text: The execution and measurement of our cybersecurity program are managed by our Information Technology department. This program is integrated into our broader governance and internal controls framework. We regularly engage with third-party consultants, auditors, and specialists to enhance our program, employing advanced cybersecurity technologies and services to prevent, detect, respond to, and recover from cyber threats and incidents. Additionally, our third-party security partner actively monitors and mitigates risks from external sources as part of our overall cybersecurity strategy.


text: We have processes to evaluate third-party service providers and vendors that have access to sensitive systems and customer data, which may include due diligence procedures such as assessments of that service provider's cybersecurity posture or a recommendation of specific mitigation controls. Following an assessment, we determine and prioritize service provider risk based on potential threat impact and likelihood, and such risk determinations drive the level of due diligence and ongoing compliance monitoring required for each service provider.

companyName: RADIANT LOGISTICS, INC

ticker: RLGT

secItem: Item 1C


text: Role of Management Management has implemented risk management structures, policies and procedures, and is responsible for the day-to-day cybersecurity risk management. Our Information Technology department that is led by our Chief Technology Officer is responsible for the day-to-day assessment and management of cybersecurity risks. Our Chief Technology Officer has led our IT department since 2013 and has over thirty years of experience developing and implementing technology and supply chain services. We have implemented a number of processes which allow the management team to be informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. These processes include, among other things, system alerts of potential malicious cyber activity, access to real-time dashboards that monitor and assess our systems, status reports provided on a daily, weekly and monthly basis, and regular ongoing communications with service providers regarding potential new attack vectors and vulnerabilities. Our Chief Technology Officer and his team shares such information with our management team and reports information about such risks to our Audit and Executive Oversight Committee ("AEOC").


text: The Board of Directors, both directly and through the delegation of responsibilities to the AEOC has risk management oversight, which includes the proper functioning of our cybersecurity risk management program. In particular, the AEOC assists the Board in its oversight of management's responsibility to assess, manage and mitigate risks associated with our business and operational activities, to administer our various compliance programs, in each case including cybersecurity concerns, and to oversee our information technology systems, processes and data.


text: The AEOC, which is comprised entirely of independent directors, is responsible for periodically reviewing and assessing with management (i) the adequacy of controls and security for our information technology systems, processes and data, and (ii) our contingency plans in the event of a breakdown or security breach affecting our information technology systems, it being understood that it is not possible to eliminate all such risks and that we will necessarily face a variety of risks with respect to information technology in the conduct of our business. The AEOC is additionally responsible for reviewing the cybersecurity disclosures required to be included in our filings with the SEC.


text: The AEOC regularly discusses with management, including our Chief Technology Officer, our enterprise risk management process, including our cybersecurity exposures, the steps management has taken to monitor and control such exposures and guidelines and policies to govern our risk assessment and risk management processes. The AEOC periodically reports to the Board regarding significant matters identified with respect to the foregoing, including, among others, our risk assessment and risk management approach to cybersecurity.


text: We believe each of the members of the AEOC has relevant work experience related to information security or cybersecurity to allow for the effective oversight of cybersecurity risks. In particular, Richard Palmieri has held numerous roles where he provided oversight of technology functions, Kristin Toth has significant experience managing e-commerce platforms and businesses, and Michael Gould has held senior roles in the technology consulting businesses at Oracle and Hewlett-Packard Company.


text: Risks from Material Cybersecurity Threats Although we have taken steps to prevent and mitigate data security threats, there can be no assurance that our protective measures and those of our third-party service providers will prevent or detect security breaches that could have a significant impact on our business, reputation, operating results and financial condition.


text: We have experienced two separate cyber events. First, in December 2021, we experienced a targeted cyber-attack, leading to a global shutdown of our connectivity, operational, and accounting systems to protect our infrastructure. Although our operations systems were eventually restored, this event caused significant disruption to our operations for approximately two weeks, temporarily impacting our ability to manage freight shipments, customs brokerage functions, and distribution activities. Next, in March 2024, our Canadian subsidiary experienced a targeted cybersecurity breach. This attack was identified by our end point protection software and our third-party monitoring partner. As per our response process, we initiated a shutdown of our Canadian infrastructure and engaged our incident response team. The operations systems were restored and approved to return to service within one week. While we continue to learn from these incidents, we do not anticipate further material adverse impacts from them on our business. Following the attacks, we enhanced our security program with additional tools and strengthened measures for improved system and network monitoring.


text: As of the date of this filing, we have not identified any cybersecurity threats that are reasonably anticipated to have a material effect on our business strategy, results of operations or financial condition. Maintaining a robust information security system is an ongoing priority for us and we plan to continue to identify and evaluate new, emerging risks to data protection and cybersecurity both internally and through our engagement of third-party service providers.


text: Cybersecurity Risk Management and Strategy We recognize the importance of information security practices designed to protect the confidentiality, integrity, and availability of company information and the personal information that we process. Cybersecurity risk management is an integral part of our overall enterprise risk management efforts. We manage cybersecurity risks using a framework based on applicable regulations, industry standards and recognized best practices. Through this framework, we devote significant resources to identifying, monitoring, assessing and responding to cybersecurity threats and incidents, including those associated with our use of third-party software, applications, services, and cloud infrastructure.

companyName: Gold.com, Inc.

ticker: GOLD


text: Our Cybersecurity Program includes multiple policies, procedures, and other components designed to identify, analyze, and respond to cybersecurity risks, including reliance on a layered system of preventative and detective technologies and controls designed to detect, mitigate, and contain cybersecurity threats. As part of our Cybersecurity Program, we maintain a Written Information Security Plan that outline internal controls and procedures designed to protect our information systems. Our Cybersecurity Program contains a comprehensive suite of cybersecurity policies that are commensurate with companies in our industry of similar size and sophistication, and these policies are also informed by the sensitivity of our data processing activities. Our Cybersecurity Program also includes policies and procedures designed to ensure adequate business continuity, disaster recovery, and incident response. We also have access through our insurer to computer forensics firms and specialized legal counsel in case of a cybersecurity incident. While we maintain cybersecurity insurance to assist in the cost of recovery from a cybersecurity incident, such coverage may not be sufficient to cover all costs resulting from such incidents.


text: We leverage qualified third-party consultants, advisors, counsel, and other experts to inform, audit, and update our Cybersecurity Program throughout each year. We engage security assessors to identify vulnerabilities through both internal and external penetration tests and to perform cybersecurity maturity assessments. We perform risk assessments annually, or more frequently if circumstances require, using both internal and external resources. We may also be subject to examinations by applicable regulators. We conduct annual cybersecurity training for employees to enhance awareness of how to detect and respond to cybersecurity threats, as well as periodic phishing training and testing campaigns. We also conduct table-top exercises annually to simulate a response to a cybersecurity incident.


text: Our designated IT team members monitor cybersecurity threats in real time for the Company at the enterprise level, with the assistance of third-party threat detection and monitoring software. Cybersecurity threats at the subsidiary level are also monitored in real time by experienced IT professionals at those subsidiaries, including our Vice President of Digital and Technology at JM Bullion. These individuals report cybersecurity incidents immediately to our Chief Information Officer (CIO), who in turn follows approved reporting protocols, as more fully described below.


text: Our Cybersecurity Compliance and Disclosure Committee (CCDC), which is further described below, is chaired by our CIO and includes the General Counsel of A-Mark and other representatives from the Company and our subsidiaries, including top-level management, to ensure enterprise-wide implementation and consistent application of the Company's data security policies and procedures. The CCDC regularly enlists subject matter experts to assist where necessary.


text: We also maintain a formal Vendor Management Program that provides oversight of cybersecurity risks related to our vendor and supplier relationships. During vendor onboarding, we perform risk-based due diligence on these third-parties, with heightened requirements for vendors that have access to confidential or personal information or that require access to our information systems. This Vendor Management Program includes specific cybersecurity requirements for our vendors, as well as ongoing monitoring, assessment, and contract review. Members of the CCDC are involved in and review the Vendor Management Program at least annually.


text: To date, we have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, the sophistication of and risks from cybersecurity threats and incidents continue to increase, and the preventative actions that we have taken and continue to take to reduce the risk of cybersecurity threats and incidents may not successfully protect against all cybersecurity threats and incidents. For more information on the risks that we face from cybersecurity threats, see "Risk Factors – Risk Factors of General Applicability—New rules have recently become effective that will require the Company to provide disclosures regarding cybersecurity management and events." in Part 1, Item 1A of this report.


