text: We assess, identify and manage risks from cybersecurity threats through our Information Technology Security and Compliance organization ("Cybersecurity Program"), which is part of our larger enterprise risk management framework. The Cybersecurity Program is currently overseen by the Audit Committee of the Board of Directors (the "Audit Committee") and is managed by our Chief Information and Digital Officer ("CIO") and a dedicated Chief Information Security Officer ("CISO"). Our current CISO has over 10 years of experience in cybersecurity and has held numerous positions in the cybersecurity sector, including serving as a Global Director of Information Security at another global high-tech manufacturing company. The CISO's organization has oversight of cybersecurity strategy, policy, standards, architecture and processes for the security of our enterprise network and, information assets. The CISO's organization monitors and manages, and works to identify and assess, cybersecurity risk through various technologies, resources, processes and policies that are updated to align with the changing threat landscape, our evolving business needs and global regulatory requirements. Our strategy includes risk assessments, risk and threat analysis, utilization of security tools, cybersecurity-related tabletop and phishing exercises designed to simulate cybersecurity incidents, and security awareness and technical security trainings.

companyName: CNH Industrial N.V.

ticker: CNH


text: Brad A. Lich, age 56, is Executive Vice President and Chief Commercial Officer, with responsibility for the AM segment, including the circular platform, as well as leadership of marketing, sales, supply chain, corporate strategy, and regional leadership. Mr. Lich joined Eastman in 2001 as Director of Global Product Management and Marketing for the Coatings business. Other positions of increasing responsibility followed, including General Manager of Emerging Markets of the former Coatings, Adhesives, Specialty Polymers, and Inks ("CASPI") segment. In 2006, Mr. Lich became Vice President of Global Marketing with direct responsibility for company-wide global marketing functions. In 2008, Mr. Lich was appointed Vice President and General Manager of the former CASPI segment, and in 2012 was appointed Vice President and General Manager of the AFP segment. In January 2014, Mr. Lich was appointed Executive Vice President, with responsibility for the AFP and AM segments and the marketing, sales, and pricing organizations. In March 2016, Mr. Lich assumed executive responsibility for outside-U.S. regional business leadership. Mr. Lich was appointed to his current position effective July 2016.

companyName: EASTMAN CHEMICAL CO

ticker: EMN

secItem: Item 1C


text: The CIDO remains informed about the monitoring, prevention, detection, mitigation, and remediation of cybersecurity incidents through the CISO and other members of the cybersecurity team, as appropriate, who are tasked with these responsibilities on a day-to-day basis.

companyName: PUBLIC SERVICE ENTERPRISE GROUP INC

ticker: PEG


text: Our cybersecurity committee plays an active role by meeting periodically to review the status of the Company's cyber security program and roadmap for new cybersecurity risk management initiatives. The committee oversees cybersecurity risk management by evaluating whether management has robust cybersecurity policies and procedures, regularly assessing and monitoring cybersecurity risks, and receiving regular reports on the Company's cybersecurity posture. The cybersecurity committee holds monthly review meetings, to discuss the status of the Company's cybersecurity posture, plans and projects underway, and to discuss any changes in existing policies and procedures.

companyName: Aeries Technology, Inc.

ticker: AERT


text: We have implemented and maintain various measures to mitigate information security challenges, including maintaining an information security program, an enterprise resilience program, a business continuity program and cyber insurance coverage, as well as regularly testing our systems to discover and address any potential vulnerabilities. The Company also conducts periodic cybersecurity awareness training for employees and provides cybersecurity updates to its employees during regularly scheduled meetings. These updates are designed to educate employees and to raise awareness of cybersecurity threats to reduce vulnerability as well as to encourage consideration of cybersecurity risks.

companyName: Greenbacker Renewable Energy Co LLC


text: Our technology and management teams meet regularly with key internal and external stakeholders to review cybersecurity concerns and areas face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition, results of operations, cash flows or reputation. To date, we have not experienced any cyber incidents that have had a material adverse effect on our business, financial condition, results of operations, or cash flows. See "Risk Factors – Risks Related to Our Business – Security breaches and other disruptions could compromise our information and expose us to liability, which would cause our business and reputation to suffer."

companyName: Sanara MedTech Inc.

ticker: SMTI


text: We use a security framework to guide our overall security posture, which has helped us develop and enhance our Information Security Policy, Incident Response Policy and Business Continuity Policy. These policies guide us in our effort to manage and control information technology risk and to define and communicate information security responsibilities and accountability throughout the Company. These policies also set the requirements to help ensure that we safeguard our data and information systems to reduce risk and minimize the effect of potential incidents. These policies are supported by written standards and procedures that ensure conformity with the policies that the board of directors has set forth. Pursuant to our Incident Response Policy, we have adopted a written Incident Response Plan that documents employee and management responsibilities, incident classifications and the procedures to be followed during a cybersecurity incident. The Incident Response Plan is tested annually through a tabletop exercise led by a third-party vendor who assists in developing and executing the exercise.

companyName: Sterling Bancorp, Inc.


text: The IRT, in coordination with the board of managers, oversees the management of risks from cybersecurity threats, including the policies, standards, processes and practices that the Company's management implements to address risks from cybersecurity threats. Any cybersecurity incidents that are detected by the Company's MSP are routed directly to the IRT. The board of managers receives reports on cybersecurity risks from management. The board of managers will be informed of any cybersecurity incident that is determined by the IRT to be material, and will receive ongoing updates regarding such material incident until it has been addressed. At least once each year, the board of managers and the IRT discuss the Company's approach to cybersecurity risk management with the Company's Co-Chief Information Officers.

companyName: TriLinc Global Impact Fund LLC

ticker: TRLC


text: The AFC, comprised entirely of independent directors, assists the Board in its responsibilities of ensuring that the Company has established, documented and maintained, and periodically reevaluates, its processes with respect to cybersecurity. Our CISO briefs the AFC on cybersecurity matters, including on the evolving threat landscape and the Company's enhanced efforts in light of emerging risks, no less than twice per year, and in 2023, our CISO provided cybersecurity updates to the AFC two times during the course of the year. In addition to formal updates provided to the AFC, our CISO maintains regular communication throughout the year with members of the AFC on these issues. The chair of the AFC also briefs the full Board on cybersecurity matters discussed amongst the AFC. Furthermore, and as discussed above, cybersecurity risks are also reviewed and discussed with the AFC and the full Board as part of the annual ERM assessment.

companyName: HEIDRICK & STRUGGLES INTERNATIONAL INC


text: Our Chief Security Officer (CSO) is ultimately responsible for cybersecurity at Progressive, with management oversight of the prevention, detection, mitigation, and remediation of cybersecurity incidents. The CSO reports directly to the Chief Financial Officer and provides regular cybersecurity updates to the CEO, other members of the executive team, and the Board of Directors' Technology Committee. Assuming the role in 2012, our CSO has served in this capacity at Progressive for more than a decade and, prior to joining us in 2010, had over 10 years of cybersecurity experience in the banking industry in security and risk management leadership roles, primarily focused on cybersecurity and banking compliance, with additional experience in the areas of anti-money laundering and financial fraud. Our CSO is also a member of our Management Risk Committee, which leads our Enterprise Risk Management program, and as a member ensures that cybersecurity risks remain a focus of the overall risk management process.

companyName: PROGRESSIVE CORP/OH/

ticker: PGR


text: Strategy and Procedures BNY Mellon has implemented policies and procedures designed to detect, prevent and respond to malicious and accidental disruptions to the delivery of critical technology services. BNY Mellon's cybersecurity strategy and procedures are embedded in its Three Lines of Defense model.

companyName: VOC Energy Trust

ticker: VOC


text: As a blank check company, we have no operations and therefore do not have any operations of our own that face cybersecurity threats. However, we do depend on the digital technologies of third parties, and as noted in Item 1A. Risk Factors of this report, any sophisticated and deliberate attacks on, or security breaches in, systems or infrastructure or the cloud that we utilize, including those of third parties, could lead to corruption or misappropriation of our assets, proprietary information and sensitive or confidential data. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose. Our board of directors oversees risk for our Company, and prior to filings with the SEC, our board of directors reviews our risk factors, including the descriptions of the risks we face from cybersecurity threats, as described in Item 1A. Risk Factors of this report.

companyName: Vine Hill Capital Investment Corp.

ticker: VCIC


text: Our IT management team, with oversight from our Board of Directors and Nominating and Corporate Governance Committee as well as members of our management team, including our Chief Operating Officer and General Counsel, are primarily responsible for assessing and managing our material risks from cybersecurity threats.

