text: BlackRock ' s Enterprise Risk Management Framework BlackRock recognizes the importance of identifying, assessing, and managing material risks associated with cybersecurity threats. Cybersecurity represents an important component of BlackRock's approach to ERM. BlackRock leverages a multi-lines-of-defense model with cybersecurity operational processes executed by global information security and other teams and dedicated internal audit technology and technology risk management ("TRM") teams that independently review technology risks. BlackRock's cybersecurity program is fully integrated into its ERM framework and is aligned with recognized frameworks, including NIST CSF, FFIEC CAT, FedRAMP, SOC 1/2, ISO 27001/2 and others. BlackRock aims to inform and continuously improve its cybersecurity program through engagement with regulatory, client, insurer, vendor, partner, peer, government and industry organizations and associations, as well as external audit, technology risk, information security and other assessments.


text: BlackRock seeks to address cybersecurity risks through a global, multilayered strategy of control programs that is designed to preserve the confidentiality, integrity and availability of the information that BlackRock collects and stores by identifying, preventing and mitigating cybersecurity threats and incidents. As one of the critical elements of BlackRock's overall ERM framework, BlackRock's cybersecurity program is focused on the following key areas:

companyName: ISHARES GOLD TRUST

ticker: IAU

secItem: Item 1C


text: Governance: As discussed in more detail under the heading "BlackRock's Cybersecurity Governance" below, the oversight by BlackRock's board of directors ("BlackRock's Board") of cybersecurity risk management is supported by BlackRock's Risk Committee, which regularly interacts with BlackRock's risk management function, BlackRock's Chief Risk Officer ("CRO") and Chief Information Security Officer ("CISO"), along with other members of management. In addition, technology and cybersecurity risks are formally overseen by a dedicated management risk governance committee, the Technology Risk and Cybersecurity Committee ("TRCC"), which is a sub-committee of the firmwide Enterprise Risk Committee ("ERC").


text: Cross-Functional Approach: BlackRock has implemented a global, cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and incidents, while also implementing layered preventative, detective, reactive and recovery controls to identify and manage cybersecurity risks.


text: Safeguards: BlackRock deploys a range of people, process and technical controls that are designed to protect BlackRock's information systems from cybersecurity threats, which may include, among others: physical security controls perimeter controls, including technical assessments, firewalls, network segregation, intrusion detection and prevention tabletop exercises, ongoing vulnerability and patch management vendor due diligence multi-factor authentication device encryption application security, code testing and penetration testing endpoint security, including anti malware protection, threat intel and response, managed detection and response, security configuration management, portable storage device lockdown, restricted administrative privileges employee awareness, training, and phishing testing data loss prevention program and monitoring information security incident reporting and monitoring and layered and comprehensive access controls.


text: Incident Response and Recovery Planning: BlackRock has established and maintains incident response and recovery plans that address BlackRock's response to a cybersecurity incident, including processes designed to assess, escalate, contain, investigate and remediate the incident, as well as to comply with applicable legal obligations and mitigate potential reputational damage. Such plans are evaluated on a periodic basis.


text: Third-Party Risk Management: BlackRock maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers, counterparties and clients, as well as the systems of third parties that could significantly and adversely impact BlackRock's business in the event of a cybersecurity incident affecting those third-party systems. Third-party risks are included within BlackRock's ERM framework, and risk identification and mitigation are supported by BlackRock's cybersecurity program. BlackRock also performs diligence on certain third parties and monitors cybersecurity threats and risks identified through such diligence.


text: Education and Awareness: BlackRock's employees and contractors are required to complete an annual information security training to equip them with effective tools to address cybersecurity threats, and to receive communications on BlackRock's evolving information security policies and procedures.


text: BlackRock's global information security team, in collaboration with the technology risk and internal audit teams, engages in the periodic assessment and testing of BlackRock's cyber risks and cybersecurity program. These efforts may include a wide range of activities, including audits, assessments, wargames and "tabletop" exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. BlackRock also participates in financial services industry and government forums in an effort to improve both internal and sector cybersecurity defense. BlackRock regularly engages third parties and advisors to assess its cybersecurity control environment. The results of certain program and control assessments are reported to BlackRock's Risk Committee, and BlackRock adjusts its cybersecurity program as appropriate based on the information provided by these assessments.


text: As of December 31, 2024, cybersecurity risks have not materially affected BlackRock's business strategy, results of operations or financial condition.


text: BlackRock ' s Cybersecurity Governance BlackRock's Board is actively engaged in the oversight of BlackRock's risk management program. BlackRock's Risk Committee assists BlackRock's Board with its oversight of BlackRock's levels of risk, risk assessment, risk management and related policies and processes, including risks arising from cybersecurity threats. BlackRock's Risk Committee receives regular reports on BlackRock's cybersecurity program, technology resilience risk management and related developments from members of our information security team, including the CISO. BlackRock's Board and BlackRock's Risk Committee also receive information regarding cybersecurity incidents that meet certain reporting thresholds. On an annual basis, senior members of BlackRock's technology, risk and information security teams provide a comprehensive overview of BlackRock's cyber risk and related programs to a joint session of BlackRock's Board's Risk and Audit Committees.


text: Technology and cybersecurity risks at BlackRock are also overseen by the TRCC, a dedicated management risk governance committee and sub committee of the firmwide ERC. The chair of the TRCC is appointed by the head of Enterprise Risk Management at BlackRock and its members include the CISO as well as a broad range of senior business stakeholders across BlackRock. The TRCC is responsible for oversight of BlackRock's technology and cybersecurity risk management practices and helps ensure that technology and cybersecurity risks remain within firmwide risk tolerances and technology and cybersecurity risk issues are escalated as appropriate to the ERC and other committees. The TRCC also reviews any relevant technology and cybersecurity risk related issues and helps ensure that they are appropriately escalated, reported, and remediated.


text: BlackRock's cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by BlackRock's CISO. As of December 31, 2024, the CISO had over 30 years of experience in information technology with a 25-year concentration in information security, including previously serving as the CISO at several global financial institutions, and held the Certified Information Systems Security Professional certification. The CISO works closely with the leadership team and other subject matter experts in the global cybersecurity group, who collectively have extensive prior work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs and overseeing cybersecurity controls in technology risk and audit functions, as well as having relevant degrees and industry-leading certifications.


text: The CISO and members of the TRCC monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management processes described above, including the operation of BlackRock's incident response plan.


text: Cybersecurity Risk Management and Strategy The Trust does not have any officers, directors or employees. The Sponsor, a subsidiary of BlackRock, is responsible for the oversight and overall management of the Trust. The Sponsor relies on BlackRock's ERM framework for the Trust's cybersecurity risk management and strategy. Key aspects of the ERM framework are summarized below. The board of directors of the Sponsor (the "Board of Directors") periodically receives reports from BlackRock regarding BlackRock's cybersecurity program.