text: Cybersecurity Governance The Board has overall responsibility for risk oversight and has delegated oversight of our Cybersecurity Program, including enterprise-wide risk assessment and management, to the CCDC. The CCDC's charter requires it to monitor Company efforts to prevent, detect, mitigate, and remediate cybersecurity incidents, and to comply with cybersecurity laws and regulations. The CCDC oversees and approves all Company policies and procedures related to cybersecurity. The CCDC also ensures that significant cybersecurity issues or concerns are reported to the Board and A-Mark's CEO, and disclosed to the public, individuals, or regulators where required by law.


text: The CCDC directly oversees information technology and information security risks through regular meetings, reports from management on information technology, cybersecurity, and related risk assessments, and incidents disclosed by third-party service providers as applicable. If a cybersecurity threat is identified, our Vice President of IT or other reporting individuals will immediately inform our IT service desk and notify our CIO. Once the threat has been analyzed, our CIO will inform our General Counsel of any security incidents. The General Counsel will report on the incident, as appropriate, to the CCDC, our CEO, President and CFO, and to the Board, either at the next scheduled meeting or on a current basis, depending on the severity of the incident.


text: The CCDC reports at least quarterly to the Board and A-Mark's CEO on the following topics, among possible others: our current risk posture and threat landscape; new material cybersecurity threats and high-risk exposures; risk mitigations and controls; incident response readiness; and updates to cybersecurity policies and procedures. The CCDC is also authorized and directed to report to the Board and A-Mark's CEO promptly in the event of a significant cybersecurity incident, as appropriate.


text: A-Mark's Chief Information Officer (CIO) chairs the CCDC. Our CIO brings over 14 years of IT experience to A-Mark. Since joining A-Mark in 2019, he has been pivotal in enhancing our data privacy compliance program, significantly strengthening our data protection and privacy measures, particularly ensuring protection of sensitive data. The co-vice chairs of the CCDC are A-Mark's Vice President of IT and JM Bullion's Vice President of Digital and Technology. Our Vice President of IT has over 25 years of experience in IT working in various industries including ecommerce, health care, and financial industries focusing on IT operations, cybersecurity and compliance. Since joining the company in 2014, he has been instrumental in the creation and growth of our cybersecurity program. Our Vice President of Digital and Technology at JM Bullion has comprehensive experience in the cybersecurity field. He successfully established a 24/7 security operation center (SOC) to continuously detect and respond to security incidents, as well as implemented various advanced services to proactively detect vulnerabilities on potential attack surfaces with high accuracy spanning across assets, applications, data, endpoints and network. He also centralized the workforce identity and access management (IAM) of the various systems for improved administration and control at the subsidiary level. He joined JM Bullion in 2015 and has served in his current role as Vice President of Digital and Technology since 2021.


text: Other members of the CCDC include top executives and management from the Company and its subsidiaries, including A-Mark's General Counsel, President, Chief Financial Officer, Chief Operating Officer, Senior Director of Financial Reporting, Director of Internal Audit, and Director of Enterprise Development and Administration, as well as JM Bullion's President and Chief Executive Officer and its Chief Financial Officer. Finally, the CCDC is assisted by an external compliance consultant with over twenty years of IT experience, and A-Mark's outside legal counsel for privacy and data security.


text: Cybersecurity is a significant and integrated component of CFSB Bancorp's risk management strategy, designed to protect the confidentiality, integrity, and availability of sensitive information contained within the Company's information services. As a financial services company, cyber threats are present and growing, and the potential exists for a cybersecurity incident to disrupt business operations, compromise sensitive data or both. To date, we have not, to our knowledge, experienced a cybersecurity incident materially affecting or reasonably likely to materially affect the Company.

companyName: CFSB Bancorp, Inc. /MA/

ticker: CFSB


text: To prepare and respond to incidents, the Company has implemented a multi-layered "defense-in-depth" cybersecurity strategy, integrating people, technology, and processes. This includes employee training, the use of innovative technologies, and the implementation of policies and procedures in the areas of Information Security, Data Governance, Business Continuity and Disaster Recovery, Privacy, Third-Party Risk Management, and Incident Response. Core activities supporting our strategy include cybersecurity training, technology optimization, threat intelligence, vulnerability and patch management and the testing of incident response, business continuity and disaster recovery capabilities. The Company engages third-party consultants and independent auditors to, among other things, conduct penetration tests and audits of the areas noted above, including cybersecurity-related vendors.


text: The Board of Directors designated the Vice President Information Systems as the Information Security Office (the "ISO") and for oversight, the full Board receives threat intelligence reports and a Cybersecurity Executive Dashboard from the ISO each month. The ISO has more than thirty years' experience with the Company and meets with the full Board of Directors in person at least annually. The ISO works with the Company's third-party Security Operations Center and the Company's Compliance/Enterprise Risk Management ("ERM") Team to identify, assess, and manage material risks from cybersecurity threats. The ISO also oversees the Company's Information Security Program, which governs various information security and cybersecurity processes, systems development, change control, disaster recovery/business continuity, physical asset classification and control policies. The Information Security Program identifies data sources, threats, and vulnerabilities and ensures awareness, accountability, and oversight for data protection throughout the Company and with trusted third parties to ensure that data is protected and able to be recovered in the event of a breach or failure (technical or other disaster). The ISO is a member of various management committees, including the quarterly Management Control meetings which serve as the Company's IT Steering Committee.


text: On a periodic basis, but not less than annually, the ISO in conjunction with the Compliance/ERM Team, identifies and documents internal and external vulnerabilities that could result in unauthorized disclosure, misuse, alteration, or destruction of customer information or customer records. Based on the results of the risk assessment, the Company's Information Security Program may be revised to protect against any anticipated threats or hazards to the security or integrity of such information. The Team reviews changes to the program designed to monitor, measure, and respond to vulnerabilities identified.


text: Response to Security Vulnerabilities In response to identified risks, management may take certain steps to correct and respond to security vulnerabilities, which may include: • Eliminating unwarranted risks by applying vendor-provided software fixes, commonly called patches. • Ensuring that changes to security configurations are documented, approved, and tested. • Ensuring that exploitable files and services are assessed and removed or disabled based upon known vulnerabilities and business needs. • Updating vulnerability scanning and intrusion detection tools to identify known vulnerabilities and related unauthorized activities. • Conducting subsequent penetration testing and vulnerability assessments, as warranted. • Reviewing performance with service providers to ensure security maintenance and reporting responsibilities are operating according to contract provisions and that service providers provide notification of system security breaches that may affect the Company.


text: Employees and Training Employees are an integral part in the line of defense against cybersecurity risks. Every employee is responsible for protecting Company and client information. Accordingly, employees complete formal training including regular simulated phishing assessments designed to sharpen threat detection and reporting capabilities. Our employees are supported with solutions designed to identify, prevent, detect, respond to, and recover from incidents. Notable technologies include firewalls, intrusion detection systems, managed endpoint security automation and response capabilities, user behavior analytics, multi-factor authentication when available, encrypted data backups, and business continuity applications. Notable services include 24/7 security monitoring and response, real-time vulnerability scanning, third-party monitoring, and threat intelligence.


text: Service Providers The Company relies on third-party vendor services and solutions to support its operations. Many of these vendors have access to sensitive and proprietary information. Third-party vendors continue to be a notable source of operational and informational risk. Accordingly, the Company has implemented an Outsourcing Management Policy which includes a detailed onboarding process and periodic reviews of vendors with access to sensitive Company data. The Outsourcing Management program is audited as part of the Company's external audit program.


text: At least annually, the ISO reports to the Board the overall status of the Information Security Program and the Company's compliance with the Interagency Guidelines for Safeguarding Customer Information. Any material findings related to the risk assessment, risk management and control decisions, service provider arrangements, results of testing, security breaches or violations are discussed as are management's responses and any recommendations for program changes.


text: Program Adjustments The ISO monitors, evaluates, and adjusts the Information Security Program considering any relevant changes in technology, the sensitivity of its customer information, internal or external threats to information, and changing business arrangements, such as mergers and acquisitions, alliances and joint ventures, outsourcing arrangements, and changes to customer information systems.