companyName: AMBARELLA INC

ticker: AMBA


text: The Audit Committee of the Board of Directors oversees our enterprise risk management, which includes cybersecurity. The ISC provides a report on our cybersecurity program to our Board at least annually.

companyName: Victory Capital Holdings, Inc.

ticker: VCTR


text: Categorization of all assets based on the criticality of the data processed and the assets criticality to the continuity of business operations.

companyName: Harmony Biosciences Holdings, Inc.

ticker: HRMY


text: Outdated Technology: Many systems use legacy technology that lack modern security features, making them more susceptible to attacks affecting water services.

companyName: YORK WATER CO

ticker: YORW


text: Material Effects from Risks of Cybersecurity Threats From time to time, we experience data and cybersecurity incidents. To date, we have not experienced any risks from cybersecurity threats (including as a result of prior incidents) that have materially affected or to our knowledge are reasonably likely to materially affect, the Company, including our business strategy, results of operations or financial condition. Any future actual or perceived cybersecurity incidents, including the failure to protect the confidentiality, integrity, availability and privacy of our data and electronic transactions, or any misuse of our information services by our clients, employees, vendors or hackers, could cause significant harm to our business and reputation and result in significant liability. Such liability could include harm to our brand and reputation and cause us to lose existing clients and market share and fail to win new clients, and may require expenditure of significant costs and operational consequences in connection with investigating, mitigating, remediating, eliminating, and putting in place additional measures designed to prevent future actual or perceived cybersecurity incidents.

companyName: Sterling Check Corp.


text: Managing Material Risks & Integrated Overall Risk Management BKV has strategically integrated cybersecurity risk management into its broader enterprise risk management framework to promote a company-wide culture of cyber risk awareness. BKV's Chief Information Officer ("CIO") and Manager of Cybersecurity work closely with its information technology ("IT") department to continuously evaluate and address cybersecurity risks in alignment with business objectives, operational needs, and industry-accepted standards, such as the Center for Internet Security (CIS) Critical Security Controls and National Institute of Standards and Technology (NIST) frameworks.

companyName: BKV Corp

ticker: BKV


text: The Cybersecurity Program, which is integrated into our enterprise risk management framework, assesses, identifies and protects our enterprise information systems, data and business operations from various security threats and contains the following elements: Information Security Risk Assessment - Conducting internal and external risk and control assessment, quality control and assurance testing. Identity and Access Management - Managing enterprise identity and access control systems. Security Architecture - Managing security architecture, including secure code deployment standards, architecture security reviews, and cybersecurity advisory support.

companyName: PennyMac Financial Services, Inc.

ticker: PFSI


text: As part of LivaNova's cyber resiliency strategy and in an effort to mitigate potential cybersecurity risks, the Company employs various measures, including employee training, systems monitoring, testing and maintenance of protective systems, and contingency plans. In addition, the CISO manages a structured cyber incident response program where periodic simulation exercises are performed to prepare and train the Company's cybersecurity incident responders. The Company deploys security tools to help bolster its defense detection capabilities, such as endpoint detection and response tools, security information and event management tools, and 24/7 monitoring. LivaNova regularly evaluates itself for appropriate business continuity and disaster recovery planning, with test scenarios that include simulations and penetration tests.

companyName: LivaNova PLC

ticker: LIVN


text: The cybersecurity program incorporates multiple layers of security controls to safeguard our systems and data. Access controls are established based on the principle of least privilege, and all employees engage in cybersecurity awareness training to cultivate a security-conscious culture. We train our employees through periodic security training, phishing simulations and regular communications about timely security topics to enhance their understanding of cybersecurity threats and their ability to identify and escalate potential cybersecurity events. We maintain robust security configuration management and regularly update systems to minimize vulnerabilities. Investments in security technology include vulnerability management tools, malicious software protection, email security, and around-the-clock monitoring.

companyName: SMITHFIELD FOODS INC

ticker: SFD


text: Dominion Energy's corporate intelligence and security program includes both cybersecurity and threat intelligence components as part of its evaluation and mitigation of risks. The evaluation of risks includes consideration of cybersecurity and privacy risk, including potential impact on Dominion Energy's employees, customers, supply chain and other stakeholders, intelligence briefings on notable cyber events impacting the industry and evaluation of insider threats. Dominion Energy utilizes a robust set of internal and third-party assessment tools to test its cyber risk management policies, practices and procedures as well as challenge assumptions upon which its defenses are built. These assessments provide opportunities for self-critical analysis and constructive feedback needed to build cyber resilience. Trainings are routinely provided to employees to help identify, avoid and mitigate cybersecurity threats and to ensure an understanding of Dominion Energy's cyber risk management policies. In addition, risk assessments are conducted as a component of the evaluation of vendors and suppliers.

companyName: DOMINION ENERGY SOUTH CAROLINA, INC.


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Company are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, the Company has not identified any impact from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition.

companyName: Barings BDC, Inc.

ticker: BBDC


text: Our approach to managing cybersecurity risks is part of a continuous improvement process, both in the context of cybersecurity and broader operational risk management.

companyName: Crucial Innovations, Corp.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: a cybersecurity incident response policy; asset management, tracking and disposal; incident detection and response; systems monitoring; vulnerability management policy; risk assessments; encryption of certain of our data; third -party cybersecurity staff; network security controls; segregation of certain of our data; access controls; physical security; employee training; penetration testing; and cybersecurity insurance.

companyName: UroGen Pharma Ltd.

ticker: URGN


text: We have established standardized and comprehensive incident response and recovery plans across Match Group's businesses. Our incident response and recovery plans address — and guide our employees, management, and our Board of Directors on — our response to a cybersecurity incident, and our procedures with regard to material incidents. We regularly test and evaluate the effectiveness of our incident response process.

companyName: Match Group, Inc.

ticker: MTCH


text: Our IT Manager has over 13 years in cybersecurity work experience and managing all levels of the Company's on-premises and cloud infrastructure.

companyName: Koil Energy Solutions, Inc.

ticker: KLNG


text: In July 2018, the Company experienced a ransomware incident which affected certain Dx information technology systems. The incident also temporarily affected certain other information technology systems involved in conducting Company-wide operations. An investigation determined that the ransomware did not and could not transfer patient or client data outside of Company systems and that there was no theft or misuse of patient or client data. This incident did not have a material effect on the Company.

companyName: LABCORP HOLDINGS INC.

ticker: LH


text: While current management and the Board do not have in-depth cybersecurity expertise, the Company is considering educational opportunities and consulting resources to address this gap. from Cybersecurity Threats cybersecurity incidents have materially affected the Company's business strategy, results of operations, or financial condition.

companyName: Genvor Inc

ticker: GNVR


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, operational risks; intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy or security laws and other litigation and legal risk; and reputational risks.

companyName: SYNOPSYS INC

ticker: SNPS


text: Our cyber risk management program identifies, tracks, escalates, remediates, and reports cyber related risks throughout the Company. These risk areas include internal, product, vendor, supply chain, and external services utilized across the Company. These risks are assessed, prioritized, and both tactically and strategically addressed via process, technology, and personnel improvements to ensure ongoing mitigation and tracking. We utilize internal and external resources, including leading third party providers in the cybersecurity prevention, detection and monitoring space, to monitor for cybersecurity threats to our systems and networks and to understand the broader threat environment.

companyName: Global Business Travel Group, Inc.

ticker: GBTG


text: As a publicly traded e-commerce outdoor company, we are acutely aware of the importance of robust cybersecurity measures in safeguarding our information assets, operational integrity, and reputation. Our approach to cybersecurity risk management is integrated into our broader risk management framework and overseen by our Board of Directors.

companyName: Outdoor Holding Co

ticker: POWW


text: At this time, we have not experienced cybersecurity incidents, or are aware of any risks from cybersecurity threats, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition.

companyName: LeonaBio, Inc.

ticker: LONA


text: Security Audits and Risk Assessments security audits: We conduct frequent security audits and vulnerability assessments to identify potential weaknesses and keep our defenses up to date. Additionally, we engage a third-party penetration testing firm for annual assessments to identify and address security vulnerabilities/misconfigurations.

companyName: Health In Tech, Inc.

ticker: HIT


text: Cybersecurity Program Overview As part of our overall risk management processes and procedures, we have instituted a cybersecurity program designed to identify, assess and manage material risks from cybersecurity threats, including by engaging a third-party cybersecurity service provider, which communicates directly with our management and compliance personnel. The cyber risk management program involves risk assessments, implementation of security measures and ongoing monitoring of systems and networks, including networks on which we rely. Through our cybersecurity program, the current threat landscape is actively monitored in an effort to identify material risks arising from new and evolving cybersecurity threats. We engage external experts, including cybersecurity assessors, consultants and auditors to evaluate cybersecurity measures and risk management processes as needed. We also depend on and engage various third parties, including suppliers, vendors and service providers in connection with our operations. Our risk management, legal, and compliance personnel oversee and identify, including through a third-party cybersecurity service provider, material risks from cybersecurity threats associated with our use of such entities.

