Audit Committee of the Board of Directors specifically oversees the management of enterprise risks, including risks associated with privacy and data security (including cybersecurity), in accordance with its charter. The Audit Committee engages in periodic discussions, on at least a bi-annual basis, with a member of the Data Privacy and Security Committee as well as members of legal and executive leadership as appropriate regarding the Company's significant financial risk exposures and the measures implemented to monitor and control these risks, including those that may result from critical cybersecurity threats. Executive leadership periodically reports on critical cybersecurity risks and risk management to the full Board of Directors.

companyName: BridgeBio Pharma, Inc.

ticker: BBIO


text: We may engage third-party advisors to monitor threats and to scan for vulnerabilities. When a cybersecurity threat or incident is identified by our third-party advisor, it is reported directly to our Sr Director of Tech. The Sr Director of Tech in conjunction with professionals throughout the organization, including information technology specialists, accountants, and lawyers, determine severity and response, then manage it to conclusion in accordance with our cybersecurity incident response processes. We may engage third party advisors as part of our incident response processes to assist with digital forensics among other efforts. The Sr Director of Tech, together with the cross-functional team, report material or potentially material incidents to our executive leadership and the Audit Committee. The Sr Director of Tech provides further updates regarding root causes and remediation efforts. In the event the Company determines it has experienced a material cybersecurity incident the Board of Directors is notified.

companyName: AIR T INC

ticker: AIRT


text: The Board of Directors receives regular reports from the Senior Vice President, Director of IT and the Information Security Officer on Glen Burnie Bancorp's cyber risks and threats, the status of projects to strengthen Glen Burnie Bancorp's information security systems, assessments of Glen Burnie Bancorp's security program, and the emerging threat landscape. Additionally, the Information Technology Committee drives awareness, ownership, and alignment across all business functions for effective cybersecurity risk management and reporting. Glen Burnie Bancorp annually engages third parties to audit its information security programs, whose findings are reported to the Audit and Information Technology Committees of the Board. The Company also engages with key vendors, industry participants, government agencies, and intelligence and law enforcement communities as part of our efforts, which are reported to the Information Technology Committee and Board of Directors.

companyName: GLEN BURNIE BANCORP

ticker: GLBZ


text: Although Alternus has not experienced cybersecurity events that have materially impacted the business, like most organizations, it faces ongoing risks such as phishing, malware, and attempted unauthorized access. These are monitored and addressed in accordance with established policies. See "Item 1A. Risk Factors" 1C. Cybersecurity".

companyName: Alternus Clean Energy, Inc.

ticker: ALCE


text: Our team of cybersecurity professionals is led day-to-day by our Vice President of Global Information Security who reports to our Chief Information Officer. Our Vice President of Global Information Security has a combined 20 years of experience in IT operations and cybersecurity leadership. The Vice President of Global Information Security also serves as the Chair of our Enterprise Risk and Compliance Committee where leaders from across the Company discuss cyber risk and other risk matters. The cybersecurity team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants.

companyName: LCI INDUSTRIES

ticker: LCII


text: Information Security Governance The Chief Information Security Officer is primarily responsible for the Information Security and Cyber Risk Management programs, and reports to the Chief Risk Officer. The Chief Technology Officer that oversees the Information Technology Department plays a key role in cybersecurity, ensuring that information systems, networks, and endpoints are configured and operated according to the requirements of the Information Security Program and related policies and standards. Both the current Chief Information Security Officer and Chief Technology Officer have over 20 years of experience in Information Technology and Information Security.

companyName: SOUTH PLAINS FINANCIAL, INC.

ticker: SPFI


text: Compliance and Regulatory Considerations Our cybersecurity practices are in alignment with industry standards and regulatory requirements. We conduct regular reviews to ensure compliance with evolving cybersecurity laws and regulations. There have been no legal or regulatory proceedings related to cybersecurity against the company in the reported period. We intend to further enhance our cybersecurity measures in response to the dynamic cyber threat landscape. This includes investing in advanced security technologies, refining our risk assessment methodologies, and continuing our commitment to staff training and development in cybersecurity awareness and best practices.

companyName: INNOVATE Corp.

ticker: VATE


text: We recognize the importance of assessing, identifying, and managing risks from cybersecurity threats. Our approach to cybersecurity risk management is aligned with our risk profile and business.

companyName: Eightco Holdings Inc.

ticker: ORBS


text: Peoples has a comprehensive Enterprise Risk Management program ("ERM Program"), which includes policies and processes for assessing, identifying and managing material risks from cybersecurity threats to Peoples and its customers. Peoples' information security policy and procedures are reviewed and assessed on an annual basis and as needed throughout the year by the Risk Committee of the Board. Peoples assesses itself against the Federal Financial Institutions Examination Council's ("FFIEC") Cybersecurity Assessment Tool ("CAT") on a quarterly basis. Beginning in 2025, Peoples will assess itself using the Cyber Risk Institute Tool ("CRIT") on at least an annual basis. Additional assessment of Peoples' cybersecurity capabilities is performed by consultants and regulators annually. Identified risks resulting from these assessments are documented, rated and mitigated by Peoples Bank's Chief Information Security Officer ("CISO"), with oversight by the Risk Committee.

companyName: PEOPLES BANCORP INC

ticker: PEBO


text: Since January 1, 2021, we have not experienced any cybersecurity incidents that have resulted in material financial loss. We are not aware of any cybersecurity threats or cybersecurity incidents that have materially affected or are reasonably likely to materially affect us or our business strategy, results of operations or financial condition.

companyName: CubeSmart

ticker: CUBE


text: The Company's employees are also required to sign confidentiality agreements in an effort to, among other things, help to ensure cybersecurity. The Company has taken measures to better ensure that key employees are aware of data security threats (including cybersecurity threats), and Company security policies and procedures, as appropriate. Improper or illegitimate use of the Company's information system resources or violation of the Company's information security policies and procedures may result in disciplinary action.

companyName: ScanTech AI Systems Inc.

ticker: STAI


text: The Audit Committee of the Board of Directors has oversight of our cybersecurity program and is responsible for reviewing and assessing the Company's cybersecurity and data protection policies, procedures and resource commitment, including key risk areas and mitigation strategies. As part of this process, the Audit Committee receives regular updates from the Chief Technology Officer on critical issues related to our information security risks, cybersecurity strategy, supplier risk and business continuity capabilities. The Company's framework includes an incident management and response program that continuously monitors the Company's information systems for vulnerabilities, threats and incidents; manages and takes action to contain incidents that occur; remediates vulnerabilities; and communicates the details of threats and incidents to management, including the Director Product Management, Head of Data, as deemed necessary or appropriate. Pursuant to the Company's incident response plan, any incidents are to be reported by the Chief Technology Officer to the Audit Committee, appropriate government agencies and other authorities, as deemed necessary or appropriate, considering the actual or potential impact, significance and scope. The Company is no t aware of any cybersecurity incidents or threats that are reasonably likely to materially affect its business strategy, results of operations, or financial condition.

companyName: OneMedNet Corp

ticker: ONMD


text: The IS program includes several key processes and functions such as access control monitoring, threat detection, vulnerability management, understanding the implications of technological changes, managing third-party relationships, and mandating employee awareness and education among other components. These activities aim to prevent avoidable errors, raise awareness, identify potential vulnerabilities, protect systems, detect security incidents and recover from any incidents that occur. These processes are continually updated and enhanced to keep pace with the evolving cybersecurity landscape.

companyName: Stock Yards Bancorp, Inc.

ticker: SYBT


text: On an ongoing basis, we and Cheniere assess our people, processes and technology and, when necessary, adjust the overall program in an effort to adapt to the ever-evolving cyber and geopolitical landscapes. We conduct regular assessments and audits, cross-functional risk mitigation exercises and risk strategy sessions to identify cybersecurity risks, applicable regulatory requirements and industry standards. These engagements are also designed to exercise, assess the maturity of, and enhance our Cyber Incident Response Plan. To support these efforts, we have contracted with third parties to perform facility and system penetration tests, compromise assessments of information technology systems, and security maturity assessments of our corporate and operational networks. Cheniere maintains a training program to help its personnel identify and assist in mitigating cybersecurity and data security risks. Cheniere's employees and the board of directors of our general partner participate in annual training, user awareness campaigns and additional issue-specific training as needed. Cheniere also provides annual training for certain contractors who have access to its information technology networks.

companyName: Cheniere Energy Partners, L.P.

