text: We have established processes and procedures for ensuring the confidentiality, integrity, and availability of data. These processes are in place to assess, identify, and manage material risks from cybersecurity threats. Annual risk assessments are performed and incorporated as part of our Enterprise Risk Management (ERM) organizational process, which is overseen by our Board of Directors (the Board) and the Audit Committee, along with Executive Leadership. Our information security management system (ISMS) program is aligned to ISO 27001, which is an international standard to manage information security. ISO 27001 is published by the International Organization for Standardization (ISO), the world's largest developer of voluntary standards, and the International Electrotechnical Commission.

companyName: FASTENAL CO

ticker: FAST


text: We have established an Incident Response Plan that defines and documents procedures for assessing, identifying, and managing a cybersecurity incident. This plan requires the IT Security Manager to determine whether a cybersecurity incident has occurred and to communicate such findings to the Incident Response Team. The IT Security Manager is responsible for communicating incidents to the Vice President - IT and the other members of management as appropriate. If a cybersecurity incident is determined to be material by our management team, they would notify our Board of Directors.

companyName: TEAM INC

ticker: TISI

secItem: Item 1C


text: Our board of directors is responsible for the oversight of cybersecurity risk management. The board of directors delegates oversight of the cybersecurity risk management program to the audit committee of the board of directors (the "Audit Committee"). Our Chief Financial Officer reports to the Audit Committee. The Audit Committee updates the board of directors on our cybersecurity risk management program, including any critical cybersecurity risks, ongoing cybersecurity initiatives and strategies, and applicable regulatory requirements and industry standards on an annual and as-needed basis.

companyName: Genprex, Inc.

ticker: GNPX


text: Through the Digital QBR process, the executive leadership team is responsible for assessing and reviewing our information security program and the Company's material risks from cybersecurity threats. Additional supervision and management is provided by our Digital Leadership team, comprised of our CTO; VP, Digital Infrastructure and Operations; VP, Digital Enterprise Applications; and International IT Director.

companyName: Simpson Manufacturing Co., Inc.

ticker: SSD


text: As of the date of this Form 10 -K, we do not believe any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. See "Item 1A. Risk Factors" for further information about these risks.

companyName: Tilray Brands, Inc.

ticker: TLRY


text: Like other companies, we currently inhabit an environment of increasing global cybersecurity vulnerabilities and threats. We aim to effectively assess, identify, and manage material risks from these cybersecurity threats through our cybersecurity risk management program.

companyName: IDEXX LABORATORIES INC /DE

ticker: IDXX


text: Management is responsible for day-to-day assessment and management of cybersecurity threats and risks. Nordson's Chief Information Security Officer ("CISO"), primarily leads these efforts. The Vice President, Information Systems and Technology is responsible for oversight of Nordson's entire global IT operations, including the cybersecurity program and brings more than 25 years of experience and leadership across various information technology engineering, business and management roles, including direct oversight of strategic direction, program execution and operational excellence of technology initiatives.

companyName: NORDSON CORP

ticker: NDSN


text: To help us defend against, detect and respond to risks from cybersecurity threats, we engage a third-party cybersecurity firm to assist with aspects of our cybersecurity program including, but not limited to, network monitoring, cloud system monitoring, and employee cybersecurity awareness training. Training topics include how to escalate suspicious activities including phishing, viruses, spams, insider threats, suspect human behaviors or safety issues. We also maintain cyber liability insurance.

companyName: Ocugen, Inc.

ticker: OCGN


text: Under the CISO, the Information Security Team is responsible for defining and implementing the Company's cybersecurity strategy, policy, standards, architecture, and processes. The Information Security Team oversees the delivery of network, cloud, email and application security, security monitoring, penetration testing, cybersecurity training and incident response. Our ISMS program has been developed based on industry standards, including those published by the International Organization for Standardization and the National Institute of Standards and Technology. Through our ISMS program, we have established a comprehensive collection of policies and standard operating procedures to guide our cybersecurity strategy, which includes an Information Security Policy applicable to all Vimeo personnel, as well as a Supplier Information Security Policy for our third-party software vendors, both of which set forth cybersecurity standards, controls, and training requirements designed to protect corporate and customer data, whether it is processed by Vimeo or a service provider. We also conduct regular workforce training to instruct employees to identify cybersecurity concerns and take the appropriate action.

companyName: Vimeo, Inc.


text: oversight of cybersecurity, data privacy and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program and cybersecurity risk exposures, and the steps taken by management to monitor and mitigate cybersecurity risks. The Committee is composed of members of our board of directors with diverse expertise, which has prepared them to oversee our cybersecurity risks.

companyName: HWH International Inc.

ticker: HWH


text: We provide regular, mandatory training for personnel and contractors regarding cybersecurity threats as a means to equip our personnel with effective tools to address cybersecurity threats and to communicate our evolving information security policies, standards, processes and practices.

companyName: Fortinet, Inc.

ticker: FTNT


text: Our Senior Vice President, Information Technology is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, communicating key priorities to relevant personnel, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: IONIS PHARMACEUTICALS INC

ticker: IONS


text: Cybersecurity Risk Management • Risk Assessment: We regularly conduct comprehensive cybersecurity risk assessments, identifying potential vulnerabilities and threats that could impact the confidentiality, integrity, and availability of our medical devices and associated data. • Policies and Procedures: InfuSystem has established and maintains cybersecurity policies and procedures that align with industry best practices and regulatory requirements. These policies address areas such as data protection, access control, incident response, and vulnerability management. • Training and Awareness: We provide ongoing cybersecurity training and awareness programs to our employees and contractors, emphasizing the importance of their role in safeguarding sensitive information and reporting security incidents. • Use of Third-Parties: InfuSystem works with a third-party Cybersecurity risk partner whose systems ingest information regarding the current state of the Company's information and technology environment and using specialized algorithms provide assessments of the company's Cybersecurity risk exposure as well as providing targeted advice to mitigate any risks identified. • Third-Party Risk Management: InfuSystem evaluates the cybersecurity practices of third-party vendors and suppliers, ensuring that they meet our cybersecurity standards and pose no undue risk to our medical devices and data. • Incident Response Plan: We maintain a robust incident response plan that outlines the steps to be taken in the event of a cybersecurity incident. This plan includes procedures for reporting incidents, containing threats, and notifying affected parties as required by law.

companyName: InfuSystem Holdings, Inc

ticker: INFU


text: Security Engineering plans, builds, and maintains technical controls and solutions that enhance our security posture that mitigate risk to the enterprise while assuring the integrity of the engineering design process.

companyName: Hilltop Holdings Inc.

ticker: HTH


text: Management, in coordination with our information technology department, is responsible for assessing the risk of cybersecurity threats and hiring appropriate personnel and third-party consultants to oversee the cybersecurity program. Specifically, these processes are overseen by our multidisciplinary Technology Risk and Information Security Committee, which consists of leaders from our Information Technology, Operations, Finance, Internal Audit and Legal teams. Such individuals have an average of over 15 years of prior work experience in various roles across multiple industries involving information technology, risk management, operations and legal matters.

companyName: Vita Coco Company, Inc.

ticker: COCO


text: The Security Incident Response Plan determines how cybersecurity threats and incidents are identified, classified, and escalated, including for the purposes of reporting, and providing relevant information to the Risk Oversight committee and the full board of directors. The Security Incident Response Plan also requires assessment of materiality of the threat or incident for the purposes of public disclosure.

companyName: Federal Home Loan Bank of Topeka


text: As a financial services company, we face cybersecurity risks and threats, and our customers, suppliers, and third-party service providers face cybersecurity risks and threats. As part of the operation of our business, the Company uses, stores, and processes data for our customers, employees, partners, and suppliers. A cybersecurity incident impacting any of these entities could materially adversely affect our operations, performance, or results of operations. In addition, as a financial services company we are subject to extensive regulatory compliance requirements, including those established by the FRB, MDOB, RIDBR, and NYDFS. To address these risks and regulatory requirements, the Company implemented a Cybersecurity Risk Management Program (the "Program") that is designed to identify, assess and mitigate risks from cybersecurity threats to the data and our systems. The Program adheres to regulatory requirements and the tenets of the Federal Financial Institutions Examination Council ("FFIEC") handbook and the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF").