companyName: iShares Gold Trust Micro

ticker: IAUM


text: As of December 31, 2024, cybersecurity risks have not materially affected the Trust's objective, results of operations or financial condition.


companyName: iShares Silver Trust

ticker: SLV


companyName: iShares S&P GSCI Commodity-Indexed Trust

ticker: GSG


text: Safeguards: BlackRock deploys a range of people, process and technical controls that are designed to protect BlackRock's information systems from cybersecurity threats, which may include, among others: physical security controls perimeter controls, including technical assessments, firewalls, network segregation, intrusion detection and prevention tabletop exercises, ongoing vulnerability and patch management vendor due diligence multi factor authentication device encryption application security, code testing and penetration testing endpoint security, including anti malware protection, threat intel and response, managed detection and response, security configuration management, portable storage device lockdown, restricted administrative privileges employee awareness, training, and phishing testing data loss prevention program and monitoring information security incident reporting and monitoring and layered and comprehensive access controls.


text: The Company's management and Board recognize the importance of strong oversight of cybersecurity risk, information security and technology in maintaining the trust and confidence of our customers, partners, employees and stockholders. Our processes for assessing, identifying and managing material risks from cybersecurity threats is incorporated into our Enterprise Risk Management (ERM) program in a similar fashion to other legal, compliance, operational, and financial risk areas. The Company maintains cybersecurity measures aligned with the National Institute of Standards and Technology Cybersecurity Framework (Framework) which organizes cybersecurity risks into six categories: identify, protect, detect, respond, recover and govern, and looks to other standards as well to help identify, assess, and manage cybersecurity risks relevant to our business.

companyName: GENERAC HOLDINGS INC.

ticker: GNRC


text: Our Chief Information Officer (CIO) oversees our information systems and cybersecurity function and reports to our Chief Executive Officer (CEO). He has over 20 years of experience in leading information systems management, strategy, and operational execution, including incident prevention, management, and response. Our Company's Chief Information Security Officer (CISO) is responsible for developing and implementing our information security program and reports to our CIO. The CISO has over 25 years of experience supporting cybersecurity and information technology. They are supported by a direct and cross-functional team of professionals with expertise and experience in threat assessment and detection, mitigation strategies, incident response, training, and regulatory compliance.


text: In addition, we have established a Cybersecurity Steering Committee comprised of members of executive leadership. The Steering Committee, in which our CIO and CISO participate, meets regularly and has established Company-wide policies and standards concerning cybersecurity matters. These policies cover areas such as malware protection, remote access, multifactor authentication, containment of confidential information and the use of the internet, email and wireless devices. We have an established incident response plan led by our CIO and CISO and depending on the nature and severity of the incident, requires escalating notifications up to our CEO and Board.


text: Our Board oversees our enterprise risk management activities. The Board receives periodic updates on our cybersecurity risk management program as well as regular updates and education on relevant legislation and trends related to cybersecurity. Our Audit Committee assists the Board in its oversight role and receives regular reports from management on the Company's information systems and cybersecurity program. Several members of our Board's Audit Committee have expertise and experience in cybersecurity, and one director is the President of a major cybersecurity services provider.


text: The CISO and information technology security team conduct regular risk assessments to assess the overall technology infrastructure and related business processes, identify and address potential security gaps and vulnerabilities, and identify areas requiring additional focus. These risk assessments extend to our supply chain, where cybersecurity health assessments are employed for our critical suppliers. The results are used to calculate a Cybersecurity Risk Score, a key component of our Supply Chain Scorecard used to proactively identify and manage potential risks. Additionally, we require certain third parties that could introduce significant cybersecurity risk to us to agree by contract to manage their cybersecurity risks in specified ways, as appropriate. Risk assessments are also performed on new products and software as part of our new product development process.


text: As part of our risk assessments, we engage third-party services for network penetration testing and security evaluations, conduct annual incident response table-top exercises, and perform regular testing of controls related to our financial information systems by our Internal Audit function.


text: In order to promote a culture of security awareness across our organization, all employees are required to complete an annual cybersecurity awareness training and are provided with periodic information updates on cybersecurity threats. We also maintain cyber insurance policies to help partially mitigate the financial impact of a significant cybersecurity incident.


text: Despite our best efforts, we cannot guarantee that our security measures will prevent all potential cybersecurity incidents or breaches. Our systems are continually subject to sophisticated and evolving cyber threats, such as phishing, ransomware, social engineering, and advanced persistent threats. However, to date, we have not been subject to any incidents or successful cyber-attacks that have materially impacted our operations or financial condition. The Company has invested in developing and acquiring cybersecurity capabilities allowing us to monitor threats and manage incident response. We have also developed internal policies to mitigate cybersecurity incidents, including providing clear guidelines for incident classification, escalation, and response. We recognize the importance of continued monitoring and improvement of our cybersecurity program, and will continue to evolve our security controls, incident response capabilities, and third-party vendor management protocols.


text: For additional information on the cybersecurity risks that we face, also see Item 1A. "Risk Factors" of this Annual Report on Form 10-K.


text: We rely on information technology systems across our operations, including for management, supply chain and financial information and various other processes and transactions. Our ability to effectively manage our business depends on the security, reliability and capacity of these systems. We have established a range of security measures that are designed to protect against the unauthorized access to and misappropriation of our information, corruption of data, intentional or unintentional disclosure of confidential information, or disruption of operations. We have implemented additional controls, security processes and monitoring of our manufacturing systems. We have also implemented additional cloud security tools and governance processes for assessing, identifying and managing material risks from cybersecurity threats. In addition, we maintain an information security training program that encompasses the following areas: phishing and email security, password security, data handling security, cloud security, operational technology security processes, and cyber-incident response and reporting processes.

companyName: SHYFT GROUP, INC.


text: The oversight of our cybersecurity risk management process is integrated into our overall risk management process. Through our enterprise risk management process, which involves a broad cross-functional group across many areas of expertise and is structurally independent of our business lines, we identify and assess risk and risk-mitigation actions, including with respect to cybersecurity risks. Our Chief Information Officer ("CIO") provides oversight of our cybersecurity risk, which is addressed by a group of stakeholders that includes our information technology ("IT") and cybersecurity leadership and IT leaders within our various facilities, with cybersecurity risk input provided from this team to our senior leadership team on a regular basis. Our CIO provides key updates on risk and mitigation strategies to the Audit Committee.