ticker: CQP


text: We have not currently identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or that we believe are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For additional information about cybersecurity risk, refer to Part II, Item 7 of this Annual Report on Form 10-K generally and under the heading "Maintaining cybersecurity and complying with data privacy laws and regulations are important to our business and a breach of our cybersecurity or a violation of data privacy laws could result in serious harm to our reputation and have a material adverse impact on our business and financial results " in Part I, Item 1A of this Annual Report on Form 10-K.

companyName: REDWOOD TRUST INC

ticker: RWT


text: The audit committee of WisdomTree, Inc. (the "Audit Committee") oversees the management of cybersecurity risks. Pursuant to the Audit Committee charter, the Audit Committee is responsible for discussing cybersecurity-related risks with management and the steps management has taken to monitor and control such risks, including WisdomTree Inc.'s risk assessment and risk management policies. The CIO regularly reports to the Audit Committee on cybersecurity risks, and the chair of the Audit Committee reports on these discussions with the full board of directors of WisdomTree, Inc. In addition, the CIO provides periodic reports to the board of directors.

companyName: WisdomTree Bitcoin Fund

ticker: BTCW


text: The Company's Information Security Program ("Program") uses a variety of safeguards to protect the confidentiality, integrity, and availability of information. The Program is designed to identify, prevent, or mitigate the risks from cybersecurity threats. The Program leverages recognized security frameworks, such as the National Institute of Standards and Technology (NIST), Financial Services Information Sharing and Analysis Center (FS-ISAC), Federal Financial Institutions Examination Council (FFIEC), and Ransomware Self-Assessment Tool (R-SAT), to organize, improve, and assess the program and to better manage and reduce cybersecurity risk. The Program is assessed and updated annually and as needed.

companyName: Texas Community Bancshares, Inc.

ticker: TCBS


text: As of the date of this report, we are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, which have materially affected or are reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition. Refer to "Item 1A. Risk Factors" in this Annual Report on Form 10-K, including "Risks Related to our Company, Business, and Operations—Cybersecurity risks may cause a disruption to our operations, a compromise or corruption of our confidential information, and/or damage to our business relationships, all of which could negatively impact our business.", for additional discussion about cybersecurity-related risks.

companyName: TPG Mortgage Investment Trust, Inc.

ticker: MITT


text: Management is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. Management is also responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: Cytek Biosciences, Inc.

ticker: CTKB


text: Cybersecurity risk is the risk of compromising the confidentiality, integrity, or availability of our technology platforms, data, and other systems, which could have an adverse impact on us, our members, Clients, and Network Partners, and our relationships with them. As further described below, we take various steps designed to help ensure that our platforms, data, and other systems remain available, resilient, and secure in the face of risks presented both by inadvertent actions (e.g., software that fails to operate properly) and by malicious activities (e.g., threat actors deliberately seeking to steal data or otherwise cause disruption). In particular, our industry continues to be a target for increasingly sophisticated cyber threats, including those driven by the rapid advancement of AI, adoption of public cloud environments, and reliance on third parties. We take a security-by-design and risk-based approach to our cybersecurity program, which emphasizes continual improvement to safeguard non-public information and enable our business operations.

companyName: HEALTHEQUITY, INC.

ticker: HQY


text: To prevent, detect, mitigate, and remediate information security threats, including a cybersecurity incident and/or threat, we maintain a cyber risk management process managed by our Senior Vice President, Operations ("SVP, Operations") who reports to our CEO. The SVP, Operations works with the Vice President, Deputy General Counsel ("Legal") on cybersecurity strategy, policy, training, standards, architecture, and processes. We have invested, and expect to continue to invest, in resources for the protection and safeguarding of our information technology systems, including, but not limited to, networks, applications, and outsourced technology services in connection with the operation of our business. These resources are designed to detect and respond to cyber incidents that may result in unauthorized access to, ransomware, damages, or destruction of, our information and systems.

companyName: Zevia PBC

ticker: ZVIA


text: Our information security team, including our Chief Technology Officer and our Senior Vice President Information Security, is responsible for day-to-day identification, assessment and management of the cybersecurity risks we face. The information security team also has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. The leaders of our information security team have over 40 years of combined experience in managing information security, developing cybersecurity strategy and implementing cybersecurity programs. The Chief Technology Officer is informed of and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents through management of the cybersecurity risk management program described above, including our cybersecurity incident response plan. Our incident response plan is also designed, depending on the circumstances, to escalate cybersecurity incidents to other members of management, report cybersecurity incidents to the Audit Committee, and support public disclosure and reporting of material incidents.

companyName: Stagwell Inc

ticker: STGW


text: Our information security program includes: • Having designated information security personnel, led by our Chief Information Security and Fraud Prevention Officer (CISO), who has decades of relevant experience and also serves as Chief Information Officer. The CISO is supported primarily by our Cybersecurity, Compliance, Risk, and Fraud Team (CyberCRAFT), which consists of approximately 500 professionals as of July 31, 2025. In addition to bringing their current expertise to their roles, CyberCRAFT professionals have the ability to participate in our specialized training and development programs to further enhance their cybersecurity skill sets and cross-train on related capabilities. The CISO works closely with the Company's internal legal team to oversee compliance with legal, regulatory and contractual security requirements; • Risk assessments designed to help identify and prioritize significant cybersecurity risks. Our process for identifying and assessing material risks from cybersecurity threats includes incorporation of an internally developed threat catalog and our tracking of trends for areas such as vulnerability management, our leverage of technical standards and guidance, input from our participation and collaboration with law enforcement and government initiatives, and our internal and vendor-supported threat intelligence initiatives. The cybersecurity risk assessment operates alongside our broader overall enterprise-wide risk assessment and management process, and key cybersecurity risks are presented to the Audit and Risk Committee in a manner that helps frame cybersecurity risks as part of a broader risk context; • Regular testing and assessments of our systems and controls to evaluate the information security program maturity and effectiveness using cybersecurity frameworks (such as ISO 27001, PCI DSS, and SOC 2) and to identify and address potential vulnerabilities—and as appropriate, we adjust our policies, standards, and processes based on testing and assessment results; • A vulnerability management program to determine the in-scope systems, patch systems based on criticality, and disclose potential vulnerabilities; • A cybersecurity incident response plan and scenario-specific playbooks for responding to various types of cybersecurity incidents; • Business continuity and disaster recovery plans to support more effective response and recovery efforts in the event of a significant cybersecurity incident or disruption; • The use of external service providers and consultants to assess or monitor the environment or otherwise assist with aspects of our cybersecurity controls; • Commercially available and customized security technologies and security and business controls to limit access to and use of such sensitive data; • A security awareness and training program for our employees and contractors, with role-based training for certain personnel and positions; and • A third-party risk management framework designed to monitor and address cybersecurity risks from various third parties (including vendors, service providers, and other contractors) that includes diligence regarding the third party's cybersecurity capabilities and additional monitoring of certain third parties based on the results of diligence. In addition, we have established standard contractual terms and conditions regarding cybersecurity applicable to third parties, as well as further downstream parties, that may be tailored to the use case and sensitivity of any data or business processes involved.

companyName: INTUIT INC.

ticker: INTU


text: Our Information Security team has gained their expertise in information technology ("IT") and cybersecurity through a combination of education, relevant degrees, certifications and prior work experience. As part of the cybersecurity process, their respective teams inform them about the prevention, detection, mitigation, and remediation of cybersecurity incidents.

companyName: SONIC AUTOMOTIVE INC

ticker: SAH


text: To address cybersecurity threats (defined as potential unauthorized occurrences on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of those systems or any information residing in those systems therein), we have a implemented an incident and event response program. That program is a component of our overall enterprise risk management and business continuity frameworks. We employ an in-depth, layered, defensive approach that leverages people, processes and technology to manage and maintain cybersecurity controls. We also employ a variety of preventative and detective tools to monitor, block, and provide alerts regarding suspicious activity relative to our information systems, as well as to report on any suspected advanced persistent threats. The program is designed to allow for the detection and timely and efficient recovery from cybersecurity incidents (defined as a violation or imminent threat of violation of information security policies, acceptable use policies, or standard computer security practices) and events by providing a well-defined, organized approach for handling any potential threats to the confidentiality, integrity, and/or availability of our information systems.