companyName: Trinity Capital Inc.

ticker: TRIN


text: The Board has established a Cybersecurity Subcommittee of the Audit Committee responsible for the oversight of risks from cybersecurity threats.

companyName: MSP Recovery, Inc.

ticker: MSPR


text: d. Third-Party Risk Management: The Company endeavors to identify and oversee cybersecurity risks presented by third parties, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.

companyName: Axogen, Inc.

ticker: AXGN


text: We maintain a cybersecurity program that is reasonably designed to protect our information, and that of our clients, portfolio companies and investment managers with which we conduct business, against cybersecurity threats that may result in significant adverse effects on the confidentiality, integrity, and availability of our information systems.

companyName: StepStone Group Inc.

ticker: STEP


text: Cybersecurity is an important part of our risk management processes and an area of focus for Williams' Board of Directors and management. Each member of our organization, from facility operators to board members, has a responsibility to safeguard our cybersecurity. Williams' Chief Information Security Officer (CISO) is responsible for our cybersecurity strategy and execution, while the Board and Williams' Audit Committee are responsible for oversight of our cybersecurity risk.

companyName: TRANSCONTINENTAL GAS PIPE LINE COMPANY, LLC


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For additional information, see "Risk Factors — Risks Related to Privacy and Technology — Changes in laws, regulations, or industry standards relating to privacy, data protection, or the transfer or processing of data relating to individuals, or any actual or perceived failure by us to comply with such laws and regulations or any other obligations, including contractual obligations, relating to privacy, data protection, or the transfer or processing of data relating to individuals, could adversely affect our business, results of operations and financial condition."

companyName: Wag! Group Co.


text: Our Board, including the Audit Committee of the Board, and our management team are actively involved in the oversight of risks from cybersecurity threats.

companyName: MAXCYTE, INC.

ticker: MXCT


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including the Vice President of IT, Director of IT Operations, and General Counsel.

companyName: Poseida Therapeutics, Inc.


text: Currently we are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected our business strategy, results of operations or financial condition or are reasonably likely to have such a material effect. However, cyber-attacks are increasing in frequency, sophistication and intensity, and despite our ongoing efforts we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents. Please refer to "Risk Factors" in Part I, Item 1A of this Governance

companyName: Sonoma Pharmaceuticals, Inc.

ticker: SNOA


text: Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. Cybersecurity risks related to our business are identified and addressed through a multi-faceted approach that consists of third-party assessments, testing of our information systems and information technology security. To defend against, detect and respond to cybersecurity incidents, we, among other things: have enabled regular monitoring of our environment by a combination of external partners and internal security tools, conduct employee trainings, monitor emerging laws and regulations related to data protection and information security and implement appropriate changes.

companyName: uniQure N.V.

ticker: QURE


text: Our objective for managing cybersecurity risk is to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse our system or information. The structure of our information security program is designed around the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, regulatory guidance, and other industry standards. In addition, we leverage certain industry and government associations, third-party benchmarking, audits, and threat intelligence fees to facilitate and promote program effectiveness. Our Information Technology Director, who reports directly to our Chief Operating Officer and the Chief Information Security Officer, who report directly to our board of directors, regularly collaborate with peer banks, industry groups, and policymakers to discuss cybersecurity trends and issues and identify best practices. The information security program is reviewed by such personnel with the goal of addressing changing threats and conditions.

companyName: FB Bancorp, Inc. /MD/

ticker: FBLA


text: To manage our cybersecurity program, we have established a cross-functional cybersecurity oversight committee and cybersecurity team, both led by our Chief Information Officer ("CIO"). Our cybersecurity oversight committee and cybersecurity team, with the support of external cyber-specialist resources, include technical experts in cybersecurity risk management, incident response and security operations with extensive experience in the operations of networks, network security and infrastructure management. In addition, members of our cybersecurity team have cybersecurity experience or certifications, such as the Certified Information Systems Security Professional certification. Our CIO is informed about and monitors prevention, detection, mitigation, and remediation efforts through regular communication and reporting from professionals on the cybersecurity management team and through the use of technological tools and software.

companyName: GRACO INC

ticker: GGG


text: Our internal auditor perform certain procedures to test the integrity and functionality of our IT systems (which includes a high-level review of our cybersecurity defenses). In addition, we have retained a third-party cybersecurity consulting firm that (i) advises us as to cybersecurity matters (including prevailing cybersecurity threats), (ii) performs, on a periodic basis, assessments of our cybersecurity defenses and (iii) on a continuous basis, monitors our IT systems for cybersecurity threats and intrusions.

companyName: BRT Apartments Corp.

ticker: BRT


text: We manage cybersecurity and technology risk at the enterprise level according to our Framework, as described in more detail under "Part II—Item 7. MD&A—Risk Management" in this Report, which uses a three lines of defense model. Our cybersecurity risks are managed programmatically under the "operational risk" category of our Framework. Through this Framework, we establish practices for assessing our risk posture and executing key controls for cybersecurity and technology risk, data management, and oversight of third parties with which we do business.

companyName: CAPITAL ONE FINANCIAL CORP

ticker: COF


text: Our Director of Cybersecurity leads our information security operations, with a focus on identifying, evaluating, mitigating, and reporting on IT and cybersecurity risks that have the potential to threaten Sensata's enterprise information assets and systems. Our cybersecurity and global IT strategy is regularly aligned with business leaders across Sensata through our IT Excellence Committee meetings, conducted 8 times a year, to ensure cyber, IT, and business priorities are communicated and understood throughout the organization.

companyName: Sensata Technologies Holding plc

ticker: ST


text: B.Oversight of Cybersecurity Risks Associated with Third Party Service Providers The Company oversees and identifies material risks from cybersecurity threats related to its use of third-party service providers in accordance with its Vendor Risk Management Process. The contracts with service providers are reviewed during the onboarding process, renewal periods, and as necessary. The contracts require service providers to report cybersecurity incidents that impact the Company's data or information systems or that can otherwise disrupt its operations to the Company on a timely basis.

companyName: MERCURY GENERAL CORP

ticker: MCY


text: Our Board recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. As a result, cybersecurity risk management is an integral part of our overall risk management and compliance program. Our cybersecurity risk management processes are modeled after industry best practices, such as the National Institute of Standards and Technology Cybersecurity Framework, for handling cybersecurity threats and incidents, including threats and incidents associated with the use of applications developed by third-party service providers, and facilitate coordination across different departments of our company.

companyName: Accel Entertainment, Inc.

ticker: ACEL


text: We utilize external standards, such as the Center for Internet Security framework, as a starting point for the design and development of our systems that assess risk and mitigation measures. Helios is committed to achieving compliance with the CIS implementation group level 2 standards. However, this does not mean that we meet any particular technical standards, specifications, or requirements, but rather we use external standards as a guide to help us identify, assess and manage cybersecurity risks and threats relevant to our business. An annual risk assessment is completed and presented to the executive leadership team and the Company's Board of Directors. We discuss changes to our policies, procedures and processes needed to address gaps identified through the assessment.

companyName: HELIOS TECHNOLOGIES, INC.

ticker: HLIO


text: The Fund relies on management of the Investment Adviser to implement third-party risk management processes to manage the risks associated with reliance on vendors, critical service providers, and other third parties that may lead to a service disruption or an adverse cybersecurity incident. This includes assessment of vendors during the selection/onboarding process, internal controls, compliance with service level agreements, and more.

companyName: Wellings Real Estate Income Fund


text: We have also established an information technology management committee which is led by our Chief Information Officer, Chief Financial Officer, and Chief Legal Officer. The members of this committee are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan.

companyName: PROKIDNEY CORP.

ticker: PROK


text: We are proactively taking steps to enhance our monitoring of third-party service providers' cybersecurity, including the continuance of a vendor third-party risk management program. As we continue to expand this program, it should better enable the Company to identify and manage material risks from cybersecurity threats related to our third-party service providers.

companyName: DMC Global Inc.

ticker: BOOM


text: Our board is actively involved in the assessment, oversight and management of the material risks that could affect the Company. The board carries out its risk oversight and management responsibilities by monitoring risk directly as a full board and, where appropriate, through its committees. Our board has delegated to the audit committee the oversight responsibility for risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements, cooperation with law enforcement, and related effects on financial and other risks. The audit committee reports any material or notable cybersecurity incidents, findings and recommendations, as appropriate, to the full board for consideration. Our Chief Technology Officer ("CTO") also presents to the audit committee and to the board, as appropriate, any updates, changes, or improvements on the Company's cybersecurity risk management program.