companyName: BROOKLINE BANCORP INC


text: Cybersecurity Risk Management and Assessment Advanced Energy understands the importance of managing risks from cybersecurity threats and maintains a comprehensive cybersecurity program developed with reference to the National Institute of Standards and Technology ("NIST") cybersecurity framework. Our cybersecurity program includes administrative, organizational, technical, and physical safeguards reasonably designed to protect the confidentiality, integrity, and availability of our data. We devote significant resources to network, operations, and product security, data encryption, business continuity/disaster recovery, vulnerability management, event monitoring and incident response, and other measures to protect our systems and data from unauthorized external access or internal misuse, including, but not limited to, the following:

companyName: ADVANCED ENERGY INDUSTRIES INC

ticker: AEIS


text: The cybersecurity program is modeled after and assessed against the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). The NIST CSF is not a certification program and our use does not imply compliance with specific, related standards – the NIST CSF is used as a guide for designing and managing cybersecurity programs.

companyName: GREIF, INC

ticker: GEF


text: We describe whether and how risks from identified cybersecurity threats have or that are reasonably likely to affect our financial position, results of operations and cash flows, under the heading "Risks Related to Our Business" included as part of our "Item 1A. Risk Factors" of this Annual Report on Form 10-K, which disclosures are incorporated by reference herein.

companyName: VAPOTHERM INC


text: Our IS Program includes the following elements: (i) internet and perimeter security; (ii) endpoint and email security; (iii) threat intelligence, monitoring and management; (iv) data security for PHI and Personally Identifiable Information ("PII"); (v) personal accountability, which includes comprehensive training for our employees and third party-contractors (including onboarding and annual training), exercises (including advanced phishing exercises) and awareness for our employees to promote vigilance of cybersecurity risks and opportunities; (vi) access management; (vii) application and cloud security; and (viii) compliance audits and assessments, which include routine technical and non-technical audits and assessments internally and in collaboration with independent third parties at least annually.

companyName: Veradigm Inc.


text: Over the past fiscal year, the Company has not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its operations, business strategy, results of operations or financial condition. See the discussion under the caption, "Risks Related to Our Real Estate Investments and Operations - We are subject to laws and regulations relating to the handling of personal information and we rely on information technology to sustain our operations. Any material failure, inadequacy, interruption or breach of the Company's privacy or information systems, or those of our vendors or other third parties, could materially adversely affect the Company's business, financial condition and results of operations. " in Item 1A, Risk Factors of this Form 10-K for further information.

companyName: ESSEX PORTFOLIO LP


text: Marc E. Binda, CPA, is an experienced risk management professional in our finance and risk management function and has served as Chief Financial Officer since September 2023 and as Treasurer since April 2018. Mr. Binda previously served as Executive Vice President – Finance and Treasurer from June 2019 to September 2023, as Senior Vice President – Finance and Treasurer from April 2018 to June 2019, as Senior Vice President – Finance from April 2012 to April 2018, and in other capacities from January 2005 to April 2012. Mr. Binda currently oversees key functions for the Company's accounting, finance, and treasury strategies, including risk management. In addition, Mr. Binda leads the Company's cybersecurity risk oversight and the development and enhancement of internal controls designed to prevent, detect, address, and mitigate the risk of cyber incidents.

companyName: ALEXANDRIA REAL ESTATE EQUITIES, INC.

ticker: ARE


text: The Company's Vice President of IT in coordination with the Company's Chief Executive Officer ("CEO"), Chief Financial Officer ("CFO"), and General Counsel ("GC"), works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. The Company maintains insurance coverage for potential breaches and a cyber incident response plan to timely, consistently, and compliantly address cybersecurity threats that may occur despite the Company's safeguards. The response plan covers preparation, detection and analysis, containment and investigation, notification (which may include timely notice to the Board if deemed material or appropriate), eradication and recovery, and incident closure and post-incident analysis. The Company retains a third-party cyber security firm to leverage in the event of a cyber security incident. The Company's response planning is reviewed annually and kept up to date with industry developments. The scope of this plan is enterprise-wide and includes the Company's business units and subsidiaries. Through ongoing communications with management, the Company's Vice President of IT monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and reports such threats and incidents to the Audit Committee when appropriate.

companyName: Green Brick Partners, Inc.

ticker: GRBK


text: The Company has developed an Incident Response Plan to guide its actions in responding to real and suspected information security incidents. This includes unlawful, unauthorized, or unacceptable actions that involve a computer system or a computer network such as Distributed Denial of Service attacks, Corporate Account Takeover schemes, or ransomware. Cybersecurity threats that are identified and deemed material are escalated and communicated directly to the Incident Response Team, in collaboration with relevant information technology personnel, insurance providers, legal counsels and when necessary, external cybersecurity firms specializing in forensic investigations.

companyName: GREENE COUNTY BANCORP INC

ticker: GCBC


text: Our ongoing cyber risk management efforts include penetration testing to assess and manage cybersecurity risks and monthly reviews of our risk register, which are updated on an ongoing basis. From time-to-time, we also provide enterprise-wide cybersecurity training for employees to continuously improve our mitigation against human-driven vulnerabilities.

companyName: Leafly Holdings, Inc. /DE


text: Our cybersecurity program is led by our CIO, who has over 30 years of experience in information technology. Our CIO leads a credentialed and experienced Information Security team who has primary responsibility for our overall cybersecurity risk management program and who supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Enterprise Risk Leadership Team, including our Executive Vice President & Chief Operating Officer, the Chief Financial Officer and the General Counsel, is responsible for assessing and managing our material enterprise risks, including risks from cybersecurity threats.

companyName: COOPER COMPANIES, INC.

ticker: COO


text: We also engage other consultants, and other third parties in connection with our risk assessment and mitigation processes. These service providers assist with the design and implementation of our cybersecurity policies and procedures, as well as monitor and test our safeguards.

companyName: PURE BIOSCIENCE, INC.

ticker: PURE


text: 3. Technical Safeguards: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including mail flow algorithms, firewalls, intrusion prevention and detection systems, malware and antivirus protection, network security protection, cloud console security and single sign-on multi-factor authentication. We also regularly conduct security and patch vulnerability scanning to help safeguard our security infrastructure.

companyName: SUTRO BIOPHARMA, INC.

ticker: STRO


text: Access control: Ensuring that access to sensitive systems and data is granted only to authorized personnel and regularly reviewed and updated.

companyName: HG Holdings, Inc.

ticker: STLY


text: The team then identifies the potential mitigation measures to address these risks, and may bring in consultants as appropriate based on their expertise and knowledge of the Company to develop strategies that are tailored to the Company's needs and profile. These measures include business continuity plans (which are developed in connection with our risk management team and the users of a given platform), improving system redundancy to limit disruptions and eliminating single points of failure where possible. In addition to our ITVP, the cybersecurity portion of our IT team includes one dedicated team member and four additional team members who handle cybersecurity risks in addition to other job responsibilities. To address any gaps in the Company's collective expertise and to account for the ever-evolving nature of cybersecurity risks, the Company retains various consultants as noted above. The internal and external headcount, and the expertise of the employees and consultants, will change from time to time as we adapt to the changing cybersecurity environment.

companyName: Portillo's Inc.

ticker: PTLO


text: Although there have been no identified material incidents to date, Management of the Company periodically reviews even non-material incidents and near misses to evaluate risk trends and improve response processes. In the event a cybersecurity incident is deemed potentially material, the Company's incident response plan requires immediate notification to the CCO of the Company, CISO of the Investment Adviser, and the Board, followed by regular status updates until resolution.

companyName: WhiteHorse Finance, Inc.

ticker: WHF


text: The cybersecurity team also closely collaborates with our physical security team on planning, risk assessment, and incident response where appropriate, as well as developing and delivering a joint annual security training and education program that engages our employees, appropriate partners and third parties in a security training program that incorporates both cybersecurity and physical security elements. Additionally, our annual security training program supports additional focused security training for personnel handling certain sensitive information such as payment card information (PCI), controlled unclassified information (CUI), or personally identifiable information (PII).

companyName: VIASAT INC

ticker: VSAT


text: Risks from Cybersecurity Threats As part of our overall risk mitigation strategy, we maintain insurance coverage for certain aspects of cybersecurity risks; however, such insurance may not be sufficient either in type or amount to cover us against claims related to cybersecurity breaches, cyberattacks, and other related breaches.

companyName: Kimball Electronics, Inc.

ticker: KE


text: Board and Management's Role in Data Privacy and Cybersecurity Oversight Our board of directors recognizes the oversight of risk management as one of its primary responsibilities and central to maintaining an effective, risk-aware and accountable organization. While the board of directors maintains ultimate responsibility for the oversight of our data privacy and cybersecurity program and risks, it has delegated certain oversight responsibilities to our audit and risk committee. Our board of directors and audit and risk committee's principal role is one of oversight, recognizing that management is responsible for the design, implementation, and maintenance of an effective program for protecting against and mitigating data privacy and cybersecurity risks. The audit and risk committee assists the board of directors in enhancing its understanding of data privacy and cybersecurity issues by overseeing our data privacy and information security programs, strategy, policies, processes, and material risks, as well as overseeing responses to security and data incidents, as appropriate.