companyName: MONROE CAPITAL Corp

ticker: MRCC


text: Our Board has delegated to its Audit Committee specific, first-line responsibility for overseeing major cybersecurity risk exposures in addition to our broader enterprise risk management program. Specifically, under its charter, the Audit Committee is responsible for overseeing and monitoring enterprise risk management, privacy, cybersecurity and data security matters, including the potential impact of those exposures on Microchip's business, financial results, operations and reputation, and the steps management has taken to monitor and mitigate such exposures. The CISO reports at least quarterly to the Audit Committee on information security and data privacy and protection. These presentations address a wide range of topics, including trends in cyber threats and the status of initiatives designed to bolster our security systems. Our full Board is typically in attendance at these presentations made to the Audit Committee. At least annually, the Board meets with members of our senior management team to review and discuss our enterprise risk management program, including areas of material risk and how these risks, which may include cybersecurity risk, are being managed and reported to the Board and its committees.

companyName: MICROCHIP TECHNOLOGY INC

ticker: MCHP


text: Our processes to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers Unisys recognizes the importance of overseeing and identifying material risks from cybersecurity threats associated with our use of third-party service providers. We have a Third Party Risk Management (TPRM) program, which is integrated into our procurement process and involves cybersecurity risk oversight and identification components. Our TPRM program includes policies and standards requiring that we perform cybersecurity due diligence reviews on our vendors based on the risk profile of a particular supplier or service provider or the service they provide. We also monitor certain of our principal suppliers and service providers on an ongoing basis by conducting additional periodic reviews. Whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect Unisys, including its business strategy, results of operations, or financial condition and if so, how.

companyName: UNISYS CORP

ticker: UIS


text: The Company maintains a Security Council that regularly meets to review current or potential threats. The Security Council's membership consists of the following: the Company's Chief Executive Officer, Chief Financial Officer, Chief Technology Officer, General Counsel, Vice President of Technology, Manager of Security, and Head of Internal Audit. We also employ a Security Department responsible for cybersecurity across the organizations. The individuals in this department are vetted for their experience and expertise before joining the team and maintain continued education and training each year using our enhanced learning program. This department's responsibilities include cyber security risk management, security operations, awareness training, incident response, industry awareness and reporting. The team assesses and maintains awareness of global cyber security threats by using several services and notifications from our vendors. The team then considers each of these threats as applied to our environment, process, operations, vendors and clients. The Security Council is led by the Chief Technology Officer, Vice President of Technology, and Manager of Security, each of whom have a depth of knowledge and experience in the cyber security space.

companyName: DHI GROUP, INC.

ticker: DHX


text: The Cybersecurity Team regularly engages third-party assessors to conduct evaluations of the Company's cybersecurity risk mitigation efforts and strategy. The Company also engages a third-party auditing firm to periodically assess our information security program. Audits are also conducted from time-to-time by other third parties, such as insurance adjusters and regulators.

companyName: CONTINENTAL RESOURCES, INC


text: Our cybersecurity incident response and vulnerability management processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including to our President of P&T, CDO, and CSO. Our President of P&T, CDO, and CSO work with our incident response team to help us mitigate and remediate cybersecurity incidents, as applicable. Our incident response and vulnerability management processes include reporting to the Audit Committee and the Cybersecurity Committee, as appropriate.

companyName: PROCORE TECHNOLOGIES, INC.

ticker: PCOR


text: Risk Management and Strategy Cybersecurity (cyber) risk is differentiated from information technology risk by threat interactions that yield high impact consequences and ever-increasing probability. While standard security operations address most day-to-day incidents, cyber risk includes motivated threat actors who often use advanced tools, techniques and processes to evade detection or inflict maximum damage to an organization's information assets. Cyber threats and attacks adapt and evolve rapidly, and the Company works to continuously enhance controls and processes to protect its networks, applications, and data from attack, damage, or unauthorized access. Critical components to the Company's cyber risk control structure include corporate governance, access management, threat intelligence, security operations, security awareness training, and vulnerability management programs. Cyber risk mitigation includes effectively identifying, protecting against, detecting, responding to, and recovering from cyber threats.

companyName: FIRST FINANCIAL BANCORP /OH/

ticker: FFBC


text: See "Risk Factors" in Part I, Item 1A of this Annual Report on Form 10-K for further information regarding cybersecurity risks.

companyName: YOUNEEQAI TECHNICAL SERVICES, INC.

ticker: YQAI


text: Our Head of Resources Management, who is also a member of our Board of Directors, and our CCO lead our cybersecurity program. Our Head of Resources Management has more than 30 years of overall experience and more than 20 years directly assessing and managing our cyber information technology and human resources systems, and the associated security concerns. Our CCO has more than 30 years of overall experience as a CPA, with more than 15 years managing information technology systems and databases, and more than 15 years supporting our Adviser's and Administrator's resource management department. This includes identifying, assessing, mitigating, and monitoring cyber information security risks. Our Director of IT has over 20 years of experience in IT, with a focus in the implementation of information security projects to enhance organizations' resilience against emerging threats and has collaborated closely with security vendors/partners to contain and address cybersecurity incidents. These managers, as well as other management personnel, attend various professional continuing education programs, which include cybersecurity matters. Certain members of our Board of Directors have, or previously held, positions with other companies, including other public companies, that involved managing risks associated with their cyber and information technology systems.

companyName: GLADSTONE INVESTMENT CORPORATION\DE

ticker: GAIN


text: In instances where a cybersecurity incident is classified and declared as material, our process is designed to meticulously document in a comprehensive report, all critical details such as the date and time of identification of the incident, a concise description of the incident's nature and scope, the impact of the incident on the Company's operations, and its current status (remediated or is undergoing remediation), in order to be clearly informed by the Company.

companyName: SOUTHERN COPPER CORP/

ticker: SCCO


text: Our cybersecurity risk management program is led by our Chief Information Security Officer ("CISO"), who manages our security team and is principally responsible for our cybersecurity risk assessment processes, our security controls, and our detection and response to cybersecurity incidents. Our program includes protocols for preventing, monitoring, detecting and responding to cybersecurity events and incidents, and cross-functional coordination and governance of business continuity and disaster recovery plans. Components of our program include: • risk assessments designed to help identify cybersecurity threats to our products and related supportive infrastructure, critical IT systems, information, and our broader enterprise IT environment; • monitoring, detection and collection and analysis of information regarding evolving, ongoing, and emerging threats and vulnerabilities, and corresponding actions to assess and remediate corresponding risks; • regular testing and assessments to identify vulnerabilities; • the periodic engagement of independent security firms and other third-party experts, where appropriate, to assess, test, and certify components of our cybersecurity program, and to otherwise assist with aspects of our cybersecurity processes and controls; • annual cybersecurity awareness training for our employees; • regular assessments of the design and operational effectiveness of the program's key processes and controls by our internal audit team as well as external consultants; and • a risk management process for third-party service providers and vendors that includes due diligence in the selection process and periodic monitoring regarding adherence to applicable cybersecurity standards.

companyName: F5, INC.

ticker: FFIV


text: Our cybersecurity risk management program is aligned with the National Institute of Standards and Technology (NIST) Cybersecurity Framework. We identify key assets that are critical to our business and assess potential cyber threats and vulnerabilities associated with those assets and the operations they enable. Following that assessment, we implement strategies and design controls to manage those risks. For example, we use single sign-on to limit access to our networks and multi-factor authentication to verify users' identities. We also continuously monitor our systems and networks to protect against internal and external threat actors. We have policies and procedures in place, such as our Privileged Access Management process, to limit and control access to our confidential information by our vendors and other third parties. We also conduct due diligence and reviews of cybersecurity policies of third parties that access our systems or data. Additionally, we are focused on segregating our manufacturing processes from the Company's other networks to minimize the risk of interruptions to our manufacturing operations resulting from cyber breaches. To increase our employees' vigilance of cybersecurity risks and educate them on best practices relating to those risks, we conduct cybersecurity trainings and awareness campaigns, such as quarterly phishing campaigns.

companyName: ENTEGRIS INC

ticker: ENTG


text: On at least a quarterly basis, Tyler's CISO provides a formal report to the Audit Committee and to the Board of Directors. Our Audit Committee Chair and CISO also communicate on an as-needed basis between those quarterly reports. In 2022, Tyler's Lead Independent Director completed the requirements to receive the CERT Certificate in Cybersecurity Oversight from the Software Engineering Institute at Carnegie Mellon University. Another Tyler director possesses more than 37 years of Department of Defense experience in cyberspace operations and major computer network architectures.

companyName: TYLER TECHNOLOGIES INC

ticker: TYL


text: We also have a vendor risk assessment process consisting of, depending on the nature and sensitivity of the supplier and data they process on our behalf, the distribution and review of supplier questionnaires designed to help us evaluate cybersecurity risks that we may encounter when working with third parties that have access to confidential and other sensitive company information. We routinely assess our high-risk suppliers' conformance to industry cybersecurity standards and evaluate them for additional information as circumstances change. Refer to Item 1A. "Risk Factors" in this annual report on Form 10-K for additional information about cybersecurity-related risks.