companyName: Lifevantage Corp

ticker: LFVN


text: For additional information regarding risks related to information technology and cybersecurity, as well as governance related to managing such risks - see also Item 1.A: Risk Factors.

companyName: ALLIENT INC

ticker: ALNT


text: We have engaged cybersecurity service provider experts and maintain an industry-leading incident response retainer to further enhance our cybersecurity safeguards and support our processes for assessing, identifying, and managing material risks from cybersecurity threats. Our third-party experts perform assessments that aid us in effectively detecting and responding to evolving cybersecurity attacks and, in the event of a cybersecurity incident, our experts will assist us with incident response support, digital forensics and incident remediation.

companyName: BankUnited, Inc.

ticker: BKU


text: Our incident response plan coordinates the activities that we and our third-party cybersecurity providers take to prepare to respond and recover from cybersecurity incidents, which include processes to triage, assess severity, investigate, escalate, contain, and remediate an incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage.

companyName: Dyne Therapeutics, Inc.

ticker: DYN


text: Cybersecurity risk is integrated and managed as part of our broader enterprise risk management program under the direction of our Vice President – Chief Risk and Compliance Officer – who works closely with our Chief Information Officer and others, including the Head of our Cybersecurity & Privacy division to help identify, review, assess and address cybersecurity and other security risks. Our Chief Risk and Compliance Officer, Chief Information Officer and the Head of our Cybersecurity & Privacy division are members of the Company's cybersecurity response team (the "Cyber Response Team"). The Cyber Response Team's responsibilities include maintaining a Cybersecurity Incident Response Plan, which sets out a path for how cyber threats and incidents are identified and escalated up to and including the Board of Directors and other leadership, when appropriate. Direct threats are escalated promptly to the appropriate team, following a path that considers both the nature of the threat, the level of risk, and the degree to which it has been substantiated. Indirect threats, such as third-party incidents, are escalated through the ITG to the appropriate corporate functions, as the situation warrants.

companyName: FTI CONSULTING, INC

ticker: FCN


text: We have established a comprehensive, enterprise-wide information security program designed to identify, protect against, detect, respond to, and manage reasonably foreseeable cybersecurity risks and threats. This program is seamlessly integrated into our overall risk management and internal control systems, subject to regular reviews by senior management. It significantly enhances the security, confidentiality, integrity, and availability of the personal and sensitive information we collect, create, use, and maintain.

companyName: CuriosityStream Inc.

ticker: CURI


text: Security awareness training for all personnel, with annual refreshers and real-time phishing simulations; and Third-party vendor assessments to ensure service providers meet our cybersecurity requirements. Response, Monitoring and Detection maintain a documented incident response plan detailing roles, responsibilities, communication protocols and escalation paths. We deployed continuous monitoring tools and log-management platforms to detect anomalous activity;

companyName: ALEXANDER TECH CORP


text: In conclusion, while AppTech Payment Corp is committed to employing comprehensive cybersecurity measures to protect against cyber threats, there are inherent risks associated with cybersecurity that could impact our business. We continue to monitor our cybersecurity landscape actively and adapt our defenses to mitigate these risks as much as possible.

companyName: AppTech Payments Corp.

ticker: APCX


text: Ongoing Education and Monitoring The CIO leads our cybersecurity team, which remains current with the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing education is crucial for the effective prevention, detection, mitigation and remediation of cybersecurity threats and incidents. The CIO implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits, including penetration testing, to identify potential vulnerabilities. In the event of a cybersecurity incident, we are equipped with a well-defined incident response plan. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.

companyName: Array Technologies, Inc.

ticker: ARRY


text: As of December 31, 2024, no known cybersecurity threats have materially affected, or are reasonably likely to materially affect, our business strategy, results of operations or financial condition. The cybersecurity risks that could materially affect Anywhere, including our business strategy, results of operations, or financial condition, are set forth in "Item 1A.—Risk Factors".

companyName: Anywhere Real Estate Group LLC


text: We use third-party service providers to perform a variety of functions throughout our business, such as email and hosting providers, contract research organizations (CROs) and contract manufacturing organizations (CMOs). We have certain vendor management processes that we may use as appropriate to manage cybersecurity risks associated with our use of these providers. These processes may include the imposition of information security contractual obligations on vendors, as well as quality control elements for certain vendors. Depending on the nature of the services provided, the sensitivity of the information systems and data at issue, and the identity of the provider, our vendor management processes may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.

companyName: ACELYRIN, Inc.


text: We conduct risk assessments on a recurring basis to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.

companyName: Ventyx Biosciences, Inc.

ticker: VTYX


text: The Bank's board annually reviews and approves the Bank's risk management policies. The Bank develops mitigation plans, monitors tactical implementation, and engages in detailed gap analysis, risk assessments and monitors remediation plans to close any outstanding gaps, all of which are overseen by the Bank's Security Governance Committee. Cybersecurity risk management is integrated with the Bank's overall risk management framework overseen by the Bank's board. Bank policies establish administrative, technical, and physical safeguards designed to protect the security, confidentiality, and integrity of Bank information in accordance with Finance Agency regulations and applicable laws. The Bank's cyber incident response plan determines how cybersecurity threats and incidents are identified, classified, escalated, and reported to senior management and the board. The cyber incident response plan also stipulates management's materiality assessment of the threat or incident for the purposes of public disclosure. The Bank's cyber incident response plan includes third party cybersecurity incidents and threats.

companyName: Federal Home Loan Bank of Atlanta


text: We have an information security incident response process to prevent, detect, mitigate, and remediate cybersecurity incidents and threats. This process includes controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can be made by management in a timely manner, with appropriate involvement by our board of directors.

companyName: Alpha Teknova, Inc.

ticker: TKNO


text: Company employs several strategies for assessing, identifying, and managing material risks from cybersecurity threats. Components of this strategy include the use of industry standard traffic monitoring tools, and training users to detect, report, and prevent unusual behavior.

companyName: BLUE BIOFUELS, INC.

ticker: BIOF


text: Our CRGC is composed of management representatives from key functions across our company. Our CIO serves as the Chair of the CRGC. The CRGC meets regularly and oversees the effectiveness of our cybersecurity program. The CRGC operates to deliver management-level oversight of cybersecurity matters. The CRGC reports regularly to our executive management team. The Chair of our CRGC reports regularly to our Board of Directors.

companyName: NuStar Energy L.P.


text: On behalf of the Fund, Fidelity engages third-party consultants to assess, identify, and/or manage material risks from cybersecurity threats. For example, Fidelity engages third-party consultants to perform audits of its cybersecurity measures and risk management processes, including those applicable to the Fund. Fidelity has also hired qualified independent assessors to review applicable security controls in accordance with the AICPA's System and Organization Controls assurance programs. Additionally, Fidelity utilizes third-party consultants with specific areas of cybersecurity expertise to review and report on various aspects of its cybersecurity program, including those applicable to the Fund. The results of these consulting engagements are shared with the Fund's Board of Trustees as part of periodic reports.

companyName: Fidelity Private Credit Fund


text: As part of the above processes, we regularly engage with consultants and other third party advisors, including annually having a third-party review our cybersecurity program to help identify areas for continued focus, improvement and compliance.

companyName: G1 Therapeutics, Inc.


text: At Immunovant, Dermavant and the healthcare technology Vants that have established and maintain separate cybersecurity functions, governance is similarly overseen in the first instance by the boards of directors of those Vants as part of their overall risk management strategy, with ultimate oversight on a company-wide basis by the Roivant board of directors.

companyName: Roivant Sciences Ltd.

ticker: ROIV


text: Additionally, as a public company, we are subject to the Sarbanes-Oxley Act requirements and must undergo independent audits of information technology general controls in support of internal control over financial reporting. These audits, which are conducted by our independent public accounting firm, assess key information security and cybersecurity risks in the environment that may affect the confidentiality, integrity and availability of systems and data. Any control deficiencies that represent cybersecurity risks, as well as any recommended changes to our processes, if appropriate, would be reported to senior management and the Board.

companyName: Urban Edge Properties

ticker: UE


text: A majority of our IT systems are built on services provided by third parties. For example, we leverage commonly used foundational technologies provided by third parties, such as secure messaging gateways, enforced drive encryption and multi-factor authentication.

companyName: Vaxxinity, Inc.

ticker: VAXX


text: We recognize the critical importance of maintaining the safety and security of our systems and data and have a program for overseeing and managing cybersecurity and related risks, which is supported by both management and our Board.