companyName: Block, Inc.

ticker: XYZ


text: Our cybersecurity risk management processes are integrated into our overall Enterprise Risk Management ("ERM") process. As part of our ERM process, department leaders identify, assess, and evaluate risks impacting our operations across the Company, including those risks related to cybersecurity. Department leaders are asked to consider the severity and likelihood of certain risk factors, drawing upon their company knowledge and past business experience. While we maintain a robust cybersecurity program, the techniques used to infiltrate information technology systems continue to evolve. Accordingly, we may not be able to timely detect threats or anticipate and implement adequate security measures. For additional information, see "Item 1A—Risk Factors." To date, we have not experienced any material cybersecurity incidents or threats.

companyName: Beyond Air, Inc.

ticker: XAIR


text: Audit Committee of the Board oversees our cybersecurity risk and receives regular reports from our management team on various potential cybersecurity matters, including areas of emerging risks, incidents and industry trends, and other areas of importance.

companyName: Allegro Merger Corp.


text: leverage procedures informed by appropriate incident handling frameworks to help us identify, protect, detect, respond and recover when there is an actual or potential cybersecurity incident; and carry information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident.

companyName: Profound Medical Corp.

ticker: PROF


text: Board & Management Responsibilities We have formed an Information Technology Steering Committee comprised of employees from multiple departments within the Company including the Chief Executive Officer ("CEO"); the Chief Financial Officer; the Chief Accounting Officer; the Vice President, Controller; the Vice President, Investor Relations & Finance; and the Vice President of Human Resources and Compliance & Information Security Officer ("ISO") to more effectively prevent, detect and respond to information security threats. The ISO has served in various roles in corporate compliance for over 20 years and reports directly to the Company's CEO. To enhance our cybersecurity capabilities, we actively collaborate with third-party vendors. Notably, we engage a Managed Service Provider ("MSP") and an MDR provider who specializes in cybersecurity issues. Our MSP plays a critical role in supporting our IT infrastructure, offering expertise and resources that complement our in-house capabilities. The MDR provides advanced cybersecurity solutions, including continuous monitoring and threat detection services, which are integral to our cybersecurity program.

companyName: NATIONAL HEALTH INVESTORS INC

ticker: NHI


text: The CIO reports quarterly to senior management, including the Chief Executive Officer, Chief Financial Officer, Chief Accounting Officer and General Counsel, among others, on the status of company-wide cybersecurity initiatives, risks and other developments. The CIO or key members of the executive leadership team update the audit committee of our Board periodically on the cybersecurity landscape, the status of ongoing initiatives and any threats or other issues. The audit committee has ultimate oversight over the cybersecurity of the organization.

companyName: Weatherford International plc

ticker: WFRD


text: Our CISO leads the strategy, engineering, and operations of cybersecurity across the Company and is responsible for providing annual updates to our Board and the ORC on our WISP program, as well as ad hoc updates on information security and cybersecurity matters. Our CISO reports directly to the Risk Management Committee. The CISO has been with the Company since 2016 and prior to this worked in a number of security and technical roles within the Federal Reserve System.

companyName: STIFEL FINANCIAL CORP

ticker: SF


text: Our cybersecurity risk management is based on recognized cybersecurity industry frameworks and standards, including those of the National Institute of Standards and Technology, the Center for Internet Security Controls, and the International Organization for Standardization.

companyName: IDT CORP

ticker: IDT


text: Our internal security controls are designed to align with standards set by the National Institute of Standards and Technology, or NIST, and the International Organization for Standardization, or ISO. In addition, our security processes are assessed by the Federal Financial Institutions Examination Council, or FFIEC, due to our status as a cybersecurity provider to several financial institutions and financial services organizations. Our security processes also are tested or assessed in accordance with the Sarbanes-Oxley Act of 2002, compliance obligations under the Service Organization Control Type 2 auditing procedure, or SOC2, and applicable privacy laws, both in the United States and internationally.

companyName: SecureWorks Corp


text: We design and assess our Cybersecurity Program based on published frameworks, including the National Institute of Standards and Technology, and routinely evaluate our program for ongoing adherence to those frameworks.

companyName: DAKTRONICS INC /SD/

ticker: DAKT


text: Key members of the IT team responsible for information security include several individuals with over 20 years of experience within various industries, including real estate, global retail, fintech, and insurance, along with experience working for several top IT service and solutions providers. The IT team provides quarterly reports to the Company's senior management, which typically address, among other things, the Company's cybersecurity strategy, initiatives, key security metrics, business response plans, and the evolving cybersecurity threat landscape.

companyName: KITE REALTY GROUP TRUST

ticker: KRG


text: Strategy and Procedures We, our Investment Adviser and its affiliates regularly assess risks from cybersecurity threats, monitor our information systems for potential vulnerabilities, and test those systems pursuant to our cybersecurity policies, standards, processes, and practices, which are integrated into our overall risk management system. To protect our information systems from cybersecurity threats, we use various security tools that help us identify, protect against, detect, respond to, and recover from security incidents. These efforts are implemented by Carlyle's Global Technology & Solutions ("GTS") team in partnership with our business, legal, and compliance teams, and are essential for us to conduct investment activities, manage internal administration activities, and connect our global enterprise. Our systems, data, network, and infrastructure are monitored and administered by formal controls and risk management processes that log events and help protect the our data. In addition, our business continuity plans are designed to allow critical business functions to continue in an orderly manner in the event of an emergency. The GTS team works closely with Carlyle's business segment teams, including our Investment Adviser, to maintain operational resilience through business continuity planning and annual information technology disaster recovery and incident response plan testing, which collectively support the goal of mitigating risk were an emergency to occur. The GTS team has procedures in place to report cybersecurity threats or incidents on a periodic basis. These efforts are underpinned by the implementation of security best practices, where possible, such as: • Multi-factor authentication for remote access, privileged access management for system administrators, application whitelisting, laptop encryption, and advanced malware defenses on endpoints; • Incident preparedness and response planning and risk mitigation; • Independent and continuous security testing, assessment and vulnerability management; • Regular security awareness training, including phishing simulations, for Carlyle authorized users; • Restrictions on access to personal email accounts, cloud storage, social media, risk-based categories of websites and USB storage devices; • Device and system access management policies and procedures that restrict access upon employee or contractor separation from the company; and • Compliance attestations by Carlyle personnel on firm policies, such as Carlyle's acceptable use policy, upon hire and annually.

companyName: Carlyle Secured Lending, Inc.

ticker: CGBD


text: Board considers cybersecurity risk as part of its risk oversight function and has delegated oversight of cybersecurity and other information technology risks to the Company's Chief Executive Officer and Chief Financial Officer, who oversee management's implementation of our cybersecurity risk management program and incident response plans.

companyName: EDUCATIONAL DEVELOPMENT CORP

ticker: EDUC


text: Management oversight of information security matters, including managing and assessing risks from cybersecurity threats fall under the oversight of our Executive Management Team which includes representation of senior leadership from Operations, Legal and Risk Management, Finance and Administration. The Executive Management Team receives regular security updates from our Chief Information Officer. Our Executive Management team participates in cybersecurity incident response efforts by engaging with the incident response team and helping direct our response to and assessment of certain cybersecurity incidents and subsequent reporting and disclosure requirements.

companyName: TETRA TECH INC

ticker: TTEK


text: To manage our material risks from cybersecurity threats, we take certain measures, including the below listed activities, depending on the nature of the relevant systems, data, and environment: • undertaking period reviews of our consumer-facing policies and statements; • conduct phishing security training for employees and contractors with access to corporate email systems; • require employees, and data service providers with whom we share customer, employee or partner data, to treat customer information with care; • running tabletop exercises to simulate a response to a cybersecurity incident; • carrying cybersecurity insurance that provides protection against the potential losses arising from a cybersecurity incident; • conducting annual cybersecurity awareness training for employees; and • maintaining an incident response plan to prepare for, detect, respond to, and recover from, cybersecurity incidents.

companyName: Sunrun Inc.