companyName: TETRA TECH INC

ticker: TTEK


text: Risk Management and Strategy Insider Risk Management. We recognize that not all threats are external. We have an insider risk management program and are working to improve our data loss protection technology to protect our critical data.

companyName: Archer Aviation Inc.

ticker: ACHR


text: We utilize ISO 27001 to identify, assess, and manage information security risk and maintain a compliant Information Security Management System ("ISMS"). Our global information security management program is ISO 27001:2013 certified.

companyName: Kimball Electronics, Inc.

ticker: KE


text: We recognize that cybersecurity threats pose a risk to our business. As part of the Company's overall risk management systems and processes, we employ a risk management framework designed with the goals of identifying, assessing and managing material risks from cybersecurity threats. Key aspects of this risk management framework include, but are not limited to: • Maintaining a cybersecurity incident response plan, coordinated by the Company's IT department and Chief Information Security Officer, which includes controls and procedures for identifying, reporting and responding to cybersecurity incidents; • Partnering with outside cybersecurity vendors periodically to gain an independent view of our cybersecurity and information security program; • Providing our employees with regular training on cybersecurity and the protection of our information systems; • Maintaining and testing a business continuity and disaster recovery program; • Database activity monitoring, encryption, secure file transfer protocols and application firewalls; and • Maintaining insurance coverage intended to address cybersecurity and data breach risks.

companyName: Addus HomeCare Corp

ticker: ADUS


text: The Chief Security Office develops Deutsche Bank Group's security strategy and oversees its implementation and operationalization globally via the organizational set-up, governance, and implemented security policies. The security strategy, which is reviewed on a regular basis, incorporates developments in the threat landscape, technology, the regulatory environment, the overall corporate and IT strategy, and other internal and external parameters.

companyName: RREEF Property Trust, Inc.


text: We assess, identify, and manage material risks related to potential cyber attacks on or through our information systems that could adversely affect the confidentiality, integrity, or availability of our information systems or the information residing on those systems through various processes. These processes include a wide variety of controls, technologies, methods, systems, and other processes that are designed to prevent, detect, or mitigate data loss, theft, and misuse, and unauthorized access to, or other cyber attacks or vulnerabilities affecting, our data.

companyName: RCI HOSPITALITY HOLDINGS, INC.

ticker: RICK


text: The Company recognizes the security of our operations is critical to protecting our customers and maintaining the reputation of the Company. Management is committed to managing Information Security Risk, which includes cybersecurity, that may impact the Company. The Enterprise Risk Committee (ERC) of the Board of Directors provides oversight of the Company's written Information Security Management and Information Technology Governance Programs (the "Programs"). Through the Programs, the Company has established polices, processes, controls, and systems designed to identify, assess, measure, manage, monitor, and report risks related to cybersecurity and help prevent or limit the effect of possible cybersecurity threats and attacks. As cybersecurity threats continue to evolve, the Company expects to continue to monitor and enhance the current controls and systems in place to detect and prevent cybersecurity attacks and to remediate discovered vulnerabilities.

companyName: LAKE SHORE BANCORP, INC.


text: The Sponsor, FMR LLC, and their respective affiliates operating as a business organization (collectively, "Fidelity") and its Enterprise Cybersecurity organization, on behalf of the Trust, have established a comprehensive risk management program, which includes processes to identify, assess, and manage cybersecurity risks, including material risks from cybersecurity threats, and to put in place appropriate controls to mitigate these risks and reduce the potential impact to the Trust and its Shareholders. The Trust does not have any employees and relies upon Fidelity and its Enterprise Cybersecurity organization for the Trust's day-to-day operations and to establish strategies, policies, and standards for the security of, and operations in, cyberspace.

companyName: Fidelity Wise Origin Bitcoin Fund

ticker: FBTC


text: Our Board of Directors maintains oversight of risks from cybersecurity threats. Our Chief Executive Officer is assigned oversight of cyber-security risks. Our Chief Executive Officer is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks to which the Company is exposed and to implement processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents.

companyName: Apple iSports Group, Inc.

ticker: AAPI


text: Company does no t currently engage with third parties in connection with cybersecurity risk management. Third-party consultants including cybersecurity auditors are being considered for future engagement, at which point any risks stemming from the use of third parties will be incorporated into the cybersecurity risk assessment.

companyName: Rivulet Entertainment, Inc.

ticker: RIVF


text: Our information security program's basis is a comprehensive set of policies and procedures covering various information security domains (collectively, "Information Security Policies"), including, but not limited to: Access control, Endpoint protection, Third-party oversight, Education, training, and awareness, security, management, Incident response, Business continuity and disaster recovery, protection and privacy, and security domains. penetration tests, and security assessments. risks are documented in a central Risk Register and tracked for mitigation and other treatment decisions.

companyName: OptimizeRx Corp

ticker: OPRX


text: We have a comprehensive enterprise risk management ("ERM") program, which is implemented by management and overseen by our Board of Directors ("Board").

companyName: LAM RESEARCH CORP

ticker: LRCX


text: The Audit Committee of our Board of Directors provides direct oversight over cybersecurity risk and provides periodic updates to the Board of Directors regarding such oversight. The Audit Committee receives periodic updates from management regarding cybersecurity matters and is notified between such updates regarding significant new cybersecurity threats or incidents.

companyName: Inozyme Pharma, Inc.


text: Our cybersecurity risk management program includes the following: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for significant service providers, suppliers, and vendors.

companyName: Viant Technology Inc.

ticker: DSP


text: We have not experienced any material cybersecurity incidents. We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition.

companyName: Webstar Technology Group Inc.

ticker: WBSR


text: As part of our cybersecurity risk management, we have adopted a cybersecurity incident response plan to identify and manage cybersecurity threats and incidents, including but not limited to those that touch on operational risk, intellectual property theft, reputational risks, fraud and extortion, harm to the personal identifying data of employees or customers, violations of laws, and other risks. Under our cybersecurity incident response plan, we have appointed an incident response team, consisting of our Chief Executive Officer, Chief Financial Officer, General Counsel, head of information technology and head of human resources. The incident response team, in connection with outside legal and cybersecurity advisors, is responsible for investigating suspected cybersecurity incidents, taking appropriate steps to contain, mitigate or resolve a cybersecurity incident and reporting findings to management. In the event of a cybersecurity incident, our General Counsel is responsible for convening a materiality incident response team to assess the materiality of cybersecurity incidents meeting certain escalation criteria.

companyName: Liquidia Corp

ticker: LQDA


text: OpCo has entered into the Services and Secondment Agreement with Westlake and we, OpCo and Westlake have entered into the Omnibus Agreement. Pursuant to these Agreements, Westlake performs various services for us, including those related to cybersecurity. As such, this disclosure addresses our cybersecurity policies and practices, some of which are executed by Westlake under the Services and Secondment Agreement and the Omnibus Agreement.

companyName: Westlake Chemical Partners LP

ticker: WLKP


text: Non-Financial Risk Management coordinates the development, maintenance, and day-to-day oversight of the Company's Enterprise Risk Management Governance Framework ("the Framework"), which defines an integrated enterprise-wide approach to risk management. This centrally managed program is designed to ensure that all business lines play a role in the successful implementation of the CSP. The CSP aligns with the Framework, enabling the CSO to provide risk oversight to and drive accountability from the business lines.

companyName: CITIZENS FINANCIAL GROUP INC/RI

ticker: CFG


text: Board Governance and Management Our management team is primarily responsible for assessing and managing our strategic risk exposures, including material risks from cybersecurity threats, with assistance from third-party service providers. Management oversees our cybersecurity process on a day-to-day basis, including those described in "Risk Management and Strategy," above.

companyName: Traws Pharma, Inc.

ticker: TRAW


text: The Company's Board of Directors is responsible for exercising oversight of management's identification and management, and planning for, risks from cybersecurity threats.