companyName: KORE Group Holdings, Inc.

ticker: KORE


text: Risk Management and Strategy have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: Webstar Technology Group Inc.

ticker: WBSR


text: The Chief Privacy Officer oversees the Company's information security program and is responsible for the day-to-day information risk management activities through the internal information security team, and outside resources. The VP, Chief Privacy Officer, who has 30 years of IT and IT security experience, 20 of which are at the Company, employs a team of information technology experts, including a dedicated Cyber Security Analyst. The VP, Chief Privacy Officer and the Cyber Security Analyst are further supported by other members of the IT department.

companyName: El Pollo Loco Holdings, Inc.

ticker: LOCO


text: The Company believes that a strong cybersecurity program is vital to effective cybersecurity risk management. The Company recognizes the importance of developing, implementing, and maintaining robust cybersecurity measures to help safeguard sensitive information and its business operations, and to protect the confidentiality, integrity, and availability of its information systems and the nonpublic information transmitted, processed and stored on its systems or those of third-party service providers.

companyName: Metropolitan Bank Holding Corp.

ticker: MCB


text: We intend to work with outside counsel and third party service providers to further develop our expertise, processes and procedures with respect to cybersecurity protection and our response plan.

companyName: Tivic Health Systems, Inc.

ticker: TIVC


text: Our processes also address cybersecurity risks associated with our use of third-party service providers. We oversee third-party service providers by conducting vendor diligence upon onboarding and ongoing monitoring. Vendors are assessed for risk based on the nature of their service, access to data and systems and supply chain risk and, based on that assessment, we conduct diligence that may include completing security questionnaires, onsite evaluation, penetration test and policy reviews, and scans or other technical evaluations. We also partner and actively engage with key vendors and industry participants to share intelligence, best practices and benchmarking data with other member organizations of the Retail and Hospitality Information Sharing and Analysis Center, which aims to help its members improve their security posture and resilience against cyber-attacks.

companyName: Acushnet Holdings Corp.

ticker: GOLF


text: Our cybersecurity risk assessment and management processes are implemented and maintained by our Head of IT, who has achieved ACC Internetworking Engineer and Global Secure Systems Internetworking Engineer qualifications and has over 25 years of experience leading international IT departments and owning responsibility for organizations' cybersecurity efforts.

companyName: Silence Therapeutics plc

ticker: SLN


text: We have created an Information Security Team, consisting of our Chief Financial Officer and our Chief Compliance Officer, to implement and administer our Cybersecurity Policy. Our Chief Financial Officer and Chief Compliance Officer have each served in senior management positions for a number of years, have received cybersecurity training from time to time in connection with their professional certifications, and have overseen and supervised the activities of external information technology personnel of the Fund during this period. Among the duties and responsibilities of our Information Security Team are the following: Ensuring that all Equus personnel are aware of the Cybersecurity Policy and agree to adhere to its requirements; Establishing that information concerning the Fund is stored on encrypted cloud-based servers accessible only by authorized Equus personnel;

companyName: EQUUS TOTAL RETURN, INC.

ticker: EQS


text: We recognize the importance of information security and we are committed to protecting and preserving the confidentiality, integrity and continued availability of the information we own or that is in our care. We have developed and implemented a cybersecurity program that strives to comply with applicable industry standards, and we assess our program against the National Institute of Standards and Technology (NIST) Cybersecurity Framework.

companyName: ENERGIZER HOLDINGS, INC.

ticker: ENR


text: Cybersecurity is among the risks identified by our Enterprise Risk Management Team for Board-level oversight. While the full Board retains overall oversight over cybersecurity, the Board has delegated to its Audit Committee oversight of the Company's information technology security program and the controls around cybersecurity and to its Compliance and Risk Committee oversight of an enterprise risk management program that is designed to assist with monitoring and mitigating operational risks. The Audit Committee and Compliance and Risk Committee meet every quarter. The Audit Committee is updated as needed on cybersecurity threats, incidents, and programs, and the Compliance and Risk Committee is updated as needed on new developments in our cybersecurity risk profile. After each such meeting, the respective chairs of the Audit Committee and Compliance and Risk Committee provide a report to the full Board on the committee meeting.

companyName: Cencora, Inc.

ticker: COR


text: Our cybersecurity risk management program includes written policies, standards, and procedures for maintaining data privacy, product security and information security to mitigate cybersecurity risks, and to identify, evaluate and respond to cybersecurity threats, vulnerabilities and incidents. Our cybersecurity risk management program and strategy is implemented across several areas, which include, but are not limited to, the following: • Information Security. We maintain a written information security program, which provides for policies, standards, guidelines, and administrative, technical and physical safeguards that we believe are reasonably designed, in light of the nature, size and complexity of our operations, to protect the resiliency of our operations and the confidentiality, integrity, and availability of our information systems, data, and information assets. The organizational, administrative and technical measures we implement are based on recognized security frameworks established by the National Institute of Standards and Technology, security measures aligned with the ISO/IEC 27000 series of standards, and other generally recognized industry standards. The program is assessed regularly and in light of new and emerging cybersecurity risks. • Technical Safeguards and Product Security. We deploy and maintain a variety of technologies to prevent and detect cybersecurity threats across the network, endpoint and cloud. We also apply security-by-design principles in our software development lifecycle, track vulnerabilities of open-source software, and run internal and external network scans at least weekly and after any meaningful change in our network configuration. We conduct regular application security assessments, including our assessments for internet-facing applications that collect, transmit, or display end user data. We also employ tooling in certain areas to help prevent deviations from policy. • Incident Response and Reporting. We maintain incident response and recovery protocols to enable prompt, effective and orderly identification, evaluation, management, and disposition of actual and potential security threats and incidents, including for purposes of escalation and internal and external-notification steps. We maintain a cross-functional incident response team, including senior representatives from information security, information technology, product, legal, privacy, communications, and finance, that is involved in assessing cybersecurity threats and incidents, assigning severity levels, and evaluating the potential impact, including the potential impact on our business strategy, results of operations and financial condition. This allows for prompt direction of appropriate personnel and resources for incident management and response, and internal notification to appropriate members of management, which may include our chief executive officer, chief product and technology officer, vice president acting as chief information security officer, general counsel, chief financial officer, and/or chief accounting officer, and the security committee of our board of directors (the "Security Committee"). The protocols also establish steps designed to publicly report and/or alert external stakeholders as and when required by applicable law or otherwise determined appropriate.

companyName: Palo Alto Networks Inc

ticker: PANW


text: We collaborate with third parties to assess the effectiveness of our cybersecurity prevention and response systems and processes. These include cybersecurity assessors, consultants, and other external cybersecurity experts to assist in the identification, verification, and validation of cybersecurity risks, as well as to support associated mitigation plans when necessary. We have also developed a third-party cybersecurity risk management process to conduct due diligence on external entities, including those that perform cybersecurity services.

companyName: SIGA TECHNOLOGIES INC

ticker: SIGA


text: Although we have not experienced any material cybersecurity incidents, a future incident could materially affect us. We rely on information technology to process, transmit and store electronic information, and to manage or support a variety of business processes, including financial transactions, PII, and resident and lease data. Our business requires us and some of our vendors, to use and store PII and other confidential and sensitive information of our residents and associates. Any failure in or breach of our operational or information security systems or those of our vendors as a result of cyber-attacks or other security incidents, could materially adversely impact our operations and financial position, including disruption of our operations caused by an inability to access network systems, disclosure or misuse of confidential or proprietary information (including PII of our residents and/or associates), damage to our reputation, and/or potentially significant legal and/or financial liabilities and penalties.

companyName: AVALONBAY COMMUNITIES INC

ticker: AVB


text: Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the CISO. With over 20 years of experience in the field of information technology, the CISO brings a wealth of expertise to the role. The CISO's education includes a Master's in Cybersecurity Management. The CISO has in-depth knowledge and experience in developing and executing our cybersecurity strategies. The CISO oversees our governance programs, tests our compliance with standards, remediates known risks, and leads our comprehensive employee security awareness program. The CISO is also responsible for building and overseeing a cybersecurity team, including internal and external resources, who provide subject matter expertise and operational talents to achieve our cybersecurity objectives.

companyName: Allegion plc

ticker: ALLE


text: The Company assesses, identifies, and manages cybersecurity risks using a risk management program intended to reduce risks to the Company, its employees, customers and stockholders.

companyName: HF Foods Group Inc.

ticker: HFFG


text: We have an enterprise-wide information security program designed to identify, protect, detect and respond to and manage reasonably foreseeable cybersecurity risks and threats.

companyName: Globalstar, Inc.