text: Incident Response Plan The Company has implemented an Incident Response Plan (the "IRP") to provide a structured and systematic incident response process for information security incidents that affect any of the information technology systems, network, or data. The Company's business continuity and disaster recovery programs provide a coordinated response when responding to incidents. The IRP is implemented and maintained by the ISO and is subject to annual review and approval by the Board. Cybersecurity metrics are reported to the board monthly.


text: The IRP includes: • Identifying the incident response team (the "IRT") and any appropriate sub-teams to address specific information security incidents, or categories of information security incidents. • Coordinating IRT activities, including developing, maintaining, and following appropriate procedures to respond to and document identified information security incidents. • Conducting post-incident reviews to gather feedback on information security incident response procedures and address any identified gaps in security measures. • Providing training and conducting periodic exercises to promote employee and stakeholder preparedness and awareness of the IRP. • Reviewing the IRP at least annually, or whenever there is a material change in Company's business practices that may reasonably affect its cyber incident response procedures.


text: Risk Management and Strategy We recognize the importance of cybersecurity in safeguarding sensitive information, maintaining operational integrity, and working to ensure the safety and efficacy of our products. We evaluate and monitor cybersecurity risk as part of our overall enterprise risk management program, which considers cybersecurity risks alongside other company risks as part of our overall risk assessment process. In addition, the risk oversight responsibility of our Board of Directors and its committees is supported by our cybersecurity risk assessment program, which include policies and processes that are designed to provide visibility and information about the identification, assessment, and management of critical risks and management's risk mitigation strategies, to our Board of Directors and personnel that are responsible for risk assessment. These policies also govern the security of our products and the protection of customer and patient data, provide for vulnerability remediation, regular system updates and patches, employee training on cybersecurity and HIPAA best practices, incident reporting, and the use of encryption to secure sensitive information. To identify, assess, and manage material cybersecurity risks, our team uses a cybersecurity risk assessment process aligned with leading frameworks such as the National Institute of Standards and Technology's Cyber Security Framework and HIPAA. Our cybersecurity risk assessment program provides the underlying basis for the activities of our team to identify and mitigate risks from, as well as develop risk management and response strategies for, evolving and emerging cybersecurity threats.

companyName: ACCURAY INC

ticker: ARAY


text: Our cybersecurity program includes a variety of processes to assess, identify and manage risks from cybersecurity threats arising from our own and third-party provided systems, including annual training requirements, simulation exercises, threat monitoring and detection tools (including those using artificial intelligence and machine learning), threat containment methods, risk assessments, third-party penetration testing and security requirements for our suppliers and other third parties. We have established processes providing for review of identified cybersecurity incidents by a cross-functional cybersecurity incident response team who monitors and manages the detection, assessment, mitigation and remediation of cybersecurity incidents and escalates incidents to the Chief Information and Security Officer and to our disclosure review board, which evaluates such incidents for materiality and potential disclosure, and works to ensure that members of management responsible for overseeing the operation of our disclosure controls and procedures are informed of such cybersecurity risks and incidents. Our cybersecurity incident response team and disclosure review board are comprised of subject matter experts, including employees in cybersecurity, information technology and other areas to evaluate potential security, financial, operational, reputational and other risks, and to address our process. We also engage third parties to enhance and strengthen our cybersecurity program, to provide additional capabilities and support and to provide periodic independent assessments and evaluations of our cybersecurity program. Third parties also provide managed services for security operations, incident response, and security remediation services.


text: We monitor and periodically enhance our cybersecurity program, processes, techniques and procedures to combat evolving and adaptive cybersecurity threats. To this end, we engage in the periodic assessment of our policies, standards, processes, and practices that are designed to address cybersecurity threats and incidents, internally and through assessments by external providers. The results of such assessments, audits, and reviews are reported to the Audit Committee and the Board of Directors, and we adjust our cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these assessments, audits, and reviews.


text: We also monitor and test our safeguards and train all our employees on cybersecurity safeguards related to our information technology systems. Personnel at all levels and departments are made aware of our cybersecurity policies through periodic cybersecurity trainings and tests. Further, we are focused on building and maintaining a positive cybersecurity culture through a combination of trainings, educational tools, videos, and other cybersecurity awareness initiatives. Our security training incorporates awareness of cyber threats (including malware, ransomware, and social engineering attacks), password hygiene, the importance of multifactor authentication and our incident reporting process. In addition to the assessment of internal cybersecurity risks, we have implemented processes to oversee, identify and monitor material risks from cybersecurity threats relating to potential compromises of sensitive information at our third-party business partners where relevant and we reevaluate these risks periodically. These processes include vetting of certain service providers for security, reliability, and availability; execution of a Business Associate Agreement with relevant providers for compliant management, storage, or processing of PHI if necessary; and confirmation by each service provider that its SOC-2 reports, or equivalent reports, are current and available, where applicable. In the event a service provider does not have a current and available SOC-2 or equivalent report, we review of the service provider's cybersecurity risk management and advise relevant business stakeholders of any significant identified risks.


text: While we regularly experience cybersecurity incidents, and we expect to continue to be subject to such incidents, as of the date of this report, we are not aware of any cybersecurity incidents that have had or are reasonably likely to have a material impact on our business or operations. However, we are subject to ongoing risks from cybersecurity threats that could materially affect us, including our business strategy, results of operations, or financial condition, as further described in Item 1A. Risk Factors in the risk factor entitled "Disruption of critical information technology systems, infrastructure and data or cyberattacks or other security breaches or incidents could harm our business and financial condition."


text: Our Board of Directors, both directly and through the delegation of responsibilities to the Audit Committee, oversees the proper functioning of our cybersecurity risk management program and ensures strategic alignment and governance of our cybersecurity efforts at the highest level. Our Board of Directors receives periodic briefings on the outcome of our cybersecurity risk management program, including steps that we are taking to mitigate risks that the program identifies, and each quarter, the Audit Committee reviews cybersecurity incidents, metrics and the state of the program.


text: Our cybersecurity risk management program is principally managed by our Global Information Systems team, which is led by our Chief Information and Security Officer, who reports directly to our Chief Executive Officer, as well as our deputy Chief Information Security Officer (deputy CISO). Our Chief Information and Security Officer and deputy CISO combined have more than 40 years of experience in cybersecurity and/or information technology risk management, have relevant certification, and are active in a variety of cybersecurity related boards and organizations. Our Chief Information and Security Officer also serves as the officer who reports directly to senior management and makes regular reports to the Audit Committee and Board of Directors as described in this Item 1C. Under the direction of our Chief Information and Security Officer and deputy CISO, we monitor developments that could affect our long-term organizational cybersecurity strategy based on threats globally and to enhance our cybersecurity program as needed in response to such developments.


text: We recognize the importance cybersecurity has to the success of our business, as well as recognize the need to continually assess cybersecurity risks and evolve our responses in the face of a rapidly and ever-changing environment. Accordingly, we aim to protect our business operations, records and information against known and evolving cybersecurity threats.

companyName: Lite Strategy, Inc.

ticker: LITS


text: Risk Management and Strategy We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing within these systems.


text: We conduct periodic risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks, reasonably address any identified gaps in existing safeguards, and regularly monitor the effectiveness of our safeguards. Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the Vice President of Information Technology who reports to our Acting Chief Executive Officer, Chief Financial Officer to manage the risk assessment and mitigation process.


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with our Information Technology department. Personnel at all levels and departments are made aware of our cybersecurity policies through trainings and internal communications.


text: If required, we engage consultants, or other third parties in connection with our risk assessment processes. These service providers, where appropriate, assist us in the assessment, testing or other aspects of our security controls to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment, as well as assist us in designing and implementing our cybersecurity policies and procedures.


text: We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K.