companyName: TWIN DISC INC

ticker: TWIN


text: Our information security team for IAS, MIS and Corporate is led by our Chief Digital & Information Officer ("CDIO"), who also serves as our Chief Information Security Officer ("CISO") for IAS, MIS and Corporate. Our CDIO/CISO reports to our President, The Baldwin Group & CEO, Retail Brokerage Operations. Our CDIO/CISO has served in the role since 2021 and has experience in application security, intrusion detection, penetration testing, Continuous Threat Exposure Management ("CTEM"), and unconventional cyber-attack vectors, having previously led technology teams at Comerica Bank, HSBC, Citibank and General Electric. Our CDIO/CISO oversees a team of information security professionals who are devoted full time to assessing and managing cybersecurity threats on a day-to-day basis. Our CDIO/CISO attends each quarterly meeting of the TCRC to brief members on information security matters and discuss cybersecurity risks generally.

companyName: Baldwin Insurance Group, Inc.

ticker: BWIN


text: Cybersecurity is a crucial component of our enterprise risk management program. We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature and information relating to our clients and investments.

companyName: COHEN & STEERS, INC.

ticker: CNS


text: Board Oversight of Privacy, Cybersecurity and Technology Risks Our Board recognizes the importance of maintaining the trust and confidence of our customers and employees. As a part of its independent oversight of the key risks facing our company, the Board, primarily through its Privacy, Security and Technology Committee, devotes significant time and attention to the oversight of privacy, cybersecurity, and technology risks. The Privacy, Security, and Technology Committee oversees management's approach to controls, policies, processes, and practices to gauge and address privacy, cybersecurity, and technology risks. The Privacy, Security, and Technology Committee regularly reports to the full Board and discusses the significant privacy, cybersecurity, and technology issues at the Board level.

companyName: ZoomInfo Technologies Inc.

ticker: GTM


text: Further, associates outside of our information technology organization have a role in our cybersecurity defenses, and we encourage a corporate culture supportive of security, which we believe improves the effectiveness of our cybersecurity risk management program. Through our Security Awareness Program, our associates are provided with regular cybersecurity training and educational resources to help ensure that they remain vigilant against threats. These include frequent simulated phishing campaigns, newsletters, alerts, e-mail reminders, and a mandatory annual cybersecurity awareness training course for all associates. In addition to Company policies that we make available to all associates, our cybersecurity awareness training provides clear reporting and escalation processes in the event of suspicious activity.

companyName: BRIGHTHOUSE LIFE INSURANCE Co


text: Our Chief Information Security Officer (CISO), working together with our Chief Information Officer (CIO), oversees a team of employees dedicated to cybersecurity. Our CISO receives ongoing updates from the cybersecurity team regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and regularly reports to the CIO. Our CISO is an active member of our management-level enterprise risk management committee, which has broad oversight of the company's enterprise risks, including cybersecurity risks. In addition, our CIO and CISO both attend regular meetings of the executive officer team, including our Chief Executive Officer, Chief Financial Officer and other senior executive officers, dedicated to compliance and risk, and report on cybersecurity matters as appropriate. Our Board of Directors has delegated primary responsibility for the oversight of cybersecurity matters to the Risk and Compliance Committee; however, the full board reviews significant cybersecurity matters as appropriate. Our CIO and CISO report on cybersecurity and information security at each meeting of the Risk and Compliance Committee.

companyName: Arthur J. Gallagher & Co.

ticker: AJG


text: Further, cybersecurity risk has also been incorporated into the Company's enterprise risk management process such that cybersecurity risk is managed on a comprehensive basis as part of strategy setting and driving performance throughout the Company, which includes identifying, aggregating, monitoring, measuring, assessing and managing risks that could affect our ability to fulfill our business objectives or execute our corporate strategy.

companyName: ONE Gas, Inc.

ticker: OGS


text: Board of Directors Our Audit Committee is responsible for the oversight of cybersecurity risks and receives a cybersecurity report from our CTO at least quarterly, and more often as needed, including in the event of a significant cybersecurity incident. The report includes information regarding the nature of threats, defense and detection capabilities, incident response plans and associate training activities. Our Board retains responsibility for the oversight of our overall risk management systems and processes and is briefed our CTO on cybersecurity risks on a quarterly basis.

companyName: LENNAR CORP /NEW/

ticker: LEN


text: Our cybersecurity risk management program is managed by our Chief Information Security and Sustainability Officer (the "CISSO") and IT manager and is overseen by the Chief Executive Officer and the Chief Financial Officer. The CISSO, IT manager, and other members of the IT security team actively participate in cybersecurity groups and seminars, including those that are maritime-specific, for collaboration on cyber resilience, threat intelligence sharing, and best practices exchange. All members of the IT security team regularly undergo new training/certifications on cybersecurity and attend seminars/conferences related to cybersecurity to keep their knowledge and expertise current. At a minimum, the CISSO meets with the Chief Executive Officer and the Chief Financial Officer monthly to provide updates on cybersecurity programs, threats, and incidents, and advises the heads of all departments of any recent threats periodically.

companyName: DORIAN LPG LTD.

ticker: LPG


text: Although we face risks from cybersecurity threats, no known cybersecurity threats have materially affected or we believe are reasonably likely to materially affect us, including our business, financial condition, results of operations and growth prospects. See "Risk Factors – Significant disruptions of our or our vendors' information technology systems or cybersecurity incidents could result in significant financial, legal, regulatory, business, and reputational harm to us."

companyName: AN2 Therapeutics, Inc.

ticker: ANTX


text: Certain information about our assessment and management of material risks from cybersecurity threats is included in risk management reports as applicable to senior leadership and the audit committee.

companyName: Silence Therapeutics plc

ticker: SLN


text: From time to time, we engage third-party service providers to enhance our risk mitigation efforts. For instance, we have engaged an independent cybersecurity advisor to evaluate our cybersecurity controls and a cybersecurity firm to conduct continuous threat detection, response and remediation.

companyName: Construction Partners, Inc.

ticker: ROAD


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management from time to time on our cyber risk management program. Board members receive presentations and training on cybersecurity topics from our Chief Information Officer (CIO), Vice President of Architecture and Security, or external experts as part of the Board's continuing education on topics that impact public companies. Our CIO is an experienced information technology professional with just under 30 years of experience in the networking and communications industries. His extensive experience extends to all facets of information technology, including enterprise applications, cloud and SaaS systems, network infrastructure, and network management. For the past decade, he has been at the forefront of cloud security through partnerships with leading identity and access management providers and other leading security technology providers. He is a certified Sarbanes-Oxley-trained professional. Our VP of Architecture and Security has over 30 years of experience in IT and Security and has the Certified Information System Security Professional (CISSP) certification as well as various technology vendor certifications.

companyName: ATN International, Inc.

ticker: ATNI


text: Our objective for managing cybersecurity risk is to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse our systems or information. The structure of our information security program is designed around the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, regulatory guidance, and other industry standards. In addition, we leverage certain industry and government associations, third-party benchmarking, audits, and threat intelligence feeds to facilitate and promote program effectiveness. Our Chief Operations Officer along with members of the IT Committee, regularly collaborate with peer banks, industry groups, and policymakers to discuss cybersecurity trends and issues and identify best practices. The information security program is periodically reviewed by such personnel with the goal of addressing changing threats and conditions.

companyName: Affinity Bancshares, Inc.

ticker: AFBI


text: FMA/2FA, this is our first AND most important first line of defense, no one should have MFA bypassed or disabled, with no exceptions.

companyName: SATIVUS TECH CORP.

ticker: SATT


text: Regulatory requirements related to data privacy and cybersecurity are also changing, presenting new and increasingly rigorous requirements that may be applicable to our business. Implementation of and maintaining compliance with the evolving changes requires significant effort and cost for a company of our size which may limit our ability to comply and our cyber insurance coverage may not be adequate for liabilities or costs actually incurred.

companyName: PROCYON CORP


text: access control measures to critical IT systems, equipment, and devices, which measures are designed to prevent unauthorized users, and executing protocols to ensure that information regarding cybersecurity incidents is shared promptly with the Board, as appropriate, to allow for risk and materiality assessments and to consider disclosure and notice requirements; and and implementing training on cybersecurity, information security, and threat awareness.

companyName: AIRWA INC.

ticker: YYAI


text: As discussed above, to support our preparedness we have an IRP that we regularly update, as well as a quick reference checklist and response playbooks with step-by-step actions for significant threat categories. In addition, we perform tabletop exercises and periodic drills at least once a year to test our incident response procedures, identify improvement opportunities and exercise team preparedness. We also maintain cybersecurity insurance providing coverage for certain costs related to security failures and specified cybersecurity-related incidents that interrupt our network or networks of our vendors, in all cases up to specified limits and subject to certain exclusions.

companyName: Playa Hotels & Resorts N.V.