ticker: GSAT


text: As of the date of this report, we are not aware of any cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, evolving cybersecurity threats make it increasingly challenging to anticipate, detect, and defend against cybersecurity threats and incidents.

companyName: Invivyd, Inc.

ticker: IVVD


text: Risk Assessment and Threat Intelligence: Under the oversight of the Vice President of Information Security who operates as our Chief Information Security Officer ("CISO"), we conduct periodic risk assessments to pinpoint potential cybersecurity vulnerabilities and threats. These assessments entail evaluating the security posture of critical systems, networks, and applications, as well as analyzing the potential impact of cybersecurity threats on our business operations, financial condition, and reputation. Additionally, we perform continuous threat monitoring and deployed monitoring systems, encompassing technologies such as intrusion detection systems, security information and event management tools, and threat intelligence programs.

companyName: AMERICAN WOODMARK CORP

ticker: AMWD


text: We conduct periodic risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information technology systems that are vulnerable to cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.

companyName: Merus N.V.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Chief Information Officer (CIO), internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: Zeta Global Holdings Corp.

ticker: ZETA


text: Risk Management and Strategy TripCo's corporate level IT and cybersecurity functions are provided by Liberty Media as part of the services agreement described in Item 1. Business. Through the services agreement, we participate in Liberty Media's processes for assessing, identifying, and managing risks from cybersecurity threats, as detailed below. Tripadvisor, as a separate publicly traded company from TripCo, operates its own cybersecurity function. While primary oversight for Tripadvisor rests with its board of directors and Audit Committee, we receive regular reporting from Tripadvisor management and collaborate with those tasked with oversight to ensure risks are appropriately addressed.

companyName: Liberty TripAdvisor Holdings, Inc.


text: The vCISO directly reports to the General Counsel and CRO. The vCISO, CRO and the SVP, Information Technology meet regularly to discuss both internal and external cybersecurity risks and incidents. The CRO and the SVP, Information Technology also regularly meet with the CEO to update him on any cybersecurity risks and incidents affecting us. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing Rhinebeck Bank. Furthermore, all significant cybersecurity matters and strategic risk management decisions are promptly escalated to the Board of Directors, ensuring that they have an up-to-date, comprehensive understanding of and can provide guidance on critical cybersecurity issues.

companyName: Rhinebeck Bancorp, Inc.

ticker: RBKB


text: with the assistance of IT support plays a pivotal role in informing the Audit Committee on cybersecurity risks. He provides comprehensive briefings directly to the Board of Directors, as needed. These briefings encompass a broad range of topics, including any emerging threats, the status of ongoing cybersecurity initiatives, and incident reports and learnings from any cybersecurity events that may occur. The Audit Committee actively participates and offers guidance in strategic decisions related to cybersecurity. This involvement helps ensure that cybersecurity considerations are integrated into our broader strategic objectives.

companyName: LogicMark, Inc.

ticker: LGMK


text: Each of our platform and corporate systems involves the use of third-party technology or service providers, or vendors, such as hosting platforms, open-source software, and application providers. We also use vendors to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats to our platform and corporate systems, including consulting firms, external legal counsel, incident response vendors, penetration test providers, auditors, monitoring technology, and cybersecurity data providers. We have a vendor management program under which our corporate security, product security, and legal teams evaluate cybersecurity risks presented by our use of vendors. Depending on the nature of the technology or services provided, the sensitivity of the information systems and data at issue, and the identity of the vendor, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks. For higher-risk vendors, this process includes a vendor security questionnaire, an evaluation of the vendor's security program and security documentation, and the imposition of contractual obligations related to cybersecurity on the vendor. All vendors are required to undergo this review, which is in addition to the applicable security reviews conducted by our product security and corporate security teams described above.

companyName: Snowflake Inc.

ticker: SNOW


text: At the Board level, the full Board and its Stewardship Committee (which oversees many of our operational risks related to manufacturing) are both involved in oversight of the Company's management of cybersecurity risk. Management, including the Chief Information Officer and Chief Information Security Officer, updates our Stewardship Committee and full Board on cybersecurity matters quarterly. We also have processes by which certain cybersecurity incidents are escalated within the Company and may be reviewed by a designated management committee and, where appropriate, reported in a timely manner to the Board.

companyName: Celanese Corp

ticker: CE


text: AES' Chief Information Security Officer ("CISO") reports to AES' General Counsel and is the head of the Company's cybersecurity team. The CISO is responsible for assessing and managing AES' cyber risk management program globally, including IPALCO and its subsidiaries. In this role, the CISO informs senior management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervises such efforts. AES' CISO has extensive experience assessing and managing cybersecurity programs and cybersecurity risk and has served in that position since 2020.

companyName: IPALCO ENTERPRISES, INC.


text: Our cybersecurity risk management program includes: • Ongoing risk assessments to help identify material cybersecurity risks to our critical systems and information by performing regular scans of our environment, assessing incident trends and engaging third parties to assess the effectiveness of our cybersecurity practices; • The use of external service providers, where appropriate, to monitor, identify, assess, test and remediate, or otherwise assist with aspects of our security controls; • Mandatory cybersecurity awareness training for employees and simulated phishing attacks; • A disaster recovery and business-continuity plan and controls designed to protect against business interruption, including the backing up of our critical systems; • A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents, internal reporting to management and the board of directors; • Cybersecurity insurance which is assessed annually; and • Risk management process for service providers, suppliers, and vendors.

companyName: KURA SUSHI USA, INC.

ticker: KRUS


text: XPO employs a robust system of information technology and information security controls and measures to assess, identify, and mange risks from cybersecurity threats which we consider to be critically important to maintaining our business and ensuring our business continuity. Our information security program is managed by a dedicated Chief Information Security Officer ("CISO"), whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, threat detection, and incident response processes. Our CISO has a background in cybersecurity and risk management, including assessing, designing, building and operating security platforms. He has over 10 years of information technology and information security experience having successfully built and led security programs on areas relating to cybersecurity, risk management, identity and access, data protection, product and software security, cyber engineering, cyber defense, automation, and compliance initiatives. The CISO, who reports directly to our Chief Information Officer, provides periodic reports to our Board of Directors, as well as our Chief Executive Officer, Chief Information Officer, and other members of our senior management as appropriate. Our CISO meets regularly with his team as well as other key personnel to share information about potential cybersecurity events and monitor, prevent, and detect potential cybersecurity incidents and develop reports for our senior management. These reports include updates on the Company's cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, including the results of security breach simulations, and the emerging threat landscape. Our Board of Directors will be informed of all material cybersecurity incidents and our information security program includes procedures for calling a special session of the Board of Directors in the event of a high or critical-risk cybersecurity incident. The Board of Directors also discusses relevant incidents in the industry and the evolving threat landscape.

companyName: XPO, Inc.

ticker: XPO


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "If our information technology systems or those of the third parties whom we work with, or our data, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions, litigation, fines and penalties, disruptions of our business operations, reputational harm, loss of revenue or profits and other adverse consequences."

companyName: RAPT Therapeutics, Inc.

ticker: RAPT


text: Recognizing the pivotal role of our personnel in cybersecurity, we also conduct proactive training sessions covering essential topics such as data handling practices and email phishing awareness. These initiatives are designed to empower our workforce to serve as a human firewall, augmenting our overall security posture.

companyName: INTELLIGENT PROTECTION MANAGEMENT CORP.

ticker: IPM


text: To date, we have not experienced any cybersecurity incidents that have had a material impact on our service, systems, business, financial condition, or results of operations. Any significant disruption to our service or access to our systems could adversely affect our business, results of operation and reputation. Further, a penetration of our systems or a third-party's systems or other misappropriation or misuse of personal information could subject us to business, regulatory, litigation and reputation risk, which could have a negative effect on our business, financial condition, and results of operations. See "Risk Factors – Cybersecurity – Any significant disruption in or unauthorized access to our computer systems or those of third parties that we utilize in our operations, including those relating to cybersecurity or arising from cyber-attacks, could result in a loss or degradation of service, unauthorized disclosure of data, including corporation information, or theft of intellectual property, including digital content assets, which could adversely impact our business." Management has implemented risk management structures, policies, and procedures, and manages our risk exposure on a day-to-day basis. We have a cybersecurity organization within our operations department that focuses on current and emerging cybersecurity matters and leverages cybersecurity consultants and third-party cybersecurity firms.

companyName: 5&2 Studios, Inc.


text: The Company operates technologies that are exposed to the internet, and although robust cybersecurity programs, technologies, and safeguards are deployed to help protect the Company's operations and assets, the Company, by nature, is exposed to material cybersecurity attacks that are either generally targeted at companies that operate on the internet, or the Company, by nature, remains exposed to attacks that are specifically directed at the Company's technology systems exposed to the internet.