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated oversight of cybersecurity and other information technology risks to the Audit Committee. The Audit Committee oversees management's implementation of our cybersecurity risk management program and is responsible for monitoring and assessing strategic risk exposure, while our management team is responsible for the day-to-day operations over the material risks we face. Our management team, including our Acting Chief Executive Officer, Chief Financial Officer and Vice President of Information Technology, provide periodic briefings to the Audit Committee regarding our cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, if applicable.


text: The Audit Committee receives annual reports from management on our cybersecurity risks. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program, in the discretion of the Board and management. Board members may receive presentations on cybersecurity topics from external experts as part of the Board's continuing education on topics that impact public companies.


text: Our Acting Chief Executive Officer, CFO and Vice President of Information Technology, are responsible for assessing and managing our material risks from cybersecurity threats and have decades of experience in overseeing operations, including information technology functions, in the public company environment. The team has primary responsibility for our overall cybersecurity risk management program and supervises our retained external cybersecurity consultants as needed.


text: Our management team supervises cybersecurity risk management efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from external consultants engaged by us; threat intelligence and other information obtained from governmental, public or private sources; and alerts and reports produced by security tools deployed in the IT environment. The cybersecurity risk management program also includes tools and activities to prevent, detect, and analyze current and emerging cybersecurity threats, and plans and strategies to address threats and incidents.


text: We have processes in place to assess, identify, and manage material risks from cyber security threats. The Company's business is dependent on the communications and information systems of Investcorp Group, of which the Adviser is a part. The Adviser manages the Company's day-to-day operations and has adopted a cyber security program that applies to the Company and its operations.

companyName: Investcorp Credit Management BDC, Inc.

ticker: ICMB


text: Cyber Security Program Overview The Adviser's cyber security program is reliant on the Investcorp Group's information security team, which is responsible for assessing, identifying, and managing material cyber risks, including those applicable to the Company. The cyber security program involves a periodic risk assessment, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Company relies. The Investcorp Group's information security team actively monitors the current threat landscape to identify material risks arising from new and evolving cyber security threats, including material risks faced by the Company, and advises the Adviser of such risks during periodic reviews.


text: The cyber security program relies on the Adviser and the Investcorp Group to engage external experts, which may include assessors, consultants, auditors, or other third parties as appropriate to evaluate its cyber security measures and risk management processes, including those applicable to the Company.


text: The Company depends on and engages various third parties, including suppliers, vendors and service providers, to operate its business. The Company takes steps to identify and oversee risks from cyber security threats associated with our use of such entities, and the Chief Compliance Officer of the Company periodically reviews cyber security-related reports regarding key service providers.


text: Oversight of Cyber Security Risks by our Board of Directors The Board of Directors provides oversight on cyber security matters, including risks associated with cyber security threats. The Board of Directors receives periodic updates from the Company's Chief Compliance Officer and the Heads of Technology of Investcorp Group regarding the overall state of the Adviser's cyber security program, information on the current threat landscape, and risks from cyber security threats and cyber security incidents impacting the Company.


text: Management's Role in Cyber Security Risk Management The Chief Compliance Office of the Company oversees the Company's compliance oversight function generally and relies on Investcorp Group's Heads of Technology and information security team for assessing and managing material risks from cyber security threats impacting the Company. Investcorp Group's Heads of Technology and information security team have extensive experience in managing cyber security and information security programs for financial services companies with complex information systems. The information security team includes seasoned professionals who are experienced with information security protocols and receive appropriate training and industry certifications regarding information security. The Chief Compliance Officer is responsible for this oversight function as Chief Compliance Officer to the Company more broadly and has significant experience in the financial services industry, during which time the Chief Compliance Officer has gained expertise in assessing and managing risks applicable to the Company.


text: Management of the Company is informed about and monitors the prevention, detection, mitigation, and remediation of cyber security incidents impacting the Company, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, information technology, and/or compliance personnel of the Adviser.


text: Assessment of Cyber Security Risk The potential impact of risks from cyber security threats on the Company are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, results of operation, and financial condition are regularly evaluated. During the reporting period, the Company has not identified any risks from cyber security threats, including as a result of previous cyber security incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, results of operation, and financial condition.


text: Risk Management and Strategy We have developed and implemented cybersecurity risk management processes intended to protect the confidentiality, integrity and availability of our critical systems and information.

companyName: SUNLINK HEALTH SYSTEMS INC


text: While everyone at the Company plays a part in managing cybersecurity risks, primary cybersecurity oversight responsibility is shared by the Board, the audit committee of the Board of Directors ("Audit Committee") and senior management. Our cybersecurity risk management program is integrated into our overall enterprise risk management program, with substantial involvement of the Company's IT subsidiary.


text: Our cybersecurity risk management program includes: • physical, technological and administrative controls intended to support our cybersecurity and data governance framework, including controls designed to protect the confidentiality, integrity and availability of our key information systems and patients, employee, vendor and other third-party information stored on those systems, such as access controls, encryption, data handling requirements and other • cybersecurity safeguards, and internal policies that govern our cybersecurity risk management and data protection practices; • a defined procedure for timely incident detection, containment, response and remediation, including a written security incident response plan that includes procedures for responding to cybersecurity incidents; • cybersecurity risk assessment processes designed to help identify material cybersecurity risks to our critical systems, information, products, services and broader enterprise IT environment; • a security team responsible for managing our cybersecurity risk assessment processes and security controls; • the use of external consultants or other third-party experts and service providers, where considered appropriate, to assess, test or otherwise assist with aspects of our cybersecurity controls; • annual cybersecurity and privacy training of employees, including incident response personnel and senior management, and specialized training for certain teams depending on their role and/or access to certain types of information; and • a third-party risk management process that includes internal vetting of certain third-party vendors and service providers with whom we may share data.


text: Additionally, we engage third-party providers to augment our cybersecurity capabilities. These partnerships entail ongoing assistance for threat monitoring and mitigation, as well as targeted support for specialized security expertise.


text: As of June 30, 2024, we have not identified risks from known cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. For an examination of cybersecurity threats that could potentially have a material impact on us, please refer to Part I, Item 1A., "Risk Factors" -"A cyber-attack or security breach could result in the compromise of our facilities, confidential data or critical data systems and give rise to potential harm to patients, remediation and other expenses, expose us to liability under HIPAA, consumer protection laws, common law or other theories, subject us to litigation and Federal and state governmental inquiries, damage our reputation, and otherwise be disruptive to our business" in this Annual Report.


text: With oversight from the Board, the Audit Committee is primarily responsible for assisting the Board in fulfilling its ultimate oversight responsibilities relating to risk assessment and management, including relating to cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program, including processes and policies for determining risk tolerance, and reviews management's strategies for adequately mitigating and managing identified risks, including risks relating to cybersecurity threats.


text: Our IT management team is responsible for assessing and managing our material risks from cybersecurity threats and for our overall cybersecurity risk management program on a day-to-day basis, and supervises both our internal cybersecurity personnel and the relationship with our retained external cybersecurity consultants. Our IT management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, including briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: We rely on complex information technology systems and various software applications to operate our business. We have developed a comprehensive cybersecurity program as part of our ISO 27001 2022 certification designed to protect our systems and the confidentiality, integrity and availability of our data.

companyName: Renalytix plc

ticker: RNLXY


text: We have implemented processes that are intended to assess, identify, manage and reduce cybersecurity risks. We maintain a global incident response plan and disaster recovery management plan, each designed to protect against, identify, evaluate, respond to and recover from an incident. These plans anticipate an array of potential scenarios and provide for the assembly of a cybersecurity incident response team in the event of a cyber incident. The incident response team is a cross-functional group that may be composed of both company personnel and external service providers, and which is tailored to a particular incident so that individuals with appropriate experience and expertise are available.


text: We regularly conduct exercises to help ensure the plans' effectiveness and our overall preparedness. We also have invested in tools and technologies to protect our and our patients', customers' and business partners' data and information technology, and we regularly monitor our information technology systems and infrastructure to identify and assess cybersecurity risks.


text: Identified issues are logged within the organization's ticketing system, or managed by the change management policy. Automated monitoring and reporting mechanisms are in place wherever possible and appropriate. Vulnerability and penetration testing is performed by appropriately qualified internal personnel or hired specialist, in managed by the Supplier & Vendor Management Policy.


text: We rely in part on third parties (including assessors, consultants, advisors and others) in connection with our processes for assessing, identifying, managing and reducing cyber risks. In addition, we have implemented a cybersecurity awareness program designed to educate and train our entire employee network on how to identify and report cybersecurity threats.


text: We also provide specialized training for employees in specialized information technology roles. We take measures to regularly update and improve our cybersecurity program, including conducting independent program assessments, penetration testing and scanning of our systems for vulnerabilities.