text: The Board oversees our enterprise risk management processes directly and through its Audit Committee. The Audit Committee of the Board oversees our cybersecurity risk and receives regular reports from our CIO on various cybersecurity matters, including risk assessments, mitigation strategies, areas of emerging risks, incidents and industry trends, and other areas of importance.

companyName: EverQuote, Inc.

ticker: EVER


text: With respect to cybersecurity incident response, our ECIRP provides a documented framework for responding to cybersecurity incidents. The ECIRP sets out a coordinated approach to investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate.

companyName: Phillips 66

ticker: PSX


text: Our information security program is managed by a dedicated Chief Information Security Officer ("CISO") who is responsible, along with his team, for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. Our CISO has served in that role since 2021 and has been in cybersecurity related roles for more than 25 years, including with two publicly traded companies. Our Board of Directors has delegated oversight of risks from cybersecurity threats through our information security program to our Audit Committee, which receives updates twice a year on the program and on an as needed basis from our CISO regarding risks from cybersecurity threats. Our CISO additionally provides periodic updates to our Board of Directors, our Chief Executive Officer and other senior management members, including through our overall Enterprise Risk Management Program. These updates include, among other risk management issues, updates on the Company's cybersecurity risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape.

companyName: INSIGHT ENTERPRISES INC

ticker: NSIT


text: In order to mitigate risk associated with the use of third parties, LiveRamp maintains a third-party risk management program, incorporating the review of third parties by data ethics and security teams. A third party's inherent security risk is determined by identifying their level of access to our systems and data. Third parties with a high inherent risk or with access to sensitive data types undergo a review of their security controls, wherein LiveRamp reviews the third party's responses to a security due diligence questionnaire, external audit reports, penetration test reports, and/or security policies. A residual score is then determined based on the third party's controls and/or operational impact to LiveRamp. LiveRamp does not approve the use of any third parties with an inadequate security posture. For third parties handling personal information, LiveRamp also conducts legal and privacy due diligence to assess legal and privacy risks and apply mitigations where appropriate. LiveRamp security also conducts ongoing monitoring of existing third parties. On a cadence determined by the third party's residual risk level, controls are re-evaluated to ensure that the security controls of the third party have not been diminished.

companyName: LiveRamp Holdings, Inc.

ticker: RAMP


text: Our Cybersecurity Strategy Our cybersecurity strategy is built on "defense-in-depth" as recommended by the National Institute of Standards and Technology. We have processes in place to identify, assess, and manage material risks from cybersecurity threats. We have developed and implemented, and we continue to develop and implement, protective measures to reduce risk, manage incidents, and sustain our security posture. For example, in our efforts to lower the risk of ransomware attacks, we have increased our cybersecurity operations by strengthening our defense-in-depth approach to protections and controls, operational resiliency, cyber hygiene and monitoring. Specific steps include tool deployments to mitigate ransomware threats and impacts, as well as implementation of practices and enhancements to minimize the risk of ransomware launching and spreading across the organization. An additional protective measure to reduce risk with respect to the unauthorized access to confidential and sensitive data in Oncor's possession includes our data risk management (DRM) program. Our DRM program focuses on data loss prevention, including as the result of unauthorized access or acquisition, by taking proactive steps to limit confidential and sensitive information from being managed or distributed electronically in an unsecure manner. Led by our executive leadership team, as well as a governance committee and operational stakeholders, our DRM group provides formal guidance, including policies and standards, to reduce our data risk. We continue to participate, review, assess and adjust our mix of activities to improve our grid operations, digital perimeter security and information security.

companyName: ONCOR ELECTRIC DELIVERY CO LLC


text: We believe we have implemented processes that are designed to effectively identify and manage risks from cybersecurity threats. Through our Service Provider, we receive Endpoint Detection and Response services ("EDR"). The EDR helps to ensure faster identification of a cybersecurity breach. Once a cyber incident is identified, our Service Provider will notify management and work to secure our systems and fix the vulnerability. An investigation will be conducted, with the assistance of the Service Provider if needed, to determine the root cause of the cyber incident, the materiality of the cyber incident, and any disclosure or legal obligations that will stem from the cyber incident.

companyName: Saker Aviation Services, Inc.

ticker: SKAS


text: The Trustee maintains a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats, which processes are integrated into the Trustee's overall risk management process. The Trustee maintains robust cybersecurity protocols including, but not limited to technological capabilities that prevent and detect disruptions; computer workstations and programs protected with passwords and passphrases, as well as employee training throughout the year on financial regulations and cybersecurity followed up by testing of that knowledge. The protocols are based on recognized best practices and standards for cybersecurity and information technology. The Trustee has an annual assessment, performed by a third-party vendor, of the Trustee's cyber risk management program.

companyName: CROSS TIMBERS ROYALTY TRUST

ticker: CRT


text: In the last three fiscal years, we have not experienced any material cybersecurity incidents and the expenses we have incurred from security incidents were immaterial. As a result, we do not believe that risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected us, our results of operations or financial condition. Notwithstanding the measures we take to assess, identify, and manage cybersecurity risks, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. For a discussion of how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, may materially affect or are reasonably likely to materially affect us, see the risk factor entitled " Our business and operations could suffer in the event of cybersecurity breaches within our operational systems or products ".

companyName: COHU INC

ticker: COHU


text: Management receives information on cyber activities, incidents, and risk assessments quarterly from the VP/Corporate Information Security, Resilience and Data Officer (CISRDO), the SVP/Manager Application Systems, and the EVP/Operations during the Security and Information Security Committee and the Information Technology Steering Committee meetings. This information is also shared and discussed quarterly with the Enterprise-wide Risk Management Committee. Various key risk measures related to cyber risk are tracked and reported quarterly to the Enterprise-wide Risk Management Committee. Our VP/CISRDO has been with CTBI for five years and has extensive 30+ years of experience in information technology management roles in various industries. Our SVP/Manager Application Systems has been with CTBI for 32 years and has held various information technology leadership roles. Our EVP/Operations has been with the company for 30 years, leading and guiding our technology teams.

companyName: COMMUNITY TRUST BANCORP INC /KY/

ticker: CTBI


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. There can be no assurance, however, that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information. For more information, see Part I, Item 1A, “Risk Factors—Risks Related to the Operation of Our Business—Significant disruptions of our information technology systems or data security incidents could result in significant financial, legal, regulatory, business and reputational harm to us” of this Annual Report.

companyName: Aardvark Therapeutics, Inc.

ticker: AARD


text: To keep the Executive Security Incident Response Team apprised of the continually shifting landscape, the CISO typically provides quarterly updates to the Executive Security Incident Response Team on information security and cybersecurity matters. The Executive Security Incident Response Team maintains oversight of the efforts made to maximize information security and cybersecurity efforts. Potential concerns related to information security and cybersecurity will be escalated to the Board of Directors and Audit Committee, as appropriate.

companyName: VICOR CORP

ticker: VICR


text: The Board oversees our annual enterprise risk assessment, which is completed with the assistance of third party consultants, where we assess key risks within the company, including security and technology risks and cybersecurity threats. Members of the Audit Committee receive updates on a quarterly basis from management, including from the Chief Technology Officer, regarding matters of cybersecurity. These updates include existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any) and status on key information security initiatives. Our Board members also engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.

companyName: WideOpenWest, Inc.

ticker: WOW


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of management, including our Interim Chief Financial Officer, who oversees outsourced IT (including cybersecurity).

companyName: Verrica Pharmaceuticals Inc.

ticker: VRCA


text: Because we are aware of the risks associated with third-party service providers, we also have implemented robust processes to oversee and manage these risks. We conduct security assessments of third-party providers before engagement and maintain ongoing monitoring to help ensure compliance with our cybersecurity standards. In addition, we perform periodic risk assessments of key vendors. This approach is designed to mitigate risks related to potential data breaches or other security incidents originating from or at third-party service providers.

companyName: Hanesbrands Inc.


text: USL does not have computer systems or networks. Pursuant to the terms of the LP Agreement, USL's affairs are managed by USCF. USCF has implemented an information security program that is focused on ensuring the security and protection of computer systems and oversight of third-party service providers. This program includes specific provisions pertaining to data security and the security of information that, if disclosed, could have detrimental effects on USL. Such provisions relate to the handling of information and computers, as well as the protection of computer systems and software from unauthorized persons. As needed, but no less frequently than annually, USCF evaluates its cybersecurity risk profile in accordance with its compliance policies and procedures. The risk assessment aims to confirm that USCF's policies are being followed and enforced, and to identify risks that may have otherwise been unknown. To mitigate the risks from cybersecurity threats posed by third parties, USCF conducts due diligence on its critical third-party service providers with respect to (1) the cybersecurity programs and policies that they have in place as well as how they safeguard sensitive information, and (2) how those programs and policies apply to customers, including USCF and USL.