ticker: RUN


text: The Company's Information Security Program aligns with Santander's Information Security Framework, as well as US regulatory requirements and industry standards, including the guidelines provided by the FFIEC IT Handbook and the US National Institute of Standards and Technology. This program is risk-driven, with documented policies, standards, processes, and procedures to ensure the identification, assessment, and appropriate management of risk. The Company has implemented a multi-layered and integrated defense model built around five security pillars – Govern, Identify, Protect, Detect, Respond and Recover – with key controls implemented in each of these pillars. • Govern covers the essential aspects of the information security program consisting of risk management strategy, third-party and supply chain risk management, roles and responsibilities, strategy, policies, and standards. • Identify covers the identification of information security and cybersecurity risk to systems, assets, data, and capabilities consisting of asset management, risk assessments including vulnerability identification and continuous improvements from testing and evaluations. • Protect covers development and implementation of appropriate safeguards to ensure delivery of critical infrastructure services. This pillar supports the ability to protect the organization against potential cybersecurity events and consists of access management and authentication, data security, awareness and training, platform security, and infrastructure resilience including network defenses. • Detect covers the development and implementation of the appropriate activities to identify the occurrence of a cybersecurity event consisting of adverse activities or events analysis, and security continuous monitoring. • Respond and recover covers the development and implementation of the appropriate activities to take action regarding a detected cybersecurity event and to maintain plans for resilience and restore any capabilities or services that were impaired due to a cybersecurity event.

companyName: Santander Holdings USA, Inc.


text: During fiscal year 2023 we began to deploy and utilize enterprise scale technology to support an appropriate cybersecurity posture including: endpoint detection and response, firewalls, security information and event management, email security, multifactor authentication, and vulnerability management. As part of the service offering from our outsourced IT security services provider, cybersecurity related alerts will be issued to us as relevant situations develop. These alerts will be evaluated in concert with our IT provider and in the event an alert requires action within our environment, such actions will be taken promptly. Our process and cybersecurity posture will continue to be refined based on the results of periodic cybersecurity assessments conducted jointly with our IT provider. We have recently begun reporting on cybersecurity in reports to the Board of Directors and will continue to do so.

companyName: CNS Pharmaceuticals, Inc.

ticker: CNSP


text: Information Security Policy and Requirements The Company's Information Security Policy ("Policy") is based upon the International Organization for Standardization ("ISO") 27001, Health Information Trust Alliance ("HITRUST") Common Security Framework ("CSF"), System and Organization Controls 2 Type 2 ("SOC 2 Type 2"), and Payment Card Industry Data Security Standard ("PCI DSS") frameworks and standards and provides specific and detailed direction and support for appropriately maintaining the overall security, confidentiality, integrity, and availability of information within the Company. The Policy covers all processes, equipment, hardware, and software owned or under the control of the Company as well as networks operated by third parties containing Company information or processes. It addresses the Company's procedures and controls for, including but not limited to, asset and data management, user access and authentication, personnel education/trainings, change management, risk management, system configurations, security monitoring and reporting, vulnerability management, and business continuity and disaster recovery. The Policy applies to all employees, consultants, contractors, and other such persons ("Personnel") with access to the aforementioned processes, equipment, hardware, and software. The Policy requires that Personnel agree to and are trained annually on all components of the Policy as a condition of employment, partnership, or temporary affiliation with the Company.

companyName: Consensus Cloud Solutions, Inc.

ticker: CCSI


text: Murphy's cybersecurity environment and risk strategy is broadly managed by the Company's Information Technology (IT) group, which oversees the Company's IT and Operational Technology (OT) infrastructure. Within the IT group, the Murphy Cybersecurity Team (MCT) is specifically responsible for monitoring and managing security of the enterprise IT and OT network and systems, including developing and deploying administrative policies, technical controls, and safety protocols necessary to prevent unauthorized access, theft, damage, or loss of Company data or systems. All members of the MCT hold globally-recognized security certifications and have wide-ranging experience in cybersecurity matters. The Incident Management Team (IMT) is responsible for responding to active security threats and incidents as they occur. The Chief Information Officer oversees the IT group and is a member of the IMT, and provides briefings to the CEO, the executive leadership team, and the Audit Committee of the Board regarding cybersecurity risks, strategy, and management at least annually. The Audit Committee is ultimately responsible for overseeing cybersecurity strategy and ensuring that management has sufficient resources, programs, and processes in place to identify, evaluate, manage, and mitigate relevant cybersecurity risks to which Murphy is exposed and to implement processes and programs to manage cybersecurity risks and mitigate any incidents. The Audit Committee also reports material cybersecurity risks to the Board as appropriate. We believe this visibility and oversight structure allows the Board and executive leadership team to make timely, data-driven decisions ensuring that Murphy, its employees, investors, and partners are adequately protected.

companyName: MURPHY OIL CORP

ticker: MUR


text: Cybersecurity is an important part of our risk management processes and an area of focus for our management. Our executive management is responsible for the oversight of risks from cybersecurity threats. Members of our board of directors receive updates from our executive management team regarding matters of cybersecurity. This includes existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any) and status on key information security initiatives.

companyName: Journey Medical Corp

ticker: DERM


text: Given the critical importance of cybersecurity, including data privacy, we have developed a cybersecurity program, supported by risk management and oversight procedures. The cybersecurity program includes written policies and standards that take into account the guidance of well-recognized industry cybersecurity frameworks.

companyName: Brixmor Property Group Inc.

ticker: BRX


text: In the event of a suspected incident, our incident response plan outlines the steps to be followed from incident detection to mitigation, recovery and notification, including notifying the head of our Information Technology department ("Head of IT") and functional areas (e.g., legal and human resources) as appropriate. This includes processes for assessing such incidents for materiality, making required notifications, disclosures or communications and determining, among other things, whether any prohibition on the trading of our common stock by insiders should be imposed prior to the disclosure of information about a material cybersecurity event.

companyName: Varex Imaging Corp

ticker: VREX


text: We have implemented a comprehensive cyber risk management program that adheres to industry standards, specifically the National Institute of Standards and Technology's cybersecurity framework and risk management standards. This program is maintained by a dedicated security operations team at the Company (the "Security Operations Team"). This process includes annually assessing and categorizing existing and emerging threats to Asure's business operations and its information systems. Identified risks are assessed for severity and probability of impact and then risk treatments are identified and implemented. Additionally, Asure has implemented a vendor risk management program to continually assess and monitor risks posed by vendors and partners of the Company.

companyName: ASURE SOFTWARE INC

ticker: ASUR


text: To date, no risks from cybersecurity threats, including as a result of any previous cybersecurity incident, have materially affected our business strategy, results of operations, or financial condition. Notwithstanding our investment in cybersecurity, we may not be successful in identifying a cybersecurity risk or preventing or mitigating a cybersecurity incident or product security vulnerability that could have a material adverse effect on our business, results of operations, or financial condition. For a discussion of cybersecurity risks affecting our business, see "Item 1A—Risk Factors—Risks Relating to Our Business and Our Industry." Although we maintain cybersecurity insurance, the costs related to cybersecurity incidents may not be fully insured.

companyName: Dell Technologies Inc.

ticker: DELL


text: The Board of Directors has risk oversight responsibility regarding risks that could affect the Company. Oversight for certain risks is administered through committees of the Board. The Audit Committee of the Board is responsible for oversight over our enterprise risk management framework. Cybersecurity risk is included in our enterprise risk management program.

companyName: FOOT LOCKER, INC.


text: The Bank's CISO has over 20 years of experience in cybersecurity across various verticals. Our CISO brings a wealth of expertise to his role. His background includes extensive experience and certifications in all facets of information technology and information security. His in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies. The Bank's CISO remains informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. To assist the Information Security team in such knowledge acquisition, we subscribe to services that provide Bank personnel with alerts on security incidents and threats. Our CISO oversees the implementation and processes for regular monitoring of our information systems. This includes the deployment of advanced security measures and regular internal/external assessments to identify potential vulnerabilities. In a cybersecurity incident, the information security incident response plan is enacted. This plan includes immediate actions to mitigate the impact of and remediate the incident.

companyName: GUARANTY BANCSHARES INC /TX/


text: Risk owners are the individuals who are ultimately accountable for ensuring the risk is managed appropriately. There may be multiple personnel who have direct responsibility for or oversee activities to manage each identified risk and collaborate with the accountable risk owner in his/her risk management efforts. Responsibilities for the continued development, implementation, and maintenance of the risk management program are also assigned internally to IT.

companyName: CXApp Inc.

ticker: CXAI


text: Our Director of IT Infrastructure and Cybersecurity has direct responsibility for assessing, monitoring and managing risks related to cybersecurity threats in conjunction with the Vice President of Information Technology. Third party experts and/or consultants are retained to help identify, assess and monitor cybersecurity incidents and related risks. Our Director of IT Infrastructure and Cybersecurity has been in that position with the Company since 2019 and, including prior experience, has over 12 years' experience in managing IT infrastructure, architecture and security. Our Vice President of Information Technology has been with the Company in his current position and similar roles since its inception in 2011. Prior to joining the Company, he had over 20 years' experience in oversight of Information Technology systems including ERP systems, infrastructure, and networking.