text: We are certified to ISO 27001, 2022 and have satisfied the requirements for Information security, cybersecurity and privacy protection — Information security management systems (ISMS).


text: Oversight of the ISMS is provided through the ISMS Board chaired by a qualified Chief Information Security Officer (CISO). With representation of the executive management team and board through the Chief Technology Officer, the ISMS collectively makes the primary strategic decision around information security and issues that may arise. All identified risks or incidents are addressed and evaluated by an Information Security Incident Response Team (ISIRT) who are responsible for notifying executive management, board and other internal or external stakeholders as deemed necessary.


text: With respect to third-party service providers, our information security program includes conducting due diligence of relevant service providers' information security programs prior to onboarding.


text: Our risk management program is designed to identify, assess and mitigate risks across various aspects of our company, including financial, operational, regulatory, reputational and legal. Cybersecurity is a critical component of this program as we rely extensively on various information systems and other electronic resources to operate our business. Additionally, we rely to a great extent on third-party service providers to perform critical functions to assist in maintaining customer accounts, providing electronic banking services and financial reporting. Our Information Security Officer, who is a member of our Executive Management Team, is primarily responsible for managing our cybersecurity program. Our Information Security Officer has direct access to our Board of Directors and is authorized to evaluate our cybersecurity posture throughout the Company to ensure the implementation of appropriate controls over our systems and applications to maintain an effective cybersecurity program. The information security officer consults, where appropriate, with both our staff of IT professionals and, at times, outside security professionals to ensure the implementation of appropriate controls.

companyName: SR Bancorp, Inc.

ticker: SRBK


text: We have implemented a cybersecurity risk management program to protect the confidentiality, integrity and availability of our information and information technology environment. Our cybersecurity risk management program consists of an extensive range of risk assessments to identify the cyber threats to our environment along with multiple policies and procedures to mitigate the risks identified, including, but not limited to, information technology and cybersecurity standards, incident response and disaster recovery/business continuity. Employees receive regular information and cybersecurity training and reminders throughout the year.


text: Daily operations are monitored by a dedicated team of information technology professionals complemented by management's monitoring of critical information security monitoring reports along with our third-party security vendor who provides for 24x7 monitoring of our external connections and email system. Defined incident response procedures are maintained, including a requirement that our security vendor notify designated members of management when unusual or suspicious activity is identified.


text: To test and evaluate the effectiveness of our cybersecurity program, we are subject to annual audits of our program by an outside audit firm who specializes in both information technology and cybersecurity assessments. These assessments include a review of general IT controls, external penetration assessments, internal penetration assessments and security awareness testing of our staff.


text: Our vendor management program is designed to identify the risks associated with using third-party service providers to run our business. Third-party service providers that present cyber risk to our operations must meet specific criteria, such as the maintenance of appropriate controls, processes and monitoring to ensure the confidentiality, integrity and availability of data and resources prior to being onboarded. In addition to initial assessments of our critical third-party service provides, we perform regular on-going monitoring of these critical third parties' infrastructure and performance, including data security and the effectiveness of their cybersecurity risk management programs.


text: Our Board of Directors, along with our information Technology Committee, which is comprised of key senior managers, are actively involved in providing oversight of our cybersecurity program. Monthly updates are provided to our Board regarding the status of our program, including key monitoring metrics and trends noted both internally and within our industry. Our Board reviews and approves all cybersecurity-related risk assessments, polices and formalized reviews performed throughout the year.


text: Risk management and strategy Our cybersecurity program has been designed to protect our organization's sensitive information, mitigate cyber threats, and ensure our critical assets' confidentiality, integrity, and availability even as the threat landscape evolves. This is accomplished by a layered security approach through implementing security measures across various levels of our people, systems, and infrastructure with leading-edge cybersecurity tools combined with a 24/7 Security Operations Center and advanced vulnerability and incident management capabilities. Our safeguards also include employee training and awareness programs around phishing, malware, and other cybersecurity risks.

companyName: RADIUS RECYCLING, INC.


text: Cybersecurity is recognized as a top enterprise risk and the IT Risk Management ("ITRM") program is an integral component of our enterprise risk management ("ERM") program. Protection of the Company's informational assets is managed by a comprehensive, multi-layer strategy, modeled on the National Institute of Standards and Technology ("NIST") cybersecurity framework, and combines technology, services, policies, and user education to mitigate cyber risks. We have instituted Acceptable Use, Information Security, and Vendor Risk policies and procedures, which support our efforts to protect employees and contractors, while ensuring that we partner with responsible vendors who also invest in effective cybersecurity practices. Where appropriate, we engage external experts in different capacities to assist in our assessment, identification, and management of risks from cybersecurity threats. Our relationships with these external partners enable us to leverage their expertise to continually strengthen our programs and procedures.


text: Our ITRM program also includes processes to identify, assess and oversee risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.


text: In the event of a cybersecurity incident, we have an established incident response plan that requires prompt notification of the CEO and the Information Security and Privacy Executive Committee ("ISPEC"). The CEO and the ISPEC oversee the process for assessing the impacts of incidents, monitoring our mitigation and remediation efforts, and complying with any relevant laws and regulations.


text: To date, we have not identified any material risks from cybersecurity threats, including as a result of any cybersecurity incident, which have materially affected, or are reasonably likely to materially affect, us, our business strategy, our results of operations, or our financial condition. As discussed more fully under "Item 1A. Risk Factors", the sophistication of cyber threats continues to increase, and the preventative actions the Company takes to reduce the risk of cyber incidents and protect its systems and information may be insufficient. See "Item 1A. Risk Factors, One or more cybersecurity incidents may adversely impact our financial condition, results of operations, and reputation" above for more information.


text: Our Board of Directors has overall oversight responsibility for our ERM program, including oversight of cybersecurity risk management. The Board administers its risk oversight function through the full Board and its standing committees. The Audit Committee is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks and implement processes and programs to manage such risks and mitigate cybersecurity incidents. Management, including the Chief Information Officer ("CIO"), updates the Audit Committee on at least an annual basis regarding our cybersecurity programs and material cybersecurity risks and mitigation strategies. In addition, we have a standardized incident response process that establishes procedures for timely escalation and notification to the ISPEC and other members of senior management.


text: Our CIO, with oversight by the ISPEC, is responsible for managing the Company's digital infrastructure, systems, and services and ensuring the confidentiality, integrity, and availability of information stored and processed using those systems. Our CIO has more than 30 years of IT and cybersecurity experience and oversees a team of dedicated cybersecurity personnel with various experience and certifications in information security and cybersecurity.


text: Our internal compliance organization, through its involvement in the ISPEC, the Enterprise Compliance Counsel ("ECC") and Internal Audit Department, works closely with our cybersecurity team in assessing and managing our cybersecurity risk.


text: The ISPEC provides comprehensive strategic guidance, coordination, and oversight of the Company's information security and privacy programs and governance, including the Cybersecurity Program, Data Privacy Program, Information Technology Policies, and data breach and cyber incident testing, plans, and operational response. The ISPEC meets quarterly and is co-chaired by the CIO and Assistant General Counsel, Legal, Chief Privacy Officer and Deputy Chief Compliance Officer. The ECC oversees key risk areas, which include IT and Cyber. The CIO is a key risk owner for the IT and cybersecurity domain and works with the ECC to effectively mitigate compliance risk within our functional regulatory area. This council meets quarterly and is chaired by the SVP General Counsel & Chief Compliance Officer and Assistant General Counsel, Legal, Chief Privacy Officer and Deputy Chief Compliance Officer. RADIUS RECYCLING, INC.


text: Cybersecurity represents an important component of our overall approach to risk management. Our information security risk management (ISRM) policies, standards and practices are integrated into our overall enterprise risk management (ERM) approach, and cybersecurity risks are one of the business risks that are subject to oversight by our Board of Directors. Our ISRM policies, standards and practices follow industry trends, which align with frameworks established by the National Institute of Standards and Technology. We approach cybersecurity threats through a cross-functional approach which endeavors to: (i) identify, prevent and mitigate cybersecurity threats to us; (ii) preserve the confidentiality, security and availability of the information that we collect and store to use in our business; (iii) protect our intellectual property; (iv) maintain the confidence of our customers, clients and business partners; and (v) provide appropriate public disclosure of cybersecurity risks and incidents when required.