companyName: Vestis Corp

ticker: VSTS


text: Our cybersecurity program is managed by our Director of Global IT Architecture and Cybersecurity (the "Cybersecurity Director"), and our CIO, who reports directly to our Chief Executive Officer. Our CIO and Cybersecurity Director each have over 30 years of experience leading numerous business and technology initiatives and global cross-functional projects to improve the Company's business systems, infrastructure, and processes, including extensive experience assessing and managing cybersecurity programs and risk. Our CIO and the IT function monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the processes described above, including the operation of the Company's incident response plans, which include appropriate escalation to the executive team and the Audit Committee. As discussed above, the CIO reports at least semiannually to the Audit Committee about cybersecurity threat risks, among other cybersecurity related matters.

companyName: STONERIDGE INC

ticker: SRI


text: The Company maintains a Security Council that regularly meets to review current or potential threats. The Security Council's membership consists of the following: the Company's Chief Executive Officer, Chief Financial Officer, General Counsel, Vice President of Technology Operations, Director of Systems Engineering, and Head of Internal Audit. We also employ a Security Department responsible for cybersecurity across the organizations. The individuals in this department are vetted for their experience and expertise before joining the team and maintain continued education and training each year using our enhanced learning program. This department's responsibilities include cyber security risk management, security operations, awareness training, incident response, industry awareness and reporting. The team assesses and maintains awareness of global cyber security threats by using several services and notifications from our vendors. The team then considers each of these threats as applied to our environment, process, operations, vendors and clients. The Security Council is led by the Vice President of Technology Operations, and Director of Systems Engineering, each of whom have a depth of knowledge and experience in the cyber security space.

companyName: DHI GROUP, INC.

ticker: DHX


text: The Risk Committee is responsible for overseeing the Company's management of cybersecurity risk, including oversight into appropriate risk mitigation, strategies, processes, systems, and controls. The CISO has regular and direct communication with the Risk Committee, providing a written cybersecurity report to the Risk Committee and a written cybersecurity report and briefing to the full Board on an annual basis (more frequently as necessary), in order to inform the Risk Committee of the state of the Company's Cybersecurity Program. These reports cover, but are not limited to, the Company's cybersecurity posture, overall status of the Company's compliance with the Cybersecurity Program, threat environment, material cybersecurity risks and events, Cybersecurity Program improvements and effectiveness, and other material matters related to the Cybersecurity Program.

companyName: Citizens Community Bancorp Inc.

ticker: CZWI


text: Related to Cybersecurity Risks Our cybersecurity risk management program is managed by our Information Security Management Committee. Led by our Chief Information Security Officer ("CISO"), the Information Security Management Committee is made up of cross-functional members of company management and works closely with our third-party information technology and security providers to develop and implement our cybersecurity strategy. Our CISO is responsible for the day-to-day oversight of the assessment and management of cybersecurity risks. The individual who is currently in this role has over 20 years of experience in information security. Our audit committee has oversight over cybersecurity risks. The audit committee reviews the enterprise risk management program quarterly, which includes the cybersecurity risk management program and any identified cybersecurity risks. With the input of the Information Security Management Committee and our information technology providers, the CISO regularly reports to the audit committee on our cybersecurity risk management process, including updates related to security testing, assessments, cyber risk and related cyber strategy, as applicable. In addition, the CISO makes annual cybersecurity reports to our board of directors.

companyName: Cerence Inc.

ticker: CRNC


text: Our Board of Directors has oversight responsibility for the Company's cybersecurity risk management, including technology and cybersecurity risks facing the Company. Management updates the Board, as necessary, regarding cybersecurity risk management matters, including reporting any material cybersecurity incidents.

companyName: FLANIGANS ENTERPRISES INC

ticker: BDL


text: e.a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents, including an enterprise-wide escalation protocol; and f.a third-party risk management process for service providers based on our assessment of their criticality to our operations and respective risk profile.

companyName: e.l.f. Beauty, Inc.

ticker: ELF


text: We have adopted an incident response plan that applies upon the occurrence of a cybersecurity incident involving a breach of our own information technology systems and applications. Pursuant to this response plan, if an incident occurs, a multi-disciplinary team is assembled that includes our CTO and General Counsel and, if appropriate, our COO and CFO, which in turn may leverage the expertise of third-party consultants, external legal counsel and other resources. The plan includes procedures designed to facilitate containment of, and responses to, a cybersecurity incident, which are based on the type of incident, the location of the incident and the breadth of the incident. The plan also establishes procedures for notifying any impacted parties, including our customers, law enforcement and regulatory authorities, third-party vendors and insurance providers. Our CTO will provide periodic updates to the Audit Committee and, when appropriate, the Board of Directors during this process.

companyName: Douglas Elliman Inc.

ticker: DOUG


text: Our Board, in coordination with the Nominating and Governance ("Nom Gov") Committee, oversees our cybersecurity program, including the management of risks from cybersecurity threats. The Nom Gov Committee receives regular presentations and reports on cybersecurity risks from our Chief Information Officer ("CIO"), which address a wide range of topics including recent developments, vulnerability assessments, third-party and independent reviews, the threat environment, incident response planning, remediation efforts, employee training and awareness (including the results of our annual cybersecurity training), and information security considerations arising with respect to our peers and third parties. On a regular basis, our Nom Gov Committee discusses our approach to cybersecurity risk management with our CIO, including planned initiatives to help the Board evaluate the effectiveness of our cybersecurity program. The Board receives occasional updates from the Nom Gov Committee and CIO on the effectiveness of our cybersecurity program. When appropriate, the Board also receives reports concerning the detection, mitigation and remediation of cybersecurity threats and incidents Our CIO has over 25 years of software engineering experience including over ten years of being responsible for MarketWise's cybersecurity. In coordination with our executive team, our CIO and our Senior Vice President of IT Operations work collaboratively across the Company to implement a program intended to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response plan. Our CIO and management monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and report such threats and incidents to the Board.

companyName: MARKETWISE, INC.

ticker: MKTW


text: The Company's cybersecurity strategy is focused on detection, protection, incident response, security risk management and mitigation, and resiliency of the cybersecurity infrastructure. The Company relies primarily on its qualified internal team to operate and maintain its information technology infrastructure and systems and to evaluate, test and update various information security processes and to manage material risks from cybersecurity threats to the Company's critical computer networks, third party hosted services, communications systems, hardware and software, and critical data, including confidential information that is proprietary, strategic or competitive in nature, as well as any personally identifiable information related to any tenants' and employees' personal data.

companyName: CLEARONE INC

ticker: CLRO


text: While the Board has overall responsibility for risk oversight, the Board delegated to the audit committee of the Board the responsibility for assisting the Board with cybersecurity disclosure matters. In its oversight role, the Board is expected to specifically consider risks that relate to the reputation of the Company and the general industry in which we operate, including with respect to privacy, information technology and cybersecurity and threats to technology infrastructure.

companyName: PLUS THERAPEUTICS, INC.

ticker: PSTV


text: At the management level, Atleos also established the Office of Risk Management and appointed a Chief Risk Officer to assist the Company in fulfilling its objectives relating to ERM, ethics & compliance (E&C), data privacy, TPRM, BCP and sustainability. The Company's Chief Risk Officer is responsible for developing and managing formal programs designed to identify, assess and respond to material and emerging risks and opportunities that may impact the achievement of the Company's strategic objectives.

companyName: NCR Atleos Corp

ticker: NATL


text: We have developed a procedure by which the board of directors and management are informed about relevant cybersecurity risks, allowing for effective cybersecurity oversight and the ability of the Company to monitor, prevent, detect, mitigate and remediate cybersecurity incidents. The results of the our evaluations and the feedback from its engagements are used to drive alignment on, and prioritization of, initiatives to enhance our cybersecurity strategies, policies, and processes and make recommendations to improve processes.

companyName: Shimmick Corp

ticker: SHIM


text: The Company manages risks through a multi-faceted approach. Steps include outlining guidelines for data access, usage, and protection, ongoing security training and awareness programs for employees, implementation of strong authentication techniques including multi-issue authentication (MFA), regularly updating and patching software and structures facilitates to mitigate vulnerabilities, conducting cybersecurity audits, and closely working with cybersecurity specialists to staying informed about emerging threats and trends and to implement multi-layered protections.

companyName: ICC Holdings, Inc.


text: Third-party experts are engaged to conduct NIST CSF maturity assessments, penetration testing assessments, periodic red team assessments and table top exercises. At a minimum, at least one of these assessments is conducted annually by a third-party expert. Peabody also engages a third-party expert to assess the risk of its business and operational vendors.