text: We rely on third-party service providers to execute certain business processes, maintain certain information systems and infrastructure, evaluate defenses, and implement recommendations. We periodically have external information security assessments performed by third parties to analyze our internal assessment results and to stay informed of information security risks. Additionally, we maintain a supplier validation process, which involves approval by our cybersecurity group for significant suppliers that will have access to any of our databases or technology. We also maintain processes to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers.


text: While we have experienced cybersecurity incidents in the past, as of the date of this filing, we do not believe that any risks from cybersecurity threats, including as a result of past cybersecurity incidents have had, or are reasonably likely to have, a material effect on the Company, including our business strategy, results of operations or financial position. We continue to invest in the cybersecurity and resiliency of our networks and to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain. For more information regarding the risks we face from cybersecurity threats, please see "Risk Factors-- More General Risks Applicable to Our Industry."


text: The Board of Directors is responsible for overseeing risk for the Company and has delegated to the Audit Committee responsibility for overseeing the cybersecurity risk management strategy for the Company. The Audit Committee reviews how we are executing against our comprehensive cybersecurity framework, including reviewing our cybersecurity reporting protocol. The Audit Committee receives regular updates on cybersecurity risks from our CIO. The Audit Committee also regularly receives updates on efforts regarding data loss prevention, regulatory compliance, data privacy, threat and vulnerability management, cyber-crisis management, and other topics as applicable. Additionally, management provides the Audit Committee with a cybersecurity dashboard, which the full Board of Directors can access as well.


text: The Company's cybersecurity program is overseen by our CIO, who is responsible for assessing and managing material risks from cybersecurity threats, including monitoring the prevention, detection, mitigation and remediation of cybersecurity incidents. Our CIO has over 20 years of global automotive technology and cybersecurity experience and reports to our President and Chief Executive Officer.


text: The Company's Security Manager reports to our CIO and is the head of our cybersecurity team. The Security Manager is responsible for assessing and managing our cyber risk management program, informs senior management, together with the CIO, regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervises such efforts. Our Security Manager has over 15 years of experience in technology and cybersecurity, a master's degree in information security and industry certifications, including CISSP, CDPSE, ITIL, and COBIT.


text: Dana maintains a risk management program overseen by our Executive Leadership Team. Our Senior Vice President and Chief Financial Officer and Senior Vice President, General Counsel and Secretary / Chief Compliance and Sustainability Officer (General Counsel) have responsibility for our risk management program. In addition, our Business Unit Presidents and functional leads oversee strategic and operational risks, including cybersecurity risks. Cybersecurity is a top priority, and our cybersecurity program is driven by our commitment to maintaining a strong security architecture, active governance, and robust controls. Our cybersecurity program is led by our Director of Cybersecurity and GRC (DOC) and overseen by Dana's Enterprise Cybersecurity Steering Committee (ECSC). The ECSC is sponsored by senior leaders from disciplines such as Information Technology, Legal, Human Resources, Engineering, Product Development, and Operations, and includes the Senior Vice President and Chief Information Officer (CIO); General Counsel; Senior Vice President and Chief Human Resources Officer; Senior Vice President and Chief Technology Officer; and Senior Vice President Global Operations. The ECSC is responsible for developing and overseeing strategies related to Dana's cybersecurity program. As set forth in its charter, our Technology & Sustainability Committee, comprised of independent directors, has oversight responsibilities for cybersecurity risk and includes members with significant cybersecurity experience. The DOC and CIO regularly provide updates on Dana's cybersecurity program to the Board and the Technology & Sustainability Committee.

companyName: DANA Inc

ticker: DAN


text: Dana's global cybersecurity team is charged with executing enterprise, product, and manufacturing cybersecurity programs and policies with a focus on security architecture, penetration testing, cyber risk management, incident response, vulnerability management, intelligence, awareness and training, and governance. Dana's cybersecurity programs utilize the National Institute of Standards and Technology (NIST) Cybersecurity Framework and leverage the International Organization for Standardization (ISO) 27001 standard for information security. Dana periodically contracts with external auditing firms to assess the maturity of Dana's cybersecurity program against the NIST Cybersecurity Framework. The results of these audits are shared with the Technology & Sustainability Committee. Dana leverages independent security ratings services assessments to aid in measuring our progress along the cybersecurity continuum as well as for measurement against peer companies. Dana's supplier risk management process incorporates cybersecurity review and assessment procedures over third-party vendors and service providers.


text: Dana has an established cybersecurity awareness training program. Formal training on topics relating to cybersecurity is mandatory at least annually for all employees with access to the Company's network. Training is administered and tracked through online learning modules. Training topics include how to escalate suspicious activities including phishing, viruses, spams, insider threats, suspect human behaviors or safety issues. Training is supplemented by phishing awareness campaigns.


text: In the event a high-risk cybersecurity incident is identified, our Incident Response Team will coordinate the response in accordance with our Information Security Incident Response Plan and make necessary communications to the ECSC and executive leadership. The DOC and CIO will make any required communications to the Chief Executive Officer (CEO), with the CEO making any required communications to the Board and Technology & Sustainability Committee. Our CEO, Chief Financial Officer, General Counsel and CIO are responsible for assessing such incidents for materiality, ensuring that any required notification or communication occurs and determining, among other things, whether any prohibition on the trading of our common stock by insiders should be imposed prior to the disclosure of information about a material cybersecurity event.


text: In the last three years we have not experienced any cybersecurity incident that has been material to the results of our operations or that has caused us to incur any material expenses.


text: We and our operators increasingly rely on information technology systems to operate our respective businesses, and the oil and natural gas industry depends on digital technologies in exploration, development, production, and processing activities. We depend on digital technology in many areas of our business and operations, including, but not limited to, estimating quantities of oil and natural gas reserves, processing and recording financial and operating data, oversight and analysis of drilling, completion and production operations and communications with the employees of the Operating Partnership and third party customers and services providers. We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational risks, gathering, misuse, loss or destruction of proprietary and other information, fraud, extortion, harm to employees or customers, violation of data privacy or security laws and disruption of other business activities.

companyName: DORCHESTER MINERALS, L.P.

ticker: DMLP


text: We maintain a comprehensive process for identifying, assessing, and managing material risks from cybersecurity threats as part of our broader risk management process. Our executive officers, along with input from our outsourced IT managed services provider, other external experts, and department managers, are responsible for our overall enterprise risk assessment and management process and regularly consider cybersecurity risks in the context of other material risks to the Partnership. We obtain input on the security industry and threat trends for our cybersecurity risk management processes from external experts, as appropriate. Our outsourced IT managed services provider has expertise in areas including, but not limited to, information technology and infrastructure, network and communications architecture, information systems and database management, back up management, and cybersecurity.