companyName: GREENBRIER COMPANIES INC

ticker: GBX


text: Risk Management and Strategy Our cybersecurity program focuses on the following areas: • Vigilance – We maintain cybersecurity threat operations with the goal of proactively identifying, preventing and mitigating cybersecurity threats and responding to cybersecurity incidents in accordance with our established cybersecurity incident response procedure plan. We recognize that the sophistication of cyber-threats will continue to evolve as threat actors increase their use of artificial intelligence technologies. • Systems Safeguards – We implement layered systems safeguards to enable the protection of our information systems from cybersecurity threats. These safeguards include network security, vulnerability management, and threat detection. • Collaboration – We utilize collaboration mechanisms established with public and private entities, including intelligence and enforcement agencies, industry groups and third-party service providers, to identify, assess and respond to cybersecurity risks. • Third-Party Risk Management – We actively manage cybersecurity risks posed by third parties and their systems that could impact our operations. We monitor and assess the security posture of our third-party vendors. We require third-party service providers with access to sensitive information to maintain cybersecurity practices aligned with industry standards and applicable laws. In addition, we proactively monitor public information regarding our vendors for security incidents, investigate potential impacts, and take appropriate action to mitigate risk. • Training – We have implemented and maintain a comprehensive cybersecurity training program to educate personnel about evolving threats and reinforce security best practices. This program includes: i. Monthly phishing awareness campaigns with mandatory remedial training for those who fail. ii. Annual security and acceptable use awareness training.


text: iii. Targeted training for high-risk groups such as finance and accounting, including phishing email response checks, to proactively mitigate threats like business email compromise.


text: • Incident Response and Recovery Planning – We have established and maintain a cybersecurity incident response procedure plan that addresses our response to cybersecurity incidents and recovery from such incidents, and such plan is tested and evaluated periodically. • Communication, Coordination and Disclosure – We utilize a cross-functional approach to address the risk from cybersecurity threats, involving management personnel from our technology, operations, legal, risk management and other key business functions, as well as the members of the Audit Committee of the Board of Directors, in an ongoing dialogue regarding cybersecurity threats and incidents, while also implementing controls and procedures for the escalation of cybersecurity incidents pursuant to established thresholds so that decisions regarding the disclosure and reporting of such incidents can be made by management in a timely manner. We have established an Incident Response Committee to quickly organize and execute an effective, productive, timely and compliance-conscious response to cybersecurity threats and incidents, as well as coordinate among the cross-functional groups. • Governance – The Board of Directors' oversight of cybersecurity risk management is supported by the Audit Committee, which regularly interacts with our experienced Chief Information Security Officer (CISO), the Incident Response Committee, which is chaired by our SVP Administration, and other members of management.


text: We manage risks from cybersecurity threats through the assessment and testing of our processes and practices focused on evaluating the effectiveness of our cybersecurity measures. We engage third parties as appropriate to perform assessments of our cybersecurity measures. The results of such assessments and reviews are reported to the Audit Committee and the Board of Directors, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by the assessments, audits and reviews. We maintain cyber risk and related insurance policies as a measure of added protection.


text: The Board of Directors, in coordination with the Audit Committee, oversees the management of risks from cybersecurity threats, including the policies, standards, processes and practices that management implements to address risks from cybersecurity threats. The Audit Committee reviews cybersecurity on a quarterly basis. The Board of Directors and the Audit Committee each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including, for example, recent developments, evolving standards, vulnerability assessments, third-party reviews, the threat environment, technological trends and information security considerations arising with respect to our peers. The Board of Directors and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding such incident until it has been addressed. On a regular basis, the Board of Directors and the Audit Committee discuss our approach to cybersecurity risk management with the CISO and other cyber team members, as well as senior leadership.


text: The CISO is principally responsible for overseeing our cybersecurity risk management program, in partnership with other business leaders across the Company. The CISO works in coordination with senior leadership, which includes our Chief Executive Officer, Chief Financial Officer, Chief Information Officer and Chief Legal & Compliance Officer. The CISO has decades of experience in the cybersecurity and information security fields, including experience with both private and public companies and the military, as well as experience in the transportation and rail industry. In addition, the CISO has ISO 27001 Certification and completed W2CCA Cyber Combat Academy.


text: The CISO, in coordination with senior leadership, works collaboratively across the Company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents. To facilitate the success of this program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents in accordance with our cybersecurity incident response procedure plan. Through the ongoing communications from these teams, the CISO and senior leadership monitor the prevention, detection, mitigation and remediation of cybersecurity incidents in real time, and report such incidents to the Audit Committee when appropriate.


text: To date, we have not experienced any risks from cybersecurity threats or incidents that have materially affected us or are reasonably likely to materially affect us, our business strategy, results of operations, or financial condition.


text: The Company recognizes the critical importance of cybersecurity in safeguarding its operations, assets, and various stakeholders and acknowledges that such risks are becoming more complex and frequent. As part of its enterprise-level risk management assessment process, the Company has implemented a cybersecurity program to identify, mitigate, and respond to risks associated with cyber threats and to protect the confidentiality, integrity and availability of Company computer systems.

companyName: LINDSAY CORP

ticker: LNN


text: The aspects of the Company's risk management approach to cybersecurity include: • Annually reviewing and updating cybersecurity policies to ensure alignment with the latest industry standards and regulatory requirements. The specific aspects of the Company's program are informed by guidelines outlined in various accepted frameworks, including the Cybersecurity Framework ("CSF") issued by the National Institute of Standards and Technology Framework ("NIST"), an agency of the United States Department of Commerce. • Maintaining a dedicated cybersecurity team under the direction of the Company's Chief Information Officer ("CIO") that has expertise related to data and network security, data governance, and risk management. • Conducting vulnerability assessments to identify and mitigate potential security risks. These assessments include network scans, penetration testing, and security audits performed by internal resources or qualified third-party providers. • Requiring all employees to participate in cybersecurity training and awareness programs including annual cybersecurity training and monthly phishing campaigns. These programs educate employees on how to recognize and respond to cyber threats and develop best practices for maintaining a strong security culture. • Monitoring information channels from trusted security information sources to stay abreast of developing cybersecurity concerns that may affect the Company or its operations. • Reviewing the security protocols of new third-party service providers to ensure acceptable levels of security are documented and maintained. • Maintaining an incident response retainer with a respected cybersecurity firm to ensure timely response and forensic capabilities.


text: Despite the Company's efforts, cyber attacks, unauthorized access, security breaches, ransomware, social engineering attacks or other cyber incidents could materially affect the Company and disrupt its business. Potential consequences of a successful cyber attack or cybersecurity incident could include remediation costs, disruption of manufacturing capabilities, legal costs, increased cybersecurity protection costs, lost revenues, litigation and legal risks including governmental or regulatory enforcement actions, increased insurance premiums, reputational damage that adversely affects customer or investor confidence, and damage to the Company's competitiveness, stock price, and long-term shareholder value. While the Company is regularly exposed to such malicious threats, none of these threats, individually or in the aggregate of related occurrences, have materially affected the Company in the period covered by this report.


text: Incident Response Procedures The Company's cybersecurity incident response plan is a critical component of the overall cybersecurity strategy. This plan outlines the procedures and actions to be taken in the event of a cybersecurity incident to minimize impact and ensure a swift recovery. Key elements of the Company's incident response plan include: • Incident discovery and confirmation: the Company has established clear protocols for identifying and reporting suspected cybersecurity incidents. Employees are trained to recognize potential incidents and report them immediately to the Company's IT security team. • Incident assessment and classification: upon receiving a report of a potential incident, the Company's IT security team conducts a thorough assessment to determine the nature and severity of the incident. Incidents are classified based on their impact and risk level. • Containment and continuity: once an incident is confirmed, the Company takes immediate steps to contain and mitigate its impact. which may involve isolating affected systems, applying security patches, or implementing other remedial actions. • Eradication and recovery: after containment, the Company works to eradicate the root cause of the incident and restore affected systems to normal operation, which includes evicting threat actors, removing malware, repairing vulnerabilities, and validating system integrity. • Communication and reporting: the Company maintains clear communication channels to keep all relevant stakeholders informed throughout the incident response process, which includes internal communication with employees and external communication with customers, regulators, and other parties as necessary. • Post-incident review and improvement: following the resolution of an incident, the Company conducts a post-incident review to identify lessons learned and areas for improvement, which helps enhance incident response capabilities and prevent future incidents.