companyName: Cactus, Inc.

ticker: WHD


text: The Board of Directors has oversight responsibility for risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements, cooperation with law enforcement, and related effects on financial and other risks. Senior management regularly discusses cyber risks and trends and, should they arise, any material incidents with the Board of Directors.

companyName: BioCardia, Inc.

ticker: BCDA


text: Our Cybersecurity Risk Management Program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • cybersecurity awareness training of our employees, and incident response personnel; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; • a third-party risk management process for service providers, suppliers, and vendors; and • engage ment of third parties for our 24/7 monitoring, detection, and response; regular penetration testing, program controls assessment, and proactive incident preparedness activities.

companyName: SKECHERS USA INC


text: As part of its enterprise risk management ("ERM") framework, Morgan Stanley has implemented and maintains a program to assess, identify and manage risks arising from the cybersecurity threats (the "Cybersecurity Program"). The Cybersecurity Program has been adopted by the General Partner, and applies to its business, as relevant. The Cybersecurity Program helps protect Morgan Stanley's clients, customers, employees, property, products, services and reputation by seeking to preserve the confidentiality, integrity and availability of information, enable the secure delivery of financial services, and protect the business and the safe operation of Morgan Stanley's technology systems. Morgan Stanley continually adjusts the Cybersecurity Program to address the evolving cybersecurity threat landscape and comply with extensive legal and regulatory expectations.

companyName: Ceres Tactical Commodity L.P.


text: Our Board has delegated the primary responsibility for oversight and review of guidelines and policies with respect to risk assessment and risk management, including cybersecurity risk, to the Audit Committee. Our Chief Technology Officer periodically reports to the Audit Committee as well as the full Board, as appropriate, on cybersecurity matters. Such reporting includes updates on our cybersecurity program, the external threat environment and our programs to address and mitigate the risks associated with the evolving cybersecurity threat environment. These reports also include updates on our preparedness, prevention, detection, responsiveness and recovery with respect to cyber incidents.

companyName: BLUE OWL CAPITAL INC.

ticker: OWL


text: Our information security team, led by our CIO and Senior Director, IT Security and Compliance, has over 75 years of collective cybersecurity experience and maintains numerous active industry-recognized cyber certifications, such as Certified Information Security Manager (CISM), Certified Information Systems Security Professional (CISSP), and Certified Information Systems Auditor (CISA). Our information security team undertakes a variety of measures in the daily monitoring and management of cybersecurity risks across our business. For example, the information security team monitors our technology infrastructure with tools designed to detect suspicious behavior and decrypt VPN traffic on our systems globally. The information security team conducts regular internal and external audits with third-party cybersecurity experts to identify and evaluate potential weaknesses in its cybersecurity systems. Some of these third-party monitoring functions continue throughout the year while other third-party security experts are periodically retained to audit specific areas of our cybersecurity program. In addition, our information security team works with our internal audit function to monitor reporting and escalation of cybersecurity incident reports from across our business. Our information security team also works with our Executive Vice President, Chief Administrative Officer and General Counsel on our data privacy program, including with respect to the preservation and protection of the integrity and confidentiality of our data and systems.

companyName: SBA COMMUNICATIONS CORP

ticker: SBAC


text: Cybersecurity risk management is overseen at the highest levels of the Company's leadership. The Board of Directors, through its Audit Committee, is responsible for monitoring the Company's cybersecurity risks and related risk management practices. The Audit Committee receives regular reports from management on cybersecurity matters, including updates on risk assessments, security improvements, and any relevant threat developments or incidents. Senior management has designated personnel (including information technology and security officers) to manage day-to-day cybersecurity operations and to implement cybersecurity policies, controls, and procedures. These personnel regularly brief the Audit Committee and the Board on the status of the Company's cybersecurity posture and risk mitigation activities. The Company also provides periodic cybersecurity training to all employees to reinforce security awareness and protocol compliance as part of its internal control framework.

companyName: SPECTRAL CAPITAL Corp

ticker: FCCN


text: Material Cybersecurity Risk, Threats & Incidents Routinely, we partner with and use third-party service providers and products that host, manage, or control sensitive data. We and the companies we work with have experienced cybersecurity incidents involving our data and systems, including ransomware and other forms of malware and computer virus attacks, unauthorized access, systems failures and temporary disruptions. For example, in June 2018, we identified forged and fraudulently induced electronic payment disbursements we made to third parties in an aggregate amount of $10 million resulting from unauthorized third-party access to our email system. Risks from cybersecurity incidents, including as a result of the June 2018 incident, have not materially affected us, including our business strategy, results of operations or financial condition for the periods covered by this Annual Report, and we do not believe that such risks are reasonably likely to have such an effect over the long term. Additional information on cybersecurity risks we face can be found in Part I, Item 1A "Risk Factors" of this Annual Report under the heading "Failure to maintain the integrity of internal or customer data or to protect our information systems from cyber-attacks could disrupt our business, damage our reputation, and subject us to costs, fines or lawsuits," which should be read in conjunction with the foregoing information.

companyName: MARRIOTT VACATIONS WORLDWIDE Corp

ticker: VAC


text: An analysis of information and technology assets that ranks the assets based upon their risk of potential internal and external threats and the impact of the potential loss of integrity, confidentiality, and availability of that asset is updated as appropriate. An Information Security Risk Assessment led by the Manager's Chief Information Officer ("CIO") is performed on an annual basis, and/or upon major changes of cybersecurity related processes and infrastructure, for evaluating the potential impacts to key technology, processes, and people upon known relevant threats. Either a mitigating action plan and/or risk acceptance with valid business reasons is required as a response to each identified risk. The results of the Information Security Risk Assessment are available to senior management for review and approval.

companyName: RIDGEWOOD ENERGY T FUND LLC


text: The potential impact of risks from cybersecurity threats on the Company are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, the Company has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition.

companyName: PRINCETON CAPITAL CORP

ticker: PIAC


text: Our Chief Information Security Officer reports to our Chief Information Officer. Our Chief Information Security Officer has more than 25 years of experience working in information technology-related roles, of which more than 10 years has been in information security leadership, and holds degrees in bio-medical engineering and computer science.

companyName: CHARLES RIVER LABORATORIES INTERNATIONAL, INC.

ticker: CRL


text: Although risks from cybersecurity threats have to date not materially affected, and we do not believe they are reasonably likely to materially affect, us, our business strategy, results of operations or financial condition, like other companies in our industry, we could, from time to time, experience threats and security incidents related to our and our third-party vendors' information systems. For more information, please see "Item 1A. Risk Factors - Increased Information Technology ("IT") security threats and more sophisticated computer crime could pose a risk to our systems, networks, and services."

companyName: OXBRIDGE RE HOLDINGS Ltd

ticker: OXBR


text: Collaborative Approach. Apollo utilizes a cross-functional approach involving stakeholders across multiple departments, including Apollo Compliance, Legal, Technology, Operations, Risk and others, aimed at identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of potentially material cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by Apollo management, in consultation with our management and our Board as applicable, in a timely manner.

companyName: Apollo Infrastructure Co LLC


text: Management is responsible for assessing and managing the any material risks to the Company from cybersecurity threats. However, management has no specific expertise in such matters, and there are no specific processes by which management is informed about or monitors the prevention, detection, mitigation and remediation of cybersecurity incidents. If any such risks were identified, management would report such risks to the board of directors.

companyName: DEEP FISSION, INC.


text: FirstEnergy's Cyber Security Program identifies security controls and user responsibilities for the organization to identify and manage the risk of a cyber security incident. FirstEnergy also conducts various internal and external risk assessments each year. These include required annual compliance assessments, such as requirements under the Sarbanes-Oxley Act and Payment Card Industry Data Security Standard compliance audits, as well as ad-hoc assessments driven by emerging risks, changes in FirstEnergy's environment, or benchmark/roadmap needs. Risks identified in such assessments are considered for inclusion in FirstEnergy's risk portfolio, or incorporated directly into the Cyber Security Program, and are then prioritized and addressed as needed through the organization's written policies and procedures. The risk assessment along with risk-based analysis and judgment are used to select security controls to address risks. During this process, the following factors, among others, are considered: likelihood and severity of risk, of impact on FirstEnergy and others, such as vendors and customers, if a risk materializes, feasibility and cost of controls, and impact of controls on operations and others. FirstEnergy also regularly evaluates the adequacy and sufficiency of specific controls.