text: Our risk management process also assesses third party risks. We perform assessments to identify and mitigate risks from third parties such as vendors and other business partners associated with our use of third party service providers. Cybersecurity risks are evaluated when determining the selection and oversight of applicable third party service providers and potential fourth party risks when handling and/or processing employee, business, or customer data.


text: To protect our information systems from cybersecurity threats, we, among other things: (i) conduct regular reviews of information systems security programs and policies, (ii) perform penetration testing using external third party tools and techniques to test security controls, (iii) provide employee training, (iv) monitor emerging trends, laws, and regulations related to data protection and information security, and (v) use various security tools that help monitor, prevent, identify, escalate, investigate, resolve, and recover from identified vulnerabilities and security incidents in a timely manner, including, but not limited to, monitoring and detection tools managed by external experts and internal reporting.


text: We, in coordination with external experts, have implemented a cyber and data security incident response plan that has four overarching and interconnected stages: 1) preparation for a cybersecurity incident, 2) identification, analysis, and notification of a security incident by external experts, as applicable, 3) containment, eradication, and recovery, and 4) post-incident analysis and learnings for future preparedness. Such incident responses are managed by our outsourced IT managed services provider, Chief Financial Officer ("CFO"), and department managers, who, together, comprise our primary incident response team. As part of our cybersecurity risk management process, our incident response team logs and tracks privacy and security incidents across the Partnership, vendors, third party service providers, and other business partners. Cyber and data security incidents are evaluated to determine materiality, as well as operational, business, and privacy impact, ranked by severity, and prioritized for response and remediation. Significant incidents are evaluated by the primary incident response team to determine whether further escalation is appropriate, and any incident assessed as potentially being or potentially becoming material is immediately escalated for further assessment and reported to the Chief Executive Officer ("CEO"). We consult with outside counsel and other subject matter experts regarding materiality analysis, disclosure, and other compliance matters, as appropriate, and our executive officers, with input from the Board of Managers, as appropriate, make the final materiality determinations and disclosure and other compliance decisions. Our management apprises the Partnership's independent public accounting firm of matters and any relevant developments.


text: The Advisory Committee of the Board of Managers of the general partner of our General Partner has oversight responsibility for risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements, cooperation with law enforcement, and related effects on financial and other risks, and it reports any findings and recommendations, as appropriate, to the full Board of Managers for consideration. Reports are periodically provided to the Advisory Committee during our board meetings by the individuals who oversee risk management in cybersecurity. This includes existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any), and status on key information security initiatives. Members of the Board of Managers also engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.


text: As of the date of this filing, our business strategy, results of operations, and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, see "Item 1A – Risk Factors".


text: Our Vice President of Strategic Initiatives and Chief Financial Officer oversee our cybersecurity risk management program described in "Risk Management and Strategy" below. While the Board of Directors has overall responsibility for risk oversight, it is supported in this regard by the Audit Committee, including with respect to cybersecurity matters. The Audit Committee assists the Board of Directors in monitoring cybersecurity risk by receiving as needed updates from and engaging in discussions with the Vice President of Strategic Initiatives and the Chief Financial Officer, that cover, among other things, our cybersecurity risk management program, response readiness and training efforts. The Audit Committee updates the full Board of Directors on cybersecurity matters as appropriate.

companyName: NATURAL HEALTH TRENDS CORP

ticker: NHTC


text: Risk Management and Strategy Our business is dependent upon our computer systems, devices and networks to collect, process and store the data necessary to conduct almost all aspects of our business. We maintain a cybersecurity risk management program, which includes internal and external human resources, processes, controls and technology designed to identify, protect, detect, respond to and manage reasonably foreseeable cybersecurity risks and threats.


text: To safeguard our information systems from cybersecurity threats, we use various security tools that help prevent, identify, escalate, investigate, resolve and recover from identified vulnerabilities and security incidents in a timely manner at a network and user end point level. These include, but are not limited to, internal reporting, monitoring and detection tools. We engage various third-party vendors to provide these security services, including providing timely cybersecurity threat alerts in addition to monitoring cybersecurity threats and our defenses against cyberattacks. This monitoring includes the proactive identification of vulnerabilities in our systems with threat intelligence. In addition, we engage a third-party vendor to perform penetration testing at least annually and our IT team also performs simulations and response readiness tests on an annual basis. Our incident response plan sets forth our response protocol to coordinate the activities that we take to respond and recover from cybersecurity incidents, which include processes to triage, assess severity, investigate, escalate, contain, and remediate an incident, as well as to comply with potentially applicable legal and reporting obligations and mitigate brand and reputational damage.


text: We also maintain a third-party risk management process to mitigate vulnerabilities associated with external service providers and vendors. This includes reviewing service-level agreements and third-party security certifications, such as PCI DSS and SOC reports, on an annual basis or as-needed to ensure vendors adhere to our security and compliance standards.


text: We have adopted an IT Policies and Procedures Policy that requires all employees to acknowledge on an annual basis their responsibilities in abiding with company policies regarding safeguard our network environment. In addition, all employees receive cybersecurity training upon hire with at least annual training on best practices, social engineering threats and cybersecurity risks.


text: We continuously monitor our computer systems, devices and networks, and work to improve our safeguards against regular and continually evolving cyber and other security threats. To date, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. However, notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident in the future that could have a material adverse effect on us. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. For further information about the cybersecurity risks we face, see "Item 1A. Risk Factors – System disruptions or failures, cybersecurity risks, and compromises of data, or the failure to comply with related laws and regulations, could harm our business."


text: The Company has no employees and is externally managed by our Manager, which is a wholly owned subsidiary of Bimini. Pursuant to the terms of the Management Agreement, our Manager manages, operates and administers our day-to-day operations, business and affairs, subject to the direction and supervision of the Board. The Board plays an active role in overseeing management of our risks, and cybersecurity represents an important component of the Company's overall approach to risk management and oversight.

companyName: Orchid Island Capital, Inc.

ticker: ORC


text: As an externally managed company, the Company relies on our Manager's information systems in connection with the Company's day-to-day operations. Consequently, the Company also relies on our Manager's processes for assessing, identifying, and managing material risks from cybersecurity threats undertaken by our Manager. All of the Company's executive officers are executive officers, directors and employees of Bimini.


text: Our Manager's cybersecurity processes and practices are integrated into the Company's risk management and oversight program. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. The Company has adopted a cybersecurity incident response plan to enable rapid response, curtail further security breaches, mitigate and manage costs, and facilitate timely disclosure of material cyber incidents as required by the SEC.


text: Risk Management and Strategy The Company, our Manager and our Board place a high priority on maintaining security over our financial information that can be accessed via the Internet and mitigating information security risks. The Company engages a third-party security firm to provide threat detection and reports, conduct annual testing of our Manager's systems, train the Manager's employees and generally advise on cybersecurity processes. At least annually, our Manager has its information technology team and its third-party security firm make a formal presentation to our Audit Committee and the Board to keep them apprised of the level of cybersecurity that exists to protect our financial information, training of the Company's officers and the Manager's employees, and the latest threats that have emerged.