text: As part of its oversight responsibilities as it relates to the Company's overall risk management, the Company's Board of Directors has designated cybersecurity oversight as a full board responsibility. The Board of Directors is mindful to have members with cybersecurity expertise represented on the Board of Directors. The CIO provides monthly reports to the Board of Directors regarding cybersecurity related matters and presents cybersecurity updates to the full Board of Directors at each Board meeting. The Board of Directors also participates in regular training and educational efforts to stay current on relevant cybersecurity related topics.


text: The Company's CIO reports directly to the Company's CEO and is responsible for managing, designing, and implementing all aspects of the Company's day-to-day cybersecurity programs and initiatives. The CIO and the dedicated cybersecurity team have appropriate levels of expertise, certifications, and previous work experience to effectively develop and oversee the Company's cybersecurity efforts.


text: We have established security practices and safeguards designed to help identify and protect against intentional and unintentional misappropriation or corruption of our information technology systems, data, and operational continuity. We conduct risk assessments to identify potential cybersecurity threats, which include evaluating the likelihood and potential impact of these threats, identifying system and network vulnerabilities, and assessing the effectiveness of our existing controls. Upon identification and assessment of risks, we develop and implement what management believes to be appropriate measures in order to manage these risks, which may involve enhancing security controls, implementing new technologies, training employees, or changing business processes. We maintain change management processes, monitoring practices, and data protection measures designed to mitigate cybersecurity risks and regularly review our systems for potential threats. Such processes and practices to assess, identify, and manage cybersecurity incidents are integrated into our overall risk management processes.

companyName: S&W Seed Co

ticker: SANW


text: Our Chief Financial Officer, also acting as our Compliance Officer, is primarily responsible for assessing and managing our strategic risk exposures, including material risks from cybersecurity threats, with assistance from our IT staff, who oversee our cybersecurity processes on a day-to-day basis. Our Board is responsible for the oversight of management's efforts to address cybersecurity risks. Management updates the Board on an ongoing basis concerning any significant cybersecurity incidents or risk exposures that have come to management's attention during the conduct of their assessments, the steps management has taken to mitigate such exposures, and any changes to the processes of identifying, assessing, and monitoring cybersecurity threats.


text: For the fiscal year ended June 30, 2024, we did not identify any cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition.


text: Risk Management and Strategy Our cybersecurity program is designed to monitor and control cybersecurity risk exposure, response, mitigation and protect the confidentiality and integrity of our critical systems and information. Our cybersecurity policies and processes are fully integrated into the Company's Enterprise Risk Management program. Our cybersecurity program is based on industry recognized best practices, including the ISO 27001 Information Security, Cybersecurity and Privacy protection international best practice standard.

companyName: KURA SUSHI USA, INC.

ticker: KRUS


text: Our cybersecurity risk management program includes: • Ongoing risk assessments to help identify material cybersecurity risks to our critical systems and information by performing regular scans of our environment, assessing incident trends and engaging third parties to assess the effectiveness of our cybersecurity practices; • The use of external service providers, where appropriate, to monitor, identify, assess, test and remediate, or otherwise assist with aspects of our security controls; • Mandatory cybersecurity awareness training for employees and simulated phishing attacks; • A disaster recovery and business-continuity plan and controls designed to protect against business interruption, including the backing up of our critical systems; • A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents, internal reporting to management and the board of directors; • Cybersecurity insurance which is assessed annually; and • Risk management process for service providers, suppliers, and vendors.


text: Cybersecurity risks are monitored on an ongoing basis, and the security program and practices are adjusted as necessary. We are not currently aware of risks from known cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Cybersecurity Governance Our board of directors considers cybersecurity risk as part of its risk oversight function and oversees management's implementation of our cybersecurity risk management program, including the steps taken to monitor, minimize or control such risks or exposures.


text: The board of directors receives quarterly reports from management regarding the status of the cybersecurity program, current activities and planned projects. In addition, management will update the board of directors, as necessary, regarding any significant cybersecurity incidents that we may experience.


text: Our management team is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our external cybersecurity consultants. Our management team's cybersecurity risk management is led by our Vice President of IT, who has over 20 years of experience in both restaurant and technology sectors and has held technology leadership roles at major national restaurant companies.


text: Additional information on cybersecurity risks is discussed in Part I, Item 1A, "Risk Factors," under the heading "We rely significantly on information technology and cybersecurity, and any material failure, weakness, interruption or breach of security could prevent us from effectively operating our business."


text: Risk Management and Strategy We recognize the critical importance of effective cyber risk management and response strategies in today's digital landscape. As part of our comprehensive risk management framework, we have developed a cyber crisis and data breach response plan for identifying, assessing, and managing material risks arising from cybersecurity incidents, including those arising from third-party service providers. These engagements include routine audits, threat assessments, and consultations aimed at enhancing our security measures. We have incorporated cybersecurity risk management within our comprehensive risk management framework to cultivate responsiveness and a corporate culture that prioritizes cybersecurity risk management. Our cyber risk management team works closely with stakeholders across corporate functions to consistently assess and mitigate cybersecurity risks, aligning with our business goals and operational requirements.

companyName: BrightView Holdings, Inc.

ticker: BV


text: We utilize a range of external experts, including cybersecurity consultants to assist in evaluating and testing our risk management systems, particularly where advanced or specialized expertise may be required.


text: We acknowledge that there are risks associated with third-party service providers that have access to our systems and data, we have implemented processes to oversee and manage these risks. We oversee and identify material risks from cybersecurity threats associated with the use of third-party service providers by reviewing service organization controls reports for key outsourced systems. We also conduct security assessments of certain third-party providers before engagement and monitor such providers to confirm compliance with industry accepted cybersecurity standards and practices. This approach is designed to reduce risks related to data breaches, operational disruptions, or other security incidents originating from third-parties.


text: We are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. However, because of the inherent nature of cybersecurity threats and the evolution of such threats over time, the Company's processes, oversight and risk management cannot provide absolute assurance that a cybersecurity threat will not have a material effect on the Company in the future.


text: Cybersecurity governance is a priority for both our Board of Directors and management. The Board has delegated primary oversight of cybersecurity risks to the Audit Committee. The Audit Committee monitors the cybersecurity risk management and cyber control functions, including external security audits. The Audit committee receives periodic updates from experienced senior management of the Company's cyber risk management team knowledgeable about assessing and managing cyber risks, including, as appropriate, updates on the prevention, detection, mitigation, and remediation of cyber incidents.


text: The Company's Chief Information Officer has been serving in this role for the Company since 2013 and has over 30 years of experience in various information security and related technology roles. The Chief Information Officer oversees the information technology and information security functions of the Company which includes our cyber risk management team.


text: The Chief Legal Officer acts as the Company's Data Breach Coordinator and leads our Cyber Crisis and Data Breach Response Committee (the "Committee") which consists of the Company's Chief Information Officer, Chief Financial Officer and Chief Accounting Officer. Cybersecurity incidents that may significantly impact the confidentiality, integrity, or availability of the Company's data or the reliability of the Company's systems or networks are reported to the Committee. The Committee assesses the materiality of each incident, which is made using both quantitative and qualitative analyses to determine an incident's immediate and reasonably likely future impacts. Such cybersecurity incidents are also reported to the Audit Committee. The Company's Data Governance Committee has oversight of that how the Company's data is handled and shared with third parties and is comprised of the Company's Chief Information Officer, Chief Legal Officer, Chief Human Resources, Chief Accounting Officer, Senior Vice President of Business Shared Services and Chief Audit Executive.


text: The Company has a cybersecurity training program that requires all employees with access to the Company's networks to participate in regular and mandatory training on how to be aware of, and help defend against, cybersecurity risks. Also, the Company regularly tests the efficacy of its training efforts as well as its systems to assess vulnerabilities to cybersecurity risks, including tabletop incident response exercises.


text: Annually we conduct an Enterprise Risk Assessment during which we identify and quantify risks, including cybersecurity risks, which could enhance or impede the Company's ability to achieve current or future strategic objectives. The conclusions of the annual Enterprise Risk Assessment are shared with the Audit Committee.