companyName: FirstEnergy Transmission, LLC


text: We have adopted and continue to maintain a cybersecurity risk management program that implements various controls, technology, and procedures for the evaluation, identification, and handling of significant cybersecurity risks that could impact the confidentiality, integrity, or availability of our information systems.

companyName: ADTRAN Holdings, Inc.

ticker: ADTN


text: Following these risk assessments, we evaluate whether and how to re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate personnel, including our Vice President, Information Technology, who reports to our Executive Vice President, Chief Technology Officer, and Head of Operations, to manage the risk assessment and mitigation process.

companyName: Sana Biotechnology, Inc.

ticker: SANA


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition. There were no material cybersecurity breaches during 2024. See "Risk Factors – Security breaches, cyber-attacks and other disruptions could compromise our information, expose us to fraud or liability, or interrupt our operations, which would cause our business and reputation to suffer."

companyName: AQUABOUNTY TECHNOLOGIES INC

ticker: AQB


text: Reporting to Board of Directors The Vice President of IT and the Director of IT Infrastructure and Security, in their respective capacity, inform the Chief Financial Officer (CFO) and Chief Legal Officer (CLO) of cybersecurity risks and incidents. Furthermore, significant cybersecurity matters, and strategic risk management decisions are required to be escalated to the Board, ensuring that they have comprehensive oversight and can provide guidance on critical cybersecurity issues. See Item 1A "Risk Factors" – "Risks Related to Business Operations and Industry."

companyName: Arcturus Therapeutics Holdings Inc.

ticker: ARCT


text: Our cybersecurity governance program is led by the Vice President and Chief Information Officer, with support from the internal information technology department. The Vice President and Chief Information Officer has over 20 years of technological leadership experience in the oil and gas industry, providing oversight of all information technology disciplines, including cybersecurity, networking, infrastructure, applications, and data management and protection. The Vice President and Chief Information Officer and his team, which consists of individuals who hold designations as Certified Information Systems Security Professional (CISSP), Certified Information Systems Auditor (CISA), CompTIASecurity+, and Department of Defense (DoD)-Cybersecurity General, are responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture and processes. In addition, our cybersecurity incident response team is responsible for responding to cybersecurity incidents in accordance with our Computer Security Incident Response Plan. Progress and developments in our cybersecurity governance program are communicated to members of the executive team. The audit committee of the board of directors receives quarterly updates on the status of our cybersecurity governance program, including as related to new or developing initiatives and any security incidents that may occur. Board members receive presentations on cybersecurity topics from the Vice President and Chief Information Officer as part of the board's continuing education on topics that impact public companies. Further, our code of business conduct and ethics expects all employees to safeguard our electronic communications systems and related technologies from theft, fraud, unauthorized access, alteration or other damage and requires them to report any cyberattacks or incidents, improper access or theft to our Chief Legal and Administrative Officer and the Vice President and Chief Information Officer. Our cybersecurity governance program also includes processes to assess cybersecurity risks related to third-party vendors and suppliers.

companyName: Diamondback Energy, Inc.

ticker: FANG


text: In the event that we experience a cybersecurity incident, we have a cybersecurity incident response playbook that sets forth the applicable processes, roles, engagements, escalations and notifications to be executed in order to promptly respond to such threats. Depending on its nature and scale, a cybersecurity threat may be managed within our information security office, escalated to our CISO and CIO, or escalated to our management, and Audit Committee and Board of Directors, as appropriate. In certain instances, our GSR may be initiated and will collectively manage Teva's response to a crisis on a corporate level. The GSR is comprised of members from our various business units and regions, including senior leadership from a variety of functions, such as information security, legal, finance, human resources, communications and compliance.

companyName: TEVA PHARMACEUTICAL INDUSTRIES LTD

ticker: TEVA


text: Our cybersecurity incident response plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including Security Management. Security Management work with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response plan includes reporting to the audit committee of the board of directors for certain cybersecurity incidents.

companyName: CASTLE BIOSCIENCES INC

ticker: CSTL


text: The Board of Directors, primarily through its Audit Committee, oversees the Company's cybersecurity program. Management regularly reports to the Audit Committee on the current state of the Company's cybersecurity program, including the current threat landscape, cybersecurity risks, and any significant incidents. The Audit Committee may provide updates to the Board on the substance of these reports and any recommendations for improvements that the Audit Committee deems appropriate.

companyName: AWARE INC /MA/

ticker: AWRE


text: We also lack sufficient resources to adequately protect against, or to investigate and remediate any vulnerability to, cyber incidents. It is possible that any of these occurrences, or a combination of them, could have material adverse consequences on our business and lead to financial loss. For more information about the cybersecurity risks we face, see the risk factor entitled " General Risk Factors - Cyber incidents or attacks directed at us could result in information theft, data corruption, operational disruption, and/or financial loss" in Item 1A. Risk Factors. As of the date of this Annual Report, we have not encountered any cybersecurity incidents since our initial public offering.

companyName: Catcha Investment Corp


text: We operate in the technology and general wellness, continuous glucose and blood pressure monitoring sectors, which are subject to various cybersecurity risks that could adversely affect our business, financial condition, and results of operations, including intellectual property theft fraud extortion harm to employees or customers violation of privacy laws and other litigation and legal risk and reputational risk. We have implemented a risk-based approach to identify and assess the cybersecurity threats that could affect our business and information systems.

companyName: Corvex, Inc.

ticker: MOVE


text: Our information security function, led by our Director of Information Technology, helps identify, assess and manage the Company's cybersecurity threats and risks, including through the use of the Company's risk register. Our Director of Information Technology helps to identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example, monitoring provided by a third-party security operations center, deploying manual and third-party service provider automated tools in certain environments, subscribing to reports and services that identify cybersecurity threats (and analyzing such reports), conducting scans of certain environments, evaluating our industry's risk profile and threats reported to us, conducting internal audits and threat assessments for certain threats, conducting vulnerability assessments using third-party tools to identify vulnerabilities, engaging third parties to conduct threat assessments, using external intelligence feeds and monitoring the dark web.

companyName: RAPT Therapeutics, Inc.

ticker: RAPT


text: In the event of a cybersecurity incident, the Company is equipped with an incident response plan that includes: (i) detection and analysis, (ii) containment and eradication, (iii) remediation and (iv) preparation for future incidents. Incident responses will be led by our incident response team and supported by Legal, Compliance and other functions as appropriate. Our CFO provides regular updates to the Audit Committee concerning the Company's technology and cybersecurity programs, associated risks and the Company's efforts to help mitigate those risks.

companyName: Liquidia Corp

ticker: LQDA


text: Our Board oversees the Company's aggregate risk profile and risk management process. The Board administers this oversight function with respect to cybersecurity risks through the Audit Committee, which is responsible for overseeing the Company's cybersecurity risk management processes, including the steps our management has taken to monitor and control cybersecurity risks.

companyName: YELP INC

ticker: YELP


text: The Company's management maintains and implements a written Cyber Security Incident Response Policy and Cyber Security Incident Response Plan, both of which are reviewed and updated on a periodic basis. In the event we identify a potential cybersecurity, privacy or other data security issue, we have defined procedures for responding to such issues, including procedures that address when and how to engage with Company management, the Audit Committee, our Board of Directors, other stakeholders and law enforcement when responding to such issues.

companyName: Childrens Place, Inc.

ticker: PLCE


text: Our organization prioritizes cybersecurity risk management, with leadership actively assessing and overseeing these risks. Our internal protocols require that significant cybersecurity risks be escalated to executive leadership, as well as to relevant management responsible for preventing, detecting, mitigating, and addressing cybersecurity incidents. These protocols ensure consistent and effective incident response, setting standards for internal notification and escalation. Additionally, they outline guidelines for external notifications, including disclosures to state or federal agencies or affected customers in the event of a cybersecurity incident. This structured framework supports our commitment to strong cybersecurity governance and risk management practices.

companyName: DFP HOLDINGS Ltd


text: The Company has not adopted any formal cybersecurity risk management program or formal processes for assessing, identifying, and managing material risks from cybersecurity threats. At the management level, our Chief Executive Officer and Interim Chief Financial Officer are responsible for addressing cybersecurity incidents, while our full board of directors has oversight responsibility for the Company's overall risk management, including cybersecurity risk, and has not delegated oversight authority for cybersecurity risks to any committee. In the event a cybersecurity incident occurs, the Company's Chief Executive Officer and the Interim Financial Officer are expected to inform our board of directors of the details of such incident as well as the measures taken in response to such incident. In fiscal year 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.

companyName: JONES SODA CO.