companyName: United States 12 Month Oil Fund, LP

ticker: USL


text: We engage in regular assessments of our infrastructure, software systems, and network architecture, using both our internal information security team as well as third-party consultants to ensure that cybersecurity risks are appropriately identified and that controls are appropriately designed to mitigate such risks. We also maintain a third-party risk management program designed to ensure that our vendors meet our cybersecurity requirements. This includes conducting periodic risk assessments of vendors, requiring vendors to implement appropriate cybersecurity controls, and monitoring vendor compliance with our cybersecurity requirements.

companyName: RED RIVER BANCSHARES INC

ticker: RRBI


text: With the growing number of threats from a combination of bad actors, process lapses, human errors, and third-party vulnerabilities, Crexendo is subject to increasing and evolving cybersecurity threats.

companyName: Crexendo, Inc.

ticker: CXDO


text: Fortress's cybersecurity program includes review and assessment by third parties of the cybersecurity processes and systems. These third parties assess and report on Fortress's deployment of cybersecurity best practices and industry frameworks and help to identify areas for continued focus and improvement. Annual penetration testing of its network, including critical systems and systems that store confidential or sensitive information, is conducted with third party consultants and vulnerabilities are reviewed by Fortress IT Management for remediation. When Fortress engages vendors and other third-party partners who will have access to sensitive data or client systems and facilities, its infrastructure technology team assesses their cybersecurity programs and processes.

companyName: FORTRESS CREDIT REALTY INCOME TRUST


text: The Incident Response Plan establishes procedures for assessing threats, determining when escalation of threats is required, and establishing a coordinated, multi-functional response to mitigate the impact of any incidents. After becoming aware of an incident, our cybersecurity team will review the incident against several critical questions to guide our immediate response. If an incident requires escalation, our core response team, which includes our CIO, CISO, General Counsel, CFO, Chief Compliance Officer, and other business leaders, is responsible for analyzing the materiality of the incident (including whether the incident qualifies as a material cyber event under SEC cybersecurity rules) and leading our response. The core response team is responsible for involving other corporate and business leaders throughout the organization as appropriate for communication and incident resolution, as well as communicating with the Board of Directors regarding the incident and management's response as appropriate.

companyName: Evercore Inc.

ticker: EVR


text: Our risk management program is designed to identify, assess, and mitigate risks across various aspects of the Company, including financial, operational, regulatory, reputational, and legal. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential of cyber threats. Our Information Security Officer (ISO) and virtual Chief Information Officer (CIO) is primarily responsible for this cybersecurity component and is a key member of the risk management organization, reporting directly to the President and Chief Executive Officer, as discussed below, periodically to our board of directors.

companyName: Fifth District Bancorp, Inc.

ticker: FDSB


text: Third-party information security service providers, subject to the Investment Adviser's Technology Risk and Information Security Committee (the "Committee") and Company CCO's oversight, have been engaged to monitor and support the Investment Adviser and Company information security control environment and breach notification processes. The Investment Adviser's Committee, subject to the Company CCO's oversight, monitors developments in data privacy and security.

companyName: Commonwealth Credit Partners BDC I, Inc.


text: The Chief Information Security Officer (CISO) is responsible for overseeing the Company's cybersecurity practices. Our CISO joined Autoliv in 2015. He has 30 years of information technology experience, including seven years as CISO. The CISO reports directly to the CFO but, in line with the corporate governance model, the CISO's activities are formally governed through a management board, the "Digitalization and IT Management Board" ("DITM Board") comprised of the Chief Information Officer (CIO) and certain members of Autoliv's Executive Management Team ("EMT") representing engineering, supply chain management, operations and manufacturing, quality and project management, finance, information technology, and divisional teams. The DITM Board meets at least quarterly with cybersecurity as a standing agenda item. In addition to the standing DITM Board meetings, the CISO, when needs arise, meets with the full EMT typically at least semi-annually to report on, or discuss, specific cybersecurity-related topics.

companyName: AUTOLIV INC

ticker: ALV


text: annual cybersecurity and privacy training of employees, including incident response personnel and senior management, and specialized training for certain teams depending on their role and/or access to certain types of information, such as consumer information; and a third -party risk management process that includes internal vetting of certain third -party vendors and service providers with whom we may share data and processes designed to oversee, identify, and reduce the potential impact of a cybersecurity incident at a third -party vendor or service provider or otherwise implicating the third -party technology and systems used.

companyName: Atlanticus Holdings Corp

ticker: ATLCP


text: The Company endeavors to continually refine its policies and practices to help protect its platform, adapt to changes in regulations, identify potential and emerging security risks, and develop mitigations for those risks. For example, the Company seeks to conduct incident simulations and assessments annually to help discover potential vulnerabilities, with the objective to improve decision-making and prioritize and promote the monitoring and reporting across compliance functions. As part of its overall risk mitigation strategy, the Company also maintains cyber insurance coverage.

companyName: CHOICE HOTELS INTERNATIONAL INC /DE

ticker: CHH


text: The Audit Committee receives reports from management on our cybersecurity risks, typically at least twice per year. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential. The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program.

companyName: Callaway Golf Co

ticker: CALY


text: When risks or threats are identified to us by a third party, the information security team is responsible for assessing the risk or threat and determining a course of action to mitigate the risk or neutralize the threat.

companyName: Simply Good Foods Co

ticker: SMPL


text: Related to Cybersecurity Risks Our board of directors is responsible for overseeing the Company's risk management process. Our board of directors focuses on our general risk management strategy and the most significant risks facing the Company, and works to ensure that appropriate risk mitigation strategies are implemented by management. Our board of directors also is apprised of particular risk management matters in connection with its general oversight and approval of corporate matters.

companyName: Paramount Group, Inc.

ticker: PGRE


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example: professional services firms, cybersecurity consultants, cybersecurity software providers, managed cybersecurity service providers, and penetration testing firms.

companyName: Allogene Therapeutics, Inc.

ticker: ALLO


text: Busey's security and privacy policies and procedures are in effect across all of its businesses and geographic locations. Busey adheres to various regulatory requirements and standards, including the Gramm-Leach-Bliley Act to ensure compliance with data protection laws. Additionally, Busey maintains cybersecurity insurance coverage to mitigate potential financial impacts from cyber incidents.

companyName: FIRST BUSEY CORP /NV/

ticker: BUSE


text: The Company has experienced issues related to malware, email phishing, and other events intended to disrupt information systems, wrongfully obtain valuable information, or cause other malicious events that could have harmed the Company's information systems. To the best of the Company's knowledge, these threats have not materially affected the Company, nor have they materially obstructed the availability of its information systems and data. Although no assurances can be given, the Company does not believe that such threats are reasonably likely to materially affect the Company in the future. See Item 1A. Risk Factors under the caption "Risks Related to the Company's Business, Properties and Strategies—A Disruption, Failure or Breach of the Company's Networks or Systems, Including as a Result of Cyber-Attacks, Could Harm Its Business."

companyName: SITE Centers Corp.

ticker: SITC


text: We have established comprehensive incident response and recovery plans and continue to periodically test and evaluate the effectiveness of those plans. Our incident response and recovery plans address—and guide our employees, management and the Board on—our response to a cybersecurity incident.

companyName: ESSENTIAL PROPERTIES REALTY TRUST, INC.

ticker: EPRT


text: We maintain policies and processes over areas such as information security, IT asset lifecycle, data destruction, backup, access provisioning, and maintenance of network accounts, to help govern the processes put in place by management designed to protect our IT assets, data, and services from threats and vulnerabilities. We partner with cybersecurity providers and consultants (collectively, "providers") leveraging third-party technology and expertise. These providers are a key part of our cybersecurity risk management strategy and infrastructure. These providers deliver services including systems inventory monitoring, vulnerability testing, user management including restricted access of privileged accounts, capacity monitoring, network protection and monitoring, endpoint protection, managed detection and response, remote monitoring and management, cybersecurity user awareness training, data backup management, incident response, cybersecurity strategy, and cyber risk advisory, assessment, and remediation.

companyName: AEON Biopharma, Inc.