text: Governance: As discussed in more detail under "Item 1C. Cybersecurity—Governance," the Audit Committee and the Board oversee cybersecurity risk management by regularly interacting with the Company's management team, our Manager's information technology team and a third-party security firm.


text: Collaborative Approach: The Company has implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.


text: Technical Safeguards: The Company deploys technical safeguards that are designed to protect information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, redundant data storage and retention methods, anti-malware functionality and access controls, which are evaluated and improved through vulnerability and exposure assessments and cybersecurity threat intelligence. With the help of the third-party security firm, the Company has implemented several layers of physical security, digital security and data backup.


text: Incident Response and Recovery Planning: The Company has established a comprehensive incident response and recovery plan that addresses the response to a cybersecurity incident and plans to test and evaluate that plan on a regular basis.


text: Third-Party Risk Management: The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including counterparties, service providers or other external users of our Manager's systems, as well as the systems of third parties that could adversely impact the Company's business in the event of a cybersecurity incident affecting those third-party systems.


text: Education and Awareness: A third-party security firm provides training to our Manager's employees, helping our Manager's information technology team to maintain a state-of-the-art cybersecurity system and stay up to date on the latest threats and counter measures available. The third-party security firm places a high priority on employee threat education through automated internal phishing tests. Our Manager's information technology team attends continuing education seminars and receives timely alerts to any new viruses or cyber threats as they occur as a means to equip personnel with effective tools to address cybersecurity threats, and to communicate evolving information security policies, standards, processes and practices.


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to affect the Company, including its business strategy, results of operations or financial condition. The Company is not aware of any material security breach to date. Accordingly, the Company has not incurred any expenses over the last three years on information security breaches. However, the Company faces certain ongoing risks from cybersecurity that, if realized, could materially affect the Company. See "Item 1A. Risk Factors - The occurrence of cyber-incidents, or a deficiency in our cybersecurity or in those of any of our third party service providers could negatively impact our business by causing a disruption to our operations, a compromise or corruption of our confidential information or damage to our business relationships or reputation, all of which could negatively impact our business and results of operations." There can be no assurance that the Company's cybersecurity risk management program and processes, including its policies, controls or procedures, will be fully implemented, complied with or effective in protecting its systems and information.


text: The Company believes oversight of cybersecurity risk is the responsibility of the Audit Committee and the full Board. Accordingly, the Audit Committee and the Board oversee the Company's cybersecurity risk management process. The Board considers the Company's cybersecurity posture and risk exposure with management taking into consideration the Company's operations and the types of data retained on its systems as part of its and the Audit Committee's periodic review of the Company's risk management. The Company's primary business involves investments in Agency RMBS, which are securities backed primarily by single-family residential mortgage loans. The Company does not receive personal information on individual mortgage borrowers. The Board reviews the Company's cybersecurity program and risk exposure with management on at least an annual basis and receives reports from management, the Manager's information technology team, and the Company's third-party security firm on these matters from time to time. The Board may also conduct additional cybersecurity reviews or receive additional updates or reports as it deems necessary.


text: As noted above, the Company relies on its Manager's information systems in connection with the Company's day-to-day operations. Consequently, the Company also relies on the processes for assessing, identifying, and managing material risks from cybersecurity threats undertaken by its Manager. Messrs. Cauley and Haas work collaboratively to implement a program designed to protect our Manager's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plan. These members of the Company's management team monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents and report such threats and incidents to the Board when appropriate.


text: Messrs. Cauley and Haas each hold undergraduate and graduate degrees in their respective fields, and each have approximately twenty years of experience managing risks at the Company and at similar companies, including risks arising from cybersecurity threats.


text: IT Risk Management The Company maintains an information technology (IT) risk identification process that encompasses risks associated with enterprise solutions and products and services provided by third-party service providers. Cybersecurity risks are considered a subcategory of IT risks and are therefore part of this process. The Company maintains a risk register to document and track IT risks, including factors such as: Categories (including but not limited to cybersecurity, data privacy, governance, and application development)

companyName: HUNT J B TRANSPORT SERVICES INC

ticker: JBHT


text: Approvals/exceptions The Company's Governance, Risk, and Compliance (GRC) team maintains the IT risk register and reports updates to the IT Risk Council, which meets regularly. The IT Risk Council is made up of members representing the Company's cybersecurity, network, server, client, database, and software teams.


text: Cybersecurity Operations and Incident Response Capabilities The Company maintains a Cybersecurity Operations Center (CSOC) comprised of in-house staff, contracted personnel, and other third-party security service providers. Our CSOC provides constant monitoring, assessment, and defense of all enterprise information systems (including web sites, applications, databases, servers, clients, and data centers) as well as service provider connections and provides incident reporting as needed.


text: The Company also maintains a Security Incident Response Team (SIRT) that responds to high-risk security incidents on a 24-hour basis. Members of this team include representatives of our CSOC and Networking Operations Center, as well as cloud/server engineering, network engineering, enterprise data, identity and access management, GRC, end-user computing, application development, and IT leadership teams.


text: Assessments and Audits The Company uses various methods to assess our cybersecurity maturity and IT risk management program, including periodic self-assessments and engagements of independent third-party assessors and consultants. We engaged third-party experts for the initial development of the IT risk management program, including preparation of the program charter, IT risk register, and responsibility assignment matrix. We use these external engagements to provide multiple assessments of our cybersecurity functions, including a compromise assessment, a security posture assessment, and a cyber-defense assessment.


text: Risks Associated with Third-Party Service Providers The Company's GRC oversees assessments of third-party service providers in collaboration with our IT contracts, data privacy, technical architecture, and legal teams. An initial review for any cybersecurity threat is completed when the provider is onboarded, with subsequent periodic reviews conducted thereafter. These subsequent reviews occur at different intervals, based on the nature of the business relationship, the type of data being exchanged (if any), and the overall potential impact to the Company, and include consideration of factors such as the third party's cybersecurity capabilities, data protections and privacy measures, and technical capabilities as related to required integrations with the Company's systems.


text: Material Findings from Cybersecurity Risks The Company faces many of the same risks and has experienced similar cybersecurity incidents as other transportation providers. None of these risks or incidents to date have materially affected our business strategy, operations, or financial condition.