ticker: JSDA


text: Monitor Cybersecurity Incidents The CISO and Senior Director of Information Security are continually informed and updated about the latest developments in cybersecurity, including emerging threats and innovative risk management techniques. They implement and oversee processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the Company is equipped with a defined and practiced incident response plan. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.

companyName: Arcosa, Inc.

ticker: ACA


text: Risks maintain a Risk Management Policy that governs the process in which we identify cybersecurity risks, evaluate their associated impacts and risk levels, and document them accordingly in the Cybersecurity Risk Register.

companyName: Grace Therapeutics, Inc.

ticker: GRCE


text: Our cybersecurity risk management program includes, among other things: • risk assessments designed to help identify material cybersecurity risks to our critical systems and information services; • a team comprising information technology (IT) security, IT infrastructure, and IT compliance personnel principally responsible for directing (i) our cybersecurity risk assessment processes, (ii) our security processes and (iii) our response to cybersecurity incidents; • the use of external cybersecurity service providers, where appropriate, to assist with development, testing and compliance in regards to our security controls and processes; • cybersecurity awareness training of employees with access to our IT systems; • a cybersecurity incident response plan and Security Operations Center to respond to cybersecurity incidents; • a third-party risk management process for service providers; and • procurement of insurance coverage that is intended to address certain aspects of cybersecurity risks.

companyName: QUANTA SERVICES, INC.

ticker: PWR


text: We engage consultants or other third parties in connection with our risk assessment processes. These service providers assist us in designing and implementing our cybersecurity policies and procedures, and monitoring and testing our safeguards. We require each third-party service provider to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our Company. Our Chief Financial Officer and Senior Director, Head of IT and Informatics provide periodic briefings to the Audit Committee regarding our Company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and related matters. The Audit Committee provides regular updates to the full Board of Directors on such reports.

companyName: Cartesian Therapeutics, Inc.

ticker: RNAC


text: We are dedicated to continuous improvement in our cybersecurity program. We regularly monitor, evaluate, and aim to enhance our capabilities through investments in technology, infrastructure, and personnel. Our goal is to stay ahead of emerging threats and maintain the highest level of cybersecurity resilience.

companyName: Ranger Energy Services, Inc.

ticker: RNGR


text: Our management oversees the assessment and management of cybersecurity threats and regularly considers cybersecurity risks in the context of other material risks to the Company. In the event of any reportable cybersecurity incident, our management shall promptly notify our board of directors, including determining the necessary actions such as disclosure, mitigation, or other appropriate responses. We obtain input, as appropriate, for our cybersecurity risk management program on the security industry and threat trends from external experts. During the reporting period, we have not experienced any material cybersecurity incidents, which would require disclosure.

companyName: Solidion Technology Inc.

ticker: STI


text: Our Sponsor's CISO leads our cybersecurity program. Their CISO holds advanced qualifications and has extensive experience in cybersecurity. Their CISO leads a global team of cybersecurity professionals with relevant prior employment experience at global financial services firms, leading technology companies, cybersecurity providers, the government and the military, some of whom are dedicated to our Advisor.

companyName: JLL Income Property Trust, Inc.


text: Board Oversight of Cybersecurity Our Board considers cybersecurity risk as part of its risk oversight function and oversees management's implementation of our cybersecurity risk management program. In addition, management updates the Board, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.

companyName: Extra Space Storage Inc.

ticker: EXR


text: Additional Information We have no t identified any known cybersecurity threats, including as a result of prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. However, there can be no assurance that our cybersecurity risk management program and processes, including our policies, controls, or procedures, will be fully implemented, complied with or effective in protecting our systems and information. Refer to "Item 1A. Risk Factors", including the risk factors that are described under the heading "Cybersecurity and Information Technology Risks," for more information regarding the risks we face from cybersecurity incidents that could adversely impact our business and operations, harm our reputation and subject us to claims or litigation.

companyName: TIGO ENERGY, INC.

ticker: TYGO


text: The Adviser's 's cybersecurity risk management and awareness programs, which apply to the Company, include identification and testing of vulnerabilities, phishing simulations and cybersecurity awareness training. The Adviser undertakes internal security reviews of its information systems and related controls, including those applicable to the Company. The Adviser also completes external reviews of the cybersecurity program and practices applicable to the Company, which may include assessments of relevant data protection practices and targeted attack simulations.

companyName: HPS Corporate Lending Fund


text: Our management is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting us, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, information technology, and/or compliance personnel of the Adviser.

companyName: Prospect Floating Rate & Alternative Income Fund, Inc.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – Cybersecurity threats continue to increase in frequency and sophistication; a successful cybersecurity attack could interrupt or disrupt our information technology systems, or those of our third-party service providers, or cause the loss of confidential or protected data which could disrupt our business, force us to incur excessive costs or cause reputational harm."

companyName: COOPER COMPANIES, INC.

ticker: COO


text: The AGM CISO, in coordination with the Apollo Technology and ERM teams, works collaboratively across Apollo to implement a program designed to protect its information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with its incident response and recovery plans. To facilitate the success of Apollo's cybersecurity risk management program, multidisciplinary teams throughout Apollo are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the CISO monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and reports such threats and incidents to the AGM audit committee or AGM board of directors, as appropriate.

companyName: Apollo Realty Income Solutions, Inc.


text: We have an ongoing cybersecurity risk mitigation program, which includes maintaining up-to-date detection, prevention and monitoring systems and contracting with outside cybersecurity firms to provide continuous monitoring of our systems as well as threat-detection services. We define a cybersecurity threat as any potential unauthorized occurrence on or conducted through our information systems or information systems of a third party that we utilize in our business that may result in adverse effects on the confidentiality, integrity or availability of our information systems or any information residing therein. Our cybersecurity policies, standards, processes, and practices are based on recognized frameworks established by the National Institute of Standards and Technology and include the following components: • Collaborative Approach: We have implemented a comprehensive, cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. • Deployment of Technical Safeguards: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. • Development and Periodic Testing of Incident Response and Recovery Planning: We have developed and maintain comprehensive incident response and recovery plans that address our response to cybersecurity threats, and such plans are tested and evaluated on a regular basis. Our periodic testing of these plans includes a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Audit Committee, and we adjust cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews. • Third-Party Risk Management: We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers, franchisees and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Implementation of Regular and Mandatory Employee Training and Awareness Programs: We provide regular, mandatory training for our personnel regarding cybersecurity threats as a means to equip them with effective tools to detect and address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices.

companyName: Restaurant Brands International Limited Partnership

ticker: RSTRF


text: Operating segments regularly collaborate to facilitate the risk monitoring and mitigation processes and to ensure the policies and procedures for our information security program are integrated into our overall risk management assessment.

companyName: ENDI Corp.

ticker: ENDI


text: The Company is subject to various laws and rules issued by multiple government agencies concerning the safeguarding and maintaining the confidentiality of its security, customer, and business information. We are committed to protecting the confidentiality, integrity, and availability of our information systems and data.

companyName: Mag Magna Corp

ticker: MGNC


text: Our CISO has experience managing a risk-based, effective, practical and appropriately-sized cybersecurity program that aligns with our strategic business objectives and leads our cybersecurity team, which is responsible for assessing and managing the Company's material risks from cybersecurity threats. Our CISO has 28 years of experience in the technology domain and 24 years of experience in information security. Our CISO is also a CISSP (Certified Information Systems Security Professional) and a CIPP/E (Certified Information Privacy Professional/Europe).

companyName: HEIDRICK & STRUGGLES INTERNATIONAL INC


text: The audit committee has formal oversight responsibility for cybersecurity, as delegated by our board of directors, and is responsible for reviewing our policies and procedures with respect to cybersecurity risk assessment and risk management. As part of the board of directors and audit committee's oversight, our Chief Technology Officer ("CTO"), and/or Chief Information Security Officer ("CISO") provide semi-annual updates to the audit committee with respect to cybersecurity incidents, mitigation, threats, risks, and management, which are also communicated to the full board. In addition, a cross-functional committee comprised of key stakeholders throughout the Company meets regularly to review cybersecurity incidents, mitigation, threats, risks, and management.

companyName: Petco Health & Wellness Company, Inc.

ticker: WOOF


text: Federated Hermes' CISO has nearly 20 years of technology experience, including deep experience in cybersecurity risk management. Prior to assuming his current role in 2020, Federated Hermes' CISO served as information security officer and director of technology for a large publicly traded travel center company and, prior to that, as information security officer for a leading retail chain. He holds a BS in Accounting and Finance and an MBA from Robert Morris University.

companyName: FEDERATED HERMES, INC.