companyName: PEABODY ENERGY CORP

ticker: BTU


text: Juniata's risk management program is designed to identify, assess and mitigate risks across various aspects of the Company, including credit, market, treasury, operational, compliance and reputational. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential for a cybersecurity incident to occur, which could disrupt business operations or compromise sensitive data. Juniata's Information Security Officer ("ISO") and SVP/IT Manager are primarily responsible for this cybersecurity component and are key members of the organization, both of which have a clear line of reporting directly to the board of directors and involved with the Information Technology ("IT") Steering Committee. To date, the Company has not, to its knowledge, experienced an incident materially affecting or reasonably likely to materially affect the Company.

companyName: JUNIATA VALLEY FINANCIAL CORP

ticker: JUVF


text: (6)Team Member Education & Awareness. We remain dedicated to fostering an internal culture of cybersecurity, where all of our team members are trained to identify, respond, and report potential cybersecurity threats that may arise. New hires are required to participate in cybersecurity onboarding training, and current employees are responsible for completing mandatory cybersecurity training annually and phishing awareness training quarterly. Our leadership team participates in advanced, targeted cybersecurity training and exercises to ensure additional security. Our leadership team also participates in table-top exercises and trainings tailored to specific business units. For example, most recently our internal audit and finance teams participated in a successful table-top exercise which simulated cyber-attacks on our payroll and financial systems. All of our table-top exercises are facilitated by a third-party.

companyName: SBA COMMUNICATIONS CORP

ticker: SBAC


text: Our third-party service providers are primarily responsible for the security of their own information technology environments and in certain instances we rely significantly on third-party service providers to supply and store our sensitive data in a secure manner. All of these third parties face potential risks relating to cybersecurity similar to ours which could disrupt their businesses and therefore adversely impact us. While we provide guidance and specific requirements in some cases, we do not directly control any of these parties' information technology security operations, or the amount of investment they place in guarding against cybersecurity threats. Accordingly, we are subject to any flaw or breaches to their information technology systems, or those which they operate for us, which could have a material adverse effect on our financial condition or results of operations.

companyName: Power REIT

ticker: PW


text: requiring employees, as well as third parties who have access to our systems, to treat confidential and private information and data with care, including performing controls relating to such data; cybersecurity risk insurance. also seek to engage reputable service providers that maintain cybersecurity programs or controls.

companyName: Calidi Biotherapeutics, Inc.

ticker: CLDI


text: Our Board of Directors considers cybersecurity risk and other information technology risks as part of its risk oversight function and meets at least quarterly to discuss matters involving cybersecurity risks. The Chief Executive Officer and Chief Financial Officer provide information to our Board of Directors regarding its activities, including those related to cybersecurity risks, and are responsible for notifying the Board of material cybersecurity incidents.

companyName: LM FUNDING AMERICA, INC.

ticker: LMFA


text: We use third-party service providers to perform a variety of functions throughout our business, such as CROs, contract manufacturing organizations, and other distributors, including those who process clinical trial data on our behalf. Depending on the nature of the services provided, the sensitivity of the critical systems, information and assets at issue, and the identity of the provider, our third-party risk management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider, including, for example, a review of security assessments and imposition of contractual obligations related to cybersecurity on the provider.

companyName: Autolus Therapeutics plc

ticker: AUTL


text: We engage third-party services to conduct penetration testing as well as other regular evaluations of our security protocols and processes. Additionally, we assess and monitor the cybersecurity controls of third party service providers and partners. Ongoing and regular monitoring of our third parties is also managed through our ISP team's protocols in partnership with the vendor management, enterprise risk management, and internal audit departments. Cybersecurity incidents are managed as part of our ISP.

companyName: Triumph Financial, Inc.

ticker: TFIN


text: Our cybersecurity program, as implemented by our advisor and overseen by our board of directors, is fully integrated into our overall risk management system, and included as part of our information technology security incident response plan. The cybersecurity policies, standards, processes, and practices are based on recognized frameworks established by the National Institute of Standards and Technology ("NIST"). These processes include overseeing and identifying risks from cybersecurity threats associated with the use of third-party service providers.

companyName: KBS Real Estate Investment Trust III, Inc.

ticker: KBSR


text: Processes for Assessing, Identifying, and Managing Threats rely on the information technology and systems maintained by Pillar and their employees to identify and manage material risks from cybersecurity threats. Pillar takes various actions, and incurs significant costs, to maintain and manage the operation and security of information technology and systems, including the data maintained in those systems. We believe that Pillar's Director of Information Technology and his associates endeavor to evaluate and address cyber risks in alignment with our business objectives, operational needs and industry-accepted standards, such as the National Institute of Standards and Technology and CIS Critical Security Controls frameworks. Since we rely on accounting, financial, operational, management and other information systems, including the Internet and third-party hosted services to conduct our operations, store personal and sensitive data, process financial information and results of operations for internal reporting purposes and comply with financial reporting, legal and tax requirements, we have processes and procedures in place to monitor the prevention, detection, mitigation and remediation of cybersecurity risks. These include, but are not limited to (i) maintaining a defined and practiced incident response plan;

companyName: INCOME OPPORTUNITY REALTY INVESTORS INC /TX/

ticker: IOR


text: The Company has not experienced any notable security incidents that would have a material impact on the results of operations and financial condition of the Company. Certain PACCAR dealers and suppliers have reported they have experienced cyberattacks and those have not caused any material impact to PACCAR or the Company.

companyName: PACCAR FINANCIAL CORP


text: Management oversight of cybersecurity risks is provided through the Company's risk committee, which is chaired by the chief executive officer and comprised of members of senior management. Among its responsibilities, the risk committee identifies the Company's material risks and reviews the strategies, processes and controls in place to facilitate the understanding, identification, prevention, measurement, reporting and mitigation of those risks. The risk committee meets quarterly and reviews the Company's current assessment of cybersecurity risks conducted by the Company's CIO/CISO and IT security department based on leading cybersecurity frameworks. The risk committee also periodically conducts a detailed review of cybersecurity risks.

companyName: RLI CORP

ticker: RLI


text: Cybersecurity threats have not materially affected the Company, including our business strategy, results of operations or financial condition, to date. Risks relating to cybersecurity threats and potential impacts to our business strategy, results of operations or financial condition are discussed in "Risk Factors" herein.

companyName: Dream Finders Homes, Inc.

ticker: DFH


text: Our Senior Director of Information Technology/Information Security is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, helping prepare for cybersecurity incidents, approving cybersecurity processes, reviewing security assessments and other security-related reports, and communicating key priorities to relevant personnel. Our CFO is responsible for approving budgets as related to cybersecurity.

companyName: Mirum Pharmaceuticals, Inc.

ticker: MIRM


text: Our cybersecurity risk management program includes the following: • a multidisciplinary team comprised of personnel from information technology ("IT"), internal audit, accounting, and legal, as well as third-party cybersecurity experts principally responsible for directing (i) our cybersecurity risk assessment processes, (ii) our security processes, and (iii) our response to cybersecurity incidents; • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, services, and our broader enterprise IT environment; • internal and third-party security tools to monitor our systems, identify cybersecurity risks, and test our IT environment; • the use of third-party cybersecurity experts, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • a cybersecurity incident response plan and business continuity plan; • cybersecurity training for employees and key business partners with access to our systems; • a third-party cybersecurity risk management process for service providers and vendors who access our systems; • requiring employees, as well as third parties who have access to our systems, to treat confidential and private information and data with care, including performing controls relating to such data; and • cybersecurity risk insurance. We also seek to engage reputable service providers that maintain cybersecurity programs or controls.

companyName: HEALTHPEAK PROPERTIES, INC.

ticker: DOC


text: The CISO will be responsible for developing, maintaining, and enforcing the Program's policies and procedures, as well as reporting on the Program's performance and material cybersecurity risks to the Audit Committee. The CISO will have the relevant expertise and authority to carry out the Program's objectives and to coordinate with other key stakeholders within and outside the Company. The Program will be overseen by the Company's Board of Directors.

companyName: Elite Health Systems Inc.

ticker: EHSI


text: conduct of penetration tests on our computer systems to evaluate the security of the systems and identify weaknesses or vulnerabilities; training programs regarding cybersecurity risks and protocols;

companyName: Viewbix Inc.

ticker: VBIX


text: Our IT risk program also includes an incident response plan that provides for how we detect, respond to and recover from cybersecurity incidents, which include processes designed to triage, assess severity, escalate, contain, investigate and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate damage to our brand and reputation.

companyName: MSCI Inc.

ticker: MSCI