text: The Board of Directors maintains oversight of risks from cybersecurity-related threats, primarily through the Audit Committee. The Audit Committee holds a separate annual in-person meeting with the Company's Chief Information Officer (CIO) and subsequently provides an update to the Board. The Company's CIO also attends a second annual meeting directly with the full Board of Directors. Beginning in 2025, in addition to these annual meetings, the CIO or the Sr. Vice President of Engineering & Technology is scheduled to meet with the Audit Committee such that the Board and the Committee receive updates on at least a quarterly basis. Other updates are provided throughout the year to the Audit Committee and the Board, as needed. In the event a cybersecurity incident is determined to be significant, a formal meeting of the full Board of Directors may be convened.


text: The Company's CIO, Senior Vice President of Engineering and Technology responsible for technical services, and Vice President of Engineering and Technology responsible for IT risk management oversee all material risks associated with cybersecurity threats. Our CIO has over 30 years of experience leading data and technology initiatives and has held executive and senior leadership roles across Fortune 500 companies. Our Senior Vice President of Engineering and Technology has more than 34 years of IT experience and has led initiatives in IT application development, IT operations, cloud computing, cybersecurity, business continuity, governance, compliance, and enterprise risk management across various industries. Our Vice President of Engineering and Technology, has more than 30 years of expertise with the Company in cybersecurity, engineering, governance, risk, and compliance, having successfully led numerous projects for the Company. Their backgrounds provide them with a comprehensive understanding of cybersecurity challenges and solutions.


text: In the event of a cybersecurity incident, these leaders engage the Incident Response Team (IRT), a team comprised of senior- and executive-level leaders from various business units, legal and finance departments, and the corporate communications team, to help manage and maintain business operations throughout the incident and any recovery period. The IRT is responsible for reporting details of the incident and its impact on the business to the Executive Leadership Team (ELT) and making key recommendations for managing operations. The ELT is responsible for advising the Board of any material cybersecurity incidents. Both the ELT and the IRT have participated in formal cybersecurity response training.


text: Cybersecurity Risk Management Cybersecurity risk management is an integral part of our overall enterprise risk management program. Our cybersecurity risk management program is designed to provide a framework for handling cybersecurity threats and incidents, including threats and incidents associated with the use of services provided by third-party service providers, and to facilitate coordination across different departments of our company. Our processes include steps for assessing the severity of a cybersecurity threat, identifying the source of a cybersecurity threat including whether the cybersecurity threat is associated with a third-party service provider, implementing cybersecurity countermeasures and mitigation strategies and informing management and our board of directors of material cybersecurity threats and incidents. Our cybersecurity team also engages third-party security experts for risk assessment and system enhancements. In addition, our cybersecurity team provides training to employees, based on their role.

companyName: OLYMPIC STEEL INC

ticker: ZEUS


text: Our board of directors has overall oversight responsibility for our risk management, and delegates cybersecurity risk management oversight to the audit committee of the board of directors. The audit committee is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks to which the company is exposed and implement processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents. The audit committee also reports material cybersecurity risks to our full board of directors. Management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes designed to ensure that such potential cybersecurity risk exposures are monitored, putting in place mitigation measures and maintaining cybersecurity programs. Our cybersecurity programs are under the direction of our Vice President of Information Services (VP-IS) who receives reports from our cybersecurity team and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our VP-IS and dedicated personnel are information system security professionals and information security managers with many years of experience. Management, including the VP-IS and our cybersecurity team, regularly update the audit committee on the company's cybersecurity programs, material cybersecurity risks and mitigation strategies and provide cybersecurity reports annually that cover, among other topics, third-party assessments of the company's cybersecurity programs, developments in cybersecurity and updates to the company's cybersecurity programs and mitigation strategies.


text: In 2024, we did not identify any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors - Risks Related to our Business" in this Annual Report on Form 10-k.


text: Cybersecurity Risk Management, Strategy and Governance Cybersecurity is a material part of ConnectOne's business. As a financial institution offering products through multiple digital delivery channels, cybersecurity incidents could have a material effect on the Company, its results of operations and its reputation, although to date the Company has not experienced any cybersecurity incident which has had a material effect on the Company's business strategy, results of operations or financial condition. See "Item 1A- Risk Factors - We cannot predict how changes in technology will impact our business; increased use of technology may expose us to service interruptions or breaches in security."

companyName: ConnectOne Bancorp, Inc.

ticker: CNOB


text: Cybersecurity risk is initially overseen at ConnectOne by the management IT Committee (the "ITC"). The members of this committee include, as co-chairs, the Chief Compliance Officer and the Chief Technology Officer. Additional members are our Information Security Officer, Information Technology ("IT") Manager, Chief Risk Officer, Chairman & Chief Executive Officer, Chief Digital Officer and Chief Brand and Innovation Officer.


text: Tarak Patel, Information Security Officer - Mr. Patel has facilitated the management of information security programs at financial institutions for over 17 years.


text: Sharif Alexandre, Chief Technology Officer - Mr. Alexandre has over 20 years industry experience including managing Information Technology and Software Development teams at organizations ranging from technology startups to Fortune 500 companies. He recently oversaw IT operations and currently leads the Software Development and Data Management teams at the Bank.


text: Laura Criscione, Chief Compliance Officer - Ms. Criscione oversees the company's Compliance and Information Security. Ms. Criscione has overseen Compliance and IT Operations throughout her more than 30-year career in financial institutions.


text: Dale Dwaileebe, IT Manager - Mr. Dwaileebe has over 20 years of IT experience, is a current member of Infragard, and holds multiple industry recognized certifications. Michael O'Malley, Chief Risk Officer – Mr. O'Malley oversees entity-wide risk management, including cybersecurity related risk.


text: Ali Mattera, Chief Digital Officer – Ms. Mattera is a technology subject matter expert with over 13 years of IT leadership and over 18 years of financial service experience. In her career she has been responsible for technology/digital strategy, enterprise program management, data analytics and IT service management at other financial institutions. In addition to the members above, Frank Sorrentino III, Chairman & Chief Executive Officer and Siya Vansia, Chief Brand & Innovation Officer are also members of the ITC due to their roles in overseeing entity-wide management.


text: In order to ensure that cybersecurity risk management is integrated into the Company's overall risk management plans, systems and processes, members of the ITC, along with other lines of business heads, report to the management Enterprise Risk Management Committee (the "ERMC"), which in turn reports to the Board Audit and Risk Committee quarterly. The ERMC consists of the Company's Chief Risk Officer, Chairman & CEO, President, Chief Financial Officer, Treasurer, Chief Compliance Officer, Chief Technology Officer and Chief Credit Officer. In addition, the Company's Chief Technology Officer attends Company Board of Directors meetings and provides an information technology ("IT") report at each meeting.