ticker: FHI


text: The Audit Committee of the Board of Directors provides direct oversight over cybersecurity risk and provides regular updates to the Board of Directors regarding such oversight. The Audit Committee regularly meets with members of management responsible for data privacy, technology, and information security risks to discuss these risks, risk management activities, incident response plans, best practices, the effectiveness of our security measures, and other related matters.

companyName: CarGurus, Inc.

ticker: CARG


text: We have not identified any cybersecurity threats that have materially impaired or are reasonably likely to materially impair our operations or financial standing. Please read Item 1A. "Risk Factors—Risks Related to Our Business—A breach of information security or the failure of one or more key information technology (IT) or operational (OT) systems, or those of third parties, may adversely affect our business, results of operations or business reputation." and " Attacks, including acts of terrorism or cyber sabotage, or the threat of such attacks, may adversely affect our business or reputation." for discussions of risks from cybersecurity threats we face.

companyName: KINDER MORGAN, INC.

ticker: KMI


text: Criteo assesses and manages its cybersecurity risks in part through an executive committee referred to as t he Governance Risk and Compliance Committee (the "GRCC"). The GRCC is composed of the CISO and certain members of our executive and leadership teams, and meets several times a year to discuss strategic information security matters including the security program, major risks and incidents and significant key performance indicators ("KPIs").

companyName: Criteo S.A.

ticker: CRTO


text: Role of our Board of Directors The Nominating and Corporate Governance Committee of the Board of Directors is primarily responsible for the oversight of our information security programs and cybersecurity incident response plans. We established a cyber subcommittee comprised of our senior management team that reports directly to the Board and its Committees regarding our cyber risks and threats, the status of initiatives strengthens our information security systems, assessments of our cybersecurity program and incident response plan, and our views of the emerging threat landscape. Our Chief Information and Compliance Officer and our head of Internal Audit report directly to the Nominating and Corporate Governance Committee as well as the Audit Committee regarding these matters and are responsible for reporting to the Committees on our company-wide enterprise risk assessment, and that assessment also includes an evaluation of cyber risks and threats. The Chair of the Nominating and Corporate Governance Committee regularly reports to the Board of Director on cybersecurity risks and other matters reviewed by the Nominating and Corporate Governance Committee in conjunction with the management team. All materials or presentations on cybersecurity provided to the Nominating and Corporate Governance Committee are provided to all Board members.

companyName: Riley Exploration Permian, Inc.

ticker: REPX


text: Cybersecurity risk management is integrated within our risk management framework. We conduct risk identification through several processes at the business unit, corporate, senior management, and Board levels. This framework includes escalation points to Prudential's risk committees, allowing cyber risk and control matters to be elevated to the Board of Directors or its Audit Committee for oversight.

companyName: PRUCO LIFE INSURANCE CO


text: Protecting our technology and information systems: When we implement significant changes to our technologies or information systems, we conduct risk-based security and privacy impact assessments and deploy technical safeguards that are designed to reasonably protect our technology and information systems from cybersecurity threats. We actively monitor and proactively research potential cybersecurity threats to our technologies and information systems. We use what we learn to evolve our security controls over time to mitigate risks posed by such threats.

companyName: Walmart Inc.

ticker: WMT


text: The Audit Committee oversees the Policy and its implementation of the Company's oversight, programs, procedures, and policies related to cybersecurity, cybersecurity risks, information security, and data privacy. Team leads from various departments of the Company have been identified under the Policy to report to the Company's CFO overseeing the cybersecurity strategy as defined in the Policy.

companyName: Cosmos Health Inc.

ticker: COSM


text: Our Global Director of Cybersecurity leads a quarterly cybersecurity governance meeting, bringing together IT teams from all subsidiaries. This meeting serves as a forum to review ongoing and upcoming security initiatives, regulatory compliance and industry best practices.

companyName: G III APPAREL GROUP LTD /DE/

ticker: GIII


text: On July 19, 2024, CreditRiskMonitor.com detected unauthorized occurrences within its computer network. Upon detection, the Company immediately activated its incident response plan and took steps to contain, assess and remediate the incident. The incident did not have a material impact on the Company, including its business strategy, results of operations, or financial condition.

companyName: CREDITRISKMONITOR COM INC

ticker: CRMZ


text: Third parties also play a role in our cybersecurity risk management strategy. We engage third parties to conduct risk assessments and evaluations of our security controls. Such risk assessment and evaluations identify, quantify, and categorize any cyber risks. In addition, we, along with third party cyber risk management specialists, develops a risk mitigation plan to address such risks, and where necessary, remediate potential vulnerabilities identified through the assessment and evaluation process. Third party cybersecurity risk management engagement also includes activities such as penetration testing, independent audits or consulting on best practices to address new challenges. We include security and privacy addendums to our contracts where applicable. We have also commenced third party risk management assessments to help manage the risks associated with reliance on vendors, critical service providers, and other third-parties that may lead to a service disruption or an adverse cybersecurity incident.

companyName: Arena Group Holdings, Inc.

ticker: AREN


text: The members of management who are responsible for assessing and managing cyber risk are the Chief Information Security Officer and the Chief Information Officer of the Company who, combined, have over 30 years of experience in managing cybersecurity. The ERMC has ultimate responsibility for the risk management of cyber risk and is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents in addition to the cyber incident response and reporting processes.

companyName: AMEDISYS INC


text: The Risk Committee of the Board of Directors (the "Risk Committee") is responsible for reviewing the Company's information security programs, including oversight of cybersecurity risks and threats. The Risk Committee receives quarterly reports from our CISO and CTO on, among other things, the Company's cyber risks and threats, the status of projects to strengthen the Company's information security program, the emerging threat landscape and key metrics from cybersecurity systems and monitoring. The Company's cyber security program and technology program are periodically audited by internal audit or independent third-party audit firms, and the results of these audits are reported to the Risk Committee, as well as the Audit Committee of the Board of Directors.

companyName: CROSSFIRST BANKSHARES, INC.


text: Education and Awareness - We conduct regular workforce training to instruct employees to identify cybersecurity concerns and take the appropriate action. We install and regularly update antivirus software on all company managed systems and workstations to detect and prevent malicious code from impacting our systems. In addition, we have a product security team focused on integrating risk and security best practices into our product development life cycle. Periodically, we are audited by an independent information systems expert to determine both the adequacy of, and compliance with, controls and standards.

companyName: SkyWater Technology, Inc

ticker: SKYT


text: The ISO has over 15 years of industry experience including management of cybersecurity, enterprise telecommunications infrastructure, and vendor relationships as well as possessing both undergraduate and graduate level degrees, including a Bachelor of Science Information Security and Assurance and Master of Science Information Security and Assurance. Additionally, the ISO was previously certified in 18 industry niches to foster in-depth understanding of technology and its associated risks, including certification as a Certified Ethical Hacker, Certified Computer Hacking Forensics Investigator, Database Design, Web Design, CCNA Routing, Switching, and Security, and is currently enrolled in the International Information System Security Certification Consortium's official Certified Information Systems Security Professional curriculum. Furthermore, the ISO must effectively collaborate with business leaders, executives, and stakeholders. To bolster the collaboration, communication, and business skills necessary to effectively analyze risk holistically, the ISO has undertaken additional graduate level curriculum, including a Master of Business Administration degree program, while maintaining active membership in the National Society of Leadership and Success Honors Society.

companyName: Community West Bancshares

ticker: CWBC


text: Recognizing the significance of external threats, we have implemented a risk-based strategy to manage cybersecurity risks associated with third parties, such as vendors and service providers. This strategy extends to these third parties' systems, which, if compromised, could impact our operations.

companyName: WIDEPOINT CORP

ticker: WYY


text: Old National has adopted an enterprise risk strategy, including for cybersecurity risks, premised on three lines of defense. While the Company expects the responsibilities described in the prior paragraph to be performed, monitored, and managed on a day-to-day basis by a "first line of defense" vested in the responsible business or function, the CISO and Information Security department representatives, as a key part of the Company's Enterprise Risk Management department, serve as a "second line of defense" on cybersecurity matters, providing guidance, oversight, separate monitoring, and testing confirmation or challenge of the first line's activities. The second line of defense function is separated from the first line of defense function through our organizational structure, with the CISO and other Information Security department personnel reporting into the Company's Chief Risk Officer (the "CRO"). The Company's Internal Audit function provides a "third line of defense," in terms of periodically auditing overall program controls and effectiveness, using internal auditors with experience in auditing information technology matters. Our Chief Audit Executive and Ethics Officer supervises our Internal Audit department and reports to the Company's Chief Executive Officer, while also maintaining a direct reporting relationship with the Chair of the Audit Committee of the Company's Board of Directors.

companyName: OLD NATIONAL BANCORP /IN/

ticker: ONB