ticker: AEON


text: Our cybersecurity team is led by our interim chief information security officer ("CISO"), who directs a unified cross-functional team that is responsible for implementing and maintaining centralized cybersecurity and data protection practices at First Advantage. Our interim CISO has numerous years of experience at First Advantage and other organizations managing security infrastructure, providing a variety of security services, and overseeing incident response and management, escalation of security events, vulnerability scanning, and security defect management. Collectively, the interim CISO and our cybersecurity team act in close coordination with senior leadership and other teams across First Advantage. In addition to our extensive in-house cybersecurity capabilities, we engage assessors, consultants, auditors, or other third parties to help assess, identify, and manage cybersecurity risks.

companyName: FIRST ADVANTAGE CORP

ticker: FA


text: Our cybersecurity risk management program includes: • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • ongoing risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.

companyName: HOULIHAN LOKEY, INC.

ticker: HLI


text: Our cybersecurity program is evaluated by both our management and board of directors. Our Chief Information Officer supervises our cybersecurity program, and our Chief Information Security Officer (CISO) manages its daily operation. Our CISO has over two decades of experience in the cybersecurity and risk management fields, including over 15 years of experience leading cybersecurity oversight, as well as various industry-recognized certifications, such as the Certified Information Systems Security Professional and Auditors certifications. The CISO provides quarterly reports to the audit committee of our board of directors, which is responsible for overseeing cybersecurity and information technology and notifying the board of directors of any significant risks or updates. These reports may include updates on our enterprise-wide cybersecurity strategy, policies, processes and standards, as well as potential cybersecurity or information technology risks and threats. Our cybersecurity program is also evaluated at least annually by external experts, and the results of those reviews are reported to our leadership team and the board of directors. Cybersecurity risk is also evaluated as an enterprise-wide risk via our enterprise risk management program, which is reviewed by our leadership team and the board of directors. All employees are required to complete semiannual cybersecurity trainings and have access to more frequent cybersecurity trainings through online simulations. We also require employees in certain roles to complete additional role-based, specialized cybersecurity trainings.

companyName: RYDER SYSTEM INC

ticker: R


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management. The Audit Committee has oversight responsibility for the Company's ERM framework, including managing cybersecurity threat risks and cybersecurity incidents. Specifically, the Audit Committee oversees the design, implementation and maintenance of an effective ERM framework for the Company's overall operational, information security, strategic, reputational, technology, and other risks. To fulfill its oversight responsibility, the Audit Committee also regularly reviews, consults, and discusses with management on strategic direction, challenges, and risks faced by the Company. The Audit Committee also regularly receives management reports on information security and enhancements to cybersecurity protections, including benchmarking assessments, which it then shares with the Board.

companyName: NCR Atleos Corp

ticker: NATL


text: We engage certain external parties, including cybersecurity assessors, consultants and auditors, to enhance our cybersecurity processes and strategies. In addition, depending on the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, we evaluate the security and risk posture with respect to our third party service providers according to the perceived level of risk and in accordance based on industry standard best practices.

companyName: Replimune Group, Inc.

ticker: REPL


text: Our internal audit team assesses the effectiveness of our internal controls relating to cybersecurity. Our management team also engages certain outside advisors and consultants to assist in the identification, oversight, evaluation and management of cybersecurity risks on a regular basis, as well as to advise on specific topics. For example, we conduct tests that help discover potential vulnerabilities, including external penetration testing and tabletop and other exercises, to evaluate our core information systems and cybersecurity practices that enable improved decision-making and prioritization, as well as to promote monitoring and reporting across compliance functions. As part of our overall risk mitigation strategy, the Company also maintains cyber insurance coverage; however, such insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyberattacks and other related breaches.

companyName: COCA COLA CO

ticker: KO


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: a cybersecurity incident response policy; asset management, tracking and disposal; incident detection and response; systems monitoring; vulnerability management policy; risk assessments; encryption of certain of our data; third-party cybersecurity staff; network security controls; segregation of certain of our data; access controls; physical security; employee training; penetration testing; and cybersecurity insurance.

companyName: UroGen Pharma Ltd.

ticker: URGN


text: employ technical safeguards that are designed to protect our information systems from cybersecurity threats, which are evaluated and improved through vulnerability assessments and other evaluations on a routine basis;

companyName: CervoMed Inc.

ticker: CRVO


text: We have implemented policies and procedures to evaluate, identify, and handle material risks associated with cybersecurity threats. These protocols are integrated into a comprehensive risk register dedicated to our cloud-based platform and internal systems access. The register undergoes an annual review conducted by the internal information technology (IT) department, overseeing cybersecurity protection for our on-premises systems, and the DevOps department, responsible for cybersecurity protection in the cloud. We also conduct regular risk assessments to identify threats to our information security systems. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks. We assess the risks facing the Company after our controls are accounted for, and then determine mitigation measures for each such risk. Our risk management processes also assess third party risks, and we perform third-party risk management to identify and mitigate risks from third parties such as vendors, suppliers, and other business partners.

companyName: D-Wave Quantum Inc.

ticker: QBTS


text: Material risks of cybersecurity threats are integrated into the Company's overall risk management program and managed across the Company, utilizing internal and third-party expertise. To protect our information systems from a cybersecurity threat, certain tools have been implemented within our IT network to help prevent, identify, detect, escalate, investigate, resolve and recover from identified vulnerabilities and security incidents in a timely manner. The Company also leverages the services and tools of a third-party cybersecurity firm to identify, prioritize, assess, mitigate and remediate reasonably foreseeable cybersecurity risks and threats.

companyName: Westrock Coffee Co

ticker: WEST


text: Our CTO has served in various roles in information technology and information security for over 35 years, which have covered operations management experience in Government Security, Identity Access Management and SaaS solutions industries. Our SVP-Engineering has over 30 years of experience in software development and engineering, starting in the U.S. Marine Corps. Our Data Engineering and Security Director has over 10 years experience in information technology, with a focus on data engineering and information security. Our General Counsel has over 12 years of experience managing risks, including risks arising from cybersecurity threats, at several publicly-traded technology companies.

companyName: authID Inc.

ticker: AUID


text: To mitigate and manage these risks, we have implemented various technical, physical, and organizational safeguards. Depending on the environment or system, these include, for example, information security policies and procedures, perimeter security controls such as firewalls and intrusion prevention systems, network security controls including multi-factor authentication and role-based access controls, and server and endpoint security controls such as anti-malware. Additionally, depending on the environment or system, we utilize application security controls, data security controls including encryption, data loss prevention controls, immutable data backups, and security awareness programs.

companyName: ONITY GROUP INC.

ticker: ONIT


text: The Company's ISO is accountable for managing enterprise information security and delivering the information security program. These responsibilities include cybersecurity risk assessment, defense operations, cyber incident response, vulnerability assessment, threat intelligence, identity access governance, and the evaluation of third party risk management and business resilience as it relates to the cybersecurity program.

companyName: JUNIATA VALLEY FINANCIAL CORP

ticker: JUVF


text: In the last three fiscal years, we have not experienced any material cybersecurity incidents. As of the date of this report, we do not believe that risks from any cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to affect us, including our business strategy, results of operations or financial condition. However, these threats pose a risk to the security of our systems and networks and the confidentiality, availability, and integrity of our data. Cybersecurity attacks could also include attacks targeting patient, employee, or customer data or the security, integrity, and/or reliability of the hardware and software we utilize in our business operations. It is possible that our information technology systems and networks, or those managed or provided by third parties, could have vulnerabilities, which could go unnoticed for a period of time. While various procedures and controls have been and are being utilized to mitigate such risks, there can be no guarantee that the actions and controls we have implemented and are implementing will be sufficient to protect and mitigate associated risks to our systems, information, or other property. For more information, see the risk factors included in Item 1A of this Annual Report.

companyName: Fulgent Genetics, Inc.

ticker: FLGT


text: The CISO or other designated person(s) conducts periodic monitoring of the networks affecting the Trust to detect unauthorized data transfers;

companyName: VanEck Merk Gold ETF

ticker: OUNZ


text: Cybersecurity remains a top financial services industry risk due to increases in the quantity and sophistication of cyberattacks, which include ransomware, malware, credential theft, supply chain, and other prevalent attack methods resulting in unauthorized access to systems or sensitive data.

companyName: CENTRAL PACIFIC FINANCIAL CORP

ticker: CPF


text: No material cybersecurity incident has been identified nor materially affected the Company's business strategy, results of operations, or financial condition during the periods covered by the Annual Report. The Company's goal is to continually assess potential incidents, enhance protocols, expand cyber risk capabilities to mitigate future risks and safeguard DFIN's intellectual property, operations and client data.

companyName: Donnelley Financial Solutions, Inc.

ticker: DFIN