text: The Company's cybersecurity risk mitigation program involves a combination of internal resources and the use of third parties. The Company's internal IT team performs monthly vulnerability scanning and performs an annual risk assessment based on the National Institute of Standards and Technology Cybersecurity Framework. The results are reported to the ITC. The Company's IT and compliance staff also review potential cybersecurity threats associated with the Company's third-party vendors, including performing a review of and obtaining a System of Organization Controls report from all vendors rated as "high risk" by the Company's internal vendor management program. The Company also has an internal Incident Response Plan and Team, which is charged with overseeing the Company's response to any cybersecurity incident. The team performs a table-top exercise at least annually to prepare to respond in the event of any actual cybersecurity incident. In addition to these internal resources, the Company uses a third-party vendor to undertake annual penetration and vulnerability testing, with the results reported to the ITC. Finally, the Company's cybersecurity compliance program is audited by the Bank's outsourced internal auditor.


text: The Company also maintains insurance which may provide coverage for expenses and certain losses incurred in connection with a cybersecurity incident.


text: Cybersecurity represents a critical component of the Company's overall approach to risk management. The Company's cybersecurity policies, standards and practices are fully integrated into our approach to risk management, and cybersecurity risks are among the core enterprise risks that are subject to oversight by our Board of Directors (the "Board"). The Company uses recognized frameworks from the National Institute of Standards and Technology as guidelines to inform its cybersecurity policies, standards, and practices. We generally approach cybersecurity matters through a cross-functional, multilayered approach, with specific goals of: (i) identifying, preventing and mitigating cybersecurity threats to the Company; (ii) preserving the confidentiality, integrity and availability of the information that we collect and store to use in our business; (iii) protecting our intellectual property; (iv) maintaining the confidence of our customers, clients and business partners; and (v) providing appropriate public disclosure of cybersecurity risks and incidents when required.

companyName: BOYD GAMING CORP

ticker: BYD


text: Risk Management and Strategy Consistent with our Information Security Policies and Standards, our cybersecurity program focuses on the following areas:


text: Awareness: We maintain an extensive presence with cybersecurity threat operations functioning continuously and uninterrupted with the specific goal of identifying, preventing, and mitigating cybersecurity threats and responding to cybersecurity incidents in accordance with our established incident response and recovery plans.


text: Systems Safeguards: We deploy systems safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through ongoing vulnerability assessments and cybersecurity threat intelligence.


text: Collaboration: We use collaboration mechanisms established with public and private entities, including intelligence and enforcement agencies, industry groups and third-party service providers, to identify, assess and respond to cybersecurity risks.


text: Third-Party Risk Management: We employ a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as third-party systems that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.


text: Training: We provide regular mandatory training for personnel regarding cybersecurity threats, which reinforces our information security policies, standards and practices, and such training is scaled to reflect the roles, responsibilities and information systems access of such personnel. We also publish an internal newsletter on a monthly and ad-hoc basis for enterprise-wide consumption to promote awareness of trends in cybersecurity threats and attack techniques.


text: Incident Response and Recovery Planning: We have established and maintain comprehensive incident response and recovery plans that fully address our response to and recovery from a cybersecurity incident, and such plans are tested and evaluated on a periodic basis.


text: Communication, Coordination and Disclosure: We take a cross-functional approach to address the risk from cybersecurity threats, involving management personnel from our technology, operations, legal, internal audit and other key business functions and engage with our Board in an ongoing dialogue regarding cybersecurity threats and incidents while also implementing controls and procedures for the assessment and escalation of cybersecurity incidents pursuant to established thresholds so that decisions regarding the disclosure and reporting of such incidents can be made by management in a timely manner.


text: Governance: Our Board regularly interacts with our Chief Information Security Officer and other members of management on cybersecurity risk management.


text: A key part of our strategy for managing risks from cybersecurity threats is the ongoing assessment and testing of our processes and practices through auditing, assessments, tabletop exercises, vulnerability testing, and other exercises focused on evaluating our cybersecurity measures effectiveness. We regularly engage third parties to perform assessments of our cybersecurity program, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Board, and we adjust our cybersecurity policies, standards, processes, and practices as necessary based on the information provided.


text: Our Board oversees the management of risks from cybersecurity threats, including the policies, standards, processes and practices that management implements to address risks from cybersecurity threats. Our Board receives regular presentations and reports on cybersecurity risks, which address a wide range of topics including, for example, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties. Our Board also receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding such incident until it has been addressed. At least quarterly, the Board discusses the Company's approach to cybersecurity risk management with our Chief Information Security Officer ("CISO").


text: Our CISO is the member of our management team that is principally responsible for overseeing our cybersecurity program, in partnership with other business leaders across the Company. Our CISO has served in various roles in information technology and information security for over 25 years and holds a degree in Business Administration with a major in Accounting and Finance and a graduate degree in International Management. Our CISO also holds advanced certifications as a Certified Information Systems Security Professional and as a Qualified Technology Executive granted by Digital Directors Network and works in coordination with the other members of management, including, but not limited to, the Company's President and Chief Executive Officer, Chief Financial Officer, Chief Technology Officer, and General Counsel. Our Chief Technology Officer holds an undergraduate degree in computer science and economics from Northwestern and has served in various roles in information technology for over 33 years with Boyd Gaming and numerous other public companies. The Company's President and Chief Executive Officer, Chief Financial Officer, and General Counsel each hold undergraduate and graduate degrees in their respective fields, and each has years of experience with managing risks at the Company and in environments similar to the Company's, including risks arising from cybersecurity threats.


text: Our CISO works collaboratively across the Company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents. To facilitate the success of this program, multidisciplinary teams are deployed to address cybersecurity threats and to respond to cybersecurity incidents in accordance with our incident response and recovery plans. Through the ongoing communications from these teams, the CISO monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents in real time, and reports such incidents to the Board when appropriate.


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company, including our business strategy, results of operations, or financial condition. We believe with the cybersecurity and governance program we have in place that we have and continue to implement effective processes and controls to prevent cybersecurity incidents from being reasonably likely to materially affect the Company. Refer to "Item 1A. Risk Factors" in this annual report on Form 10-K, including "Failure to maintain the integrity of our information technology systems, protect our internal information, or comply with applicable privacy and data security regulations could adversely affect us", for additional discussion about cybersecurity-related risks.


text: We take an enterprise-wide approach to cybersecurity, using established processes for assessing, identifying, and managing risks from cybersecurity threats. We have implemented various measures across our organization to manage our cybersecurity risks, including implementing systems to identify, prevent, detect, investigate, resolve and recover from cyber security attacks. All employees participate in our security awareness training program, and additional training is required for various roles within the organization. Employees are trained and encouraged to identify and report security concerns, and cybersecurity is engrained in our culture.