text: We are a special purpose acquisition company with no business operations. Since the IPO Closing Date, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not believe that we currently face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if any. We have not encountered any cybersecurity incidents since the IPO Closing Date.

companyName: Gores Holdings IX, Inc.


text: Management of material risks from cybersecurity threats is integrated into the Company's overall risk management processes and is monitored as an enterprise risk. The Company's Board of Directors (the "Board"), with the input of management, oversees the Company's internal controls and processes, including internal controls designed to assess, identify, and manage material risks from cybersecurity threats.

companyName: MARINEMAX INC

ticker: HZO


text: Our comprehensive cybersecurity program includes, but is not limited to, standards and procedures for vulnerability management, user training, security assessments and testing, business continuity planning, encryption of sensitive data, physical security, user access controls, vendor risk management, teleworking, user device management and proactive systems, data and activity monitoring, and incident response. A limited scope of third-party service providers are involved in supporting our business and, where appropriate, we have established standards and procedures to ensure commercial best practices, audit, risk management, and strict contractual controls are in place and followed. Comprehensive contingency, recovery, and continuity plans are in place to ensure the ongoing provision of services to customers in the event of a cybersecurity incident.


text: Our Executive Vice President and Chief Digital Officer, (the "CDO"), Shawn C. Berg, is responsible for managing the Company's cybersecurity risk and cybersecurity program. Shawn Berg has served as Chief Digital Officer since April 2019 overseeing the Company's Technology, Marketing, and Digital Business operations. Mr. Berg was appointed as an executive officer of MarineMax by our Board in October 2022. Previously he served as Vice President of Technology after joining MarineMax in 2017. Mr. Berg has over 30 years of experience, including multiple officer-level positions, of invaluable experience in information technology and security.


text: Our Technology Group monitors material risks over time and updates the Company's mitigation measures as appropriate. The Technology Group also regularly reports to the CDO and other key executives, as identified in the incident response plan, on the status of material risks, mitigation measures, and incidents related to such risks.


text: The CDO provides the Board with ongoing security updates, which include notable changes to program plans, changes to the risk environment, information regarding material incidents that may have occurred, reports on recent assessments of our security controls, and details regarding forward-looking plans and strategies to mitigate cyber risk.


text: The Company has been subject to cybersecurity threats in the past, including the Incident. We believe the impacts of the Incident were not material to MarineMax's financial condition or results of operations. In addition, as of the date of this report, the Company is not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.


text: Notwithstanding our vigilant cybersecurity measures, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. For further discussion of the risks associated with cybersecurity incidents, see the cybersecurity risk factor in Item 1A. Risk Factor in this report, titled "Increased cybersecurity requirements, threats and more sophisticated and targeted computer crime could pose a risk to our systems, networks, data and our third-party service providers. Our business operations could be negatively impacted by an outage or breach of our informational technology systems or a cybersecurity event".


text: Cybersecurity Risk Management and Strategy Our cybersecurity risk management strategy is designed to detect, evaluate, and manage risks from cybersecurity threats and incidents. Our program is intended to identify cybersecurity risks facing our organization and inform our risk-based approach to cybersecurity preparedness and incident response procedures.

companyName: UNIFIRST CORP

ticker: UNF


text: Our cybersecurity risk management program is supported by our third-party vendors and service providers, and includes, but is not limited to, periodic penetration testing and endpoint detection, and automated tools to monitor our network and systems to detect vulnerabilities or unusual activity that could lead to unauthorized access to our systems or data. We conduct assessments, as appropriate, of critical third-party service providers, which generally include a cybersecurity questionnaire and a review of security assessments and certifications. We also provide cybersecurity awareness training to employees with access to our network.


text: We also have a policy for responding to and mitigating cybersecurity incidents. Our incident response procedures were overseen until recently by our Chief Information Officer ("CIO"). In connection with the upcoming retirement of our CIO, we recently hired a new Chief Information & Technology Officer ("CITO") who oversees our incident response procedures. Our incident response procedures are reviewed and updated periodically.


text: We have not identified cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, like other companies in our industry, we and our third-party vendors have from time to time experienced threats that could affect our information or systems. For more information, please see the Risk Factor titled "If our information technology systems suffer interruptions or failures, including as a result of cyber-attacks, our business operations could be disrupted or other material adverse impacts on our business could result."


text: Cybersecurity Governance Our CITO, who reports to our Chief Financial Officer, is responsible for leading our information security team and overseeing the Company's cybersecurity risk management efforts. Our CITO has significant experience as a chief technology officer.


text: Our cybersecurity risk management program is overseen by our Board of Directors. As was the case with our CIO, members of the Board of Directors and the Audit Committee will periodically meet with our CITO to discuss material cybersecurity risks facing our organization and significant changes or updates to our cybersecurity processes. The full Board of Directors receives a cybersecurity risk management update from management generally on a quarterly basis.


text: Risk Management Strategies Our Company is committed to protecting the privacy and security of customer information and the integrity of our information technology systems. We have developed and implemented a cybersecurity risk management program ("Cybersecurity Program") that is tailored to address specific risks in the retail industry, using a flexible approach informed by our deep understanding of attacker methodologies, targeted assets, and industry best practices. The Cybersecurity Program is intended to protect the confidentiality, availability, and integrity of our information and critical systems by continually monitoring, assessing, identifying, and mitigating cybersecurity risks. The Cybersecurity Program is part of our integrated risk management process and includes, but is not limited to, the following features: • Regularly simulated phishing attacks and comprehensive cybersecurity training for all employees, with special focus on high-risk individuals using a new security awareness platform. • Cybersecurity insurance coverage to mitigate financial impacts from potential cyber incidents. • Endpoint detection and response technologies (EDR) to monitor systems continuously for malicious activity. • Behavior analytics tools that help track normal behavior patterns and quickly detect any anomalies. • Cloud security measures, offering comprehensive protection and vulnerability management for our cloud environments. • Digital risk protection that includes brand protection, social media monitoring, dark web surveillance, and proactive response to phishing, fraud, and account takeovers. • Zero-day vulnerability management, with third-party monitoring to prioritize critical vulnerabilities based on real-time risk assessments and active exploitation. • Comprehensive vendor risk management program, including penetration tests, Service Organization Control ("SOC") reports, and security architecture reviews, especially for third parties managing sensitive data or accessing internal systems.

companyName: Sally Beauty Holdings, Inc.

ticker: SBH


text: In addition, we have a written cybersecurity incident response plan ("Response Plan") that is reviewed and updated, if necessary, at least annually. The Response Plan includes a cross-functional incident response team comprised of various key executive representatives from different departments in our organization, such as our Chief Information Security Officer ("CISO") and General Counsel, that are tasked with assessing the scope, nature, and potential impact of incidents. Findings are reported to the Chief Executive Officer ("CEO"), Chief Financial Officer ("CFO"), our Board and the Disclosure Committee, the latter of which is comprised of senior representatives from our finance, accounting, internal audit and legal departments under the supervision of the CEO and CFO.


text: We also regularly engage third parties to perform assessments on the Cybersecurity Program, including an annual self-assessed risk review facilitated by an independent third party, where we evaluate various cybersecurity domains and control areas and benchmark our program against industry peers. Additionally, we conduct annual third-party penetration tests focused on our highest-risk areas globally, providing insights into potential vulnerabilities. These assessments are supplemented by red team exercises and real-world incident response simulations to continually improve our security posture.


text: From time to time, we experience cybersecurity threats and incidents. As of the date of this Annual Report, we have not identified any instances that have occurred in the current year, or in prior years, that would have a material impact on our Company or on our results of operation, or financial position. For more information related to our cybersecurity risks, see Item 1A. "Risk Factors–Regulatory, Legal and Cybersecurity Risks" within this annual report.


text: Our Board understands the critical importance of managing evolving risks associated with cybersecurity threats. The Board has responsibility for overseeing risks related to the cybersecurity threat landscape, including data protection and security breach readiness. Our CISO reports directly to the Chief Information Officer and is responsible for the operation of our Cybersecurity Program. Our CISO brings over 26 years of experience in information security, including the last 12 years as a Chief Information Security Officer in the retail industry. With a diverse background in both industry and consulting, our CISO has led major security programs, implementing practical strategies to protect critical data and systems.