companyName: RUSH ENTERPRISES INC \TX\

ticker: RUSHA


text: Our cybersecurity risk management program leverages the Center for Internet Security Critical Security Framework to provide a structured methodology to help ensure the confidentiality, integrity and availability of our systems and data. We regularly assess cybersecurity risks and monitor our systems for vulnerabilities. We conduct regular reviews and tests of our systems and our cybersecurity program, both internally and using consultants and external auditors. These tests include, but are not limited to, vulnerability testing, penetration testing, tabletop exercises, systems recovery tests, assessments and other activities to assess the readiness and effectiveness of our cybersecurity controls and protections.


text: Our Information Security program is led by our Chief Information Officer ("CIO"), who reports to our Chief Operating Officer ("COO"). Our CIO works with our Chief Privacy Officer ("CPO") to address cybersecurity and data privacy risks and concerns. The Information Security Governance Committee ("ISGC"), composed of executives from various corporate functions oversees our cybersecurity policy and strategy. Members of the ISGC, including the CIO and CPO, meet with the COO on a regular basis to review and monitor our cybersecurity risks and mitigation efforts. Our Board of Directors (the "Board") oversees our enterprise risk management activities in general, including cybersecurity risks. The Audit Committee of the Board has been designated with specific oversight responsibility with respect to cybersecurity and data privacy risk management. The Board receives a comprehensive update on the status of risks related to cybersecurity annually and periodic updates on particular matters. We engage external assessors, consultants, and auditors to assist us in evaluating and enhancing our cybersecurity risk management processes. We also have processes to oversee and identify such risks from cybersecurity threats associated with our use of third-party service providers.


text: While we have not experienced a material breach, our systems are frequently the target of cyber security attacks intending to steal, misuse, or destroy data, to impact our ability to do business, or otherwise negatively impact us. If we did experience a significant disruption in service, theft of data, or other significant attack, it could result in legal claims or proceedings, liability under federal and state laws that protect the privacy of personal information, regulatory penalties, remediation costs, increased cybersecurity costs, loss of revenue or customers, damage to our reputation or competitive position, or other harm to our business. For more information regarding the risks we face from cybersecurity threats, please see "Risk Factors."


text: Cybersecurity Risk Management and Strategy Information technology is important to our business operations and we are committed to protecting the privacy, security, and integrity of our data, as well as our employee, customer, and vendor data. Accordingly, we have established processes, procedures, and controls to identify, manage, assess, and mitigate material risks from cybersecurity threats, as well as identify, contain, and respond to cybersecurity incidents. These processes include, but are not limited to, monitoring and updating of our information technology and infrastructure to prevent, detect, address, and mitigate risks associated with unauthorized access, misuse, computer viruses, and other events that could have a security impact. Additionally, to protect and secure sensitive data, we employ multi-factor authentication, a suite of security tools, systems monitoring and alerting, audit logs, and controls across our major systems, devices, and business processes. We engage with external experts to evaluate and test our cybersecurity risk preparedness. Regular exams and threat and security assessments with these third parties ensure that our cybersecurity strategies align with industry best practices. To manage cybersecurity risks associated with third-party service providers, we impose security requirements upon our suppliers, including maintaining an effective security management program and notifying us in the event of any known or suspected cyber incident. We also conduct company-wide security awareness training periodically to provide employees the opportunity to gain an understanding of the various forms of cybersecurity incidents and enable our employees to handle and report the majority of suspicious activities or threats. We currently maintain a cyber insurance policy that provides coverage for security breaches; however, such insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyber-attacks, or other related breaches.

companyName: AEye, Inc.

ticker: LIDR


text: As of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, see the risk factor within Item 1A "Risk Factors" in this Annual Report on Form 10-K, entitled "We, as well as our suppliers and partners, are subject to cybersecurity risks to operational systems, infrastructure, integrated software in our lidar solutions, and the data processed by those solutions, and any material failure, weakness, interruption, cyber event, incident, or breach of security could adversely affect our business by causing a disruption of our operations, a compromise or corruption of our confidential or other business-critical information, and/or damage our business relationships, all of which could negatively impact our business financial condition, and operating results."


text: Cybersecurity Governance Cybersecurity risks are among the enterprise risks that our Board of Directors oversees, primarily through delegation to the Audit Committee of the Board. The Audit Committee assists the Board in overseeing our privacy and information policies and reviewing our cybersecurity program. The Audit Committee engages with our management team, including our Director of IT and our Chief Financial Officer, and receives periodic reports on cybersecurity. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential. The Board receives regular updates on the activities of the Audit Committee, including with regard to cybersecurity oversight. These cybersecurity reviews by the Audit Committee or Board of Directors generally occur at least once annually, or more frequently as determined to be necessary.


text: The day to day operations of our cybersecurity risk management program are overseen by our Director of IT, who reports to our Chief Financial Officer. Our Director of IT has served in this position for 6 years. He has over 39 years of IT experience, including over 10 years of experience in security compliance. Our Director of IT supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal personnel, threat intelligence, alerts, or reports produced by security tools deployed in the IT environment.


text: The Company's Board of Directors (the "Board") recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Board is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM"). The Company's cybersecurity policies, standards, processes, and practices are fully integrated into the Company's ERM program and are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. Management's philosophy on cybersecurity is to be vigilant in protecting the Company and its constituents through robust investments and employee awareness to aid in the prevention, detection and mitigation of cyber threats, while recognizing that not all threats are preventable.

companyName: DOUGLAS DYNAMICS, INC

ticker: PLOW


text: Risk Management and Strategy As one of the critical elements of the Company's overall ERM approach, the Company's cybersecurity program is focused on the following key areas: Governance: As discussed in more detail under the heading "Governance," the Board's oversight of cybersecurity risk management is supported by the Audit Committee of the Board (the "Audit Committee"), which regularly interacts with executive leadership, the Company's ERM function, and the Company's Vice President of Information Technology. Collaborative Approach: The Company has implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. Technical Safeguards: The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. Incident Response and Recovery Planning: The Company has established and maintains incident response and recovery plans that address the Company's response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis. Third-Party Risk Management: The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. Education and Awareness: The Company provides regular, mandatory training for personnel regarding cybersecurity threats as a means to equip the Company's personnel with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices. The Company engages in the periodic assessment and testing of the Company's policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. The Company regularly engages third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to executive management, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: The Board, in coordination with the Audit Committee, oversees the Company's ERM process, including the management of risks arising from cybersecurity threats. The Board and the Audit Committee each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. The Board and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, the Board and the Audit Committee discuss the Company's approach to cybersecurity risk management with the members of senior leadership, which includes the Company's Vice President of Information Technology.


text: The Vice President of Information Technology, in coordination with executive leadership including our Interim Chief Executive Officer ("CEO") and Chief Financial Officer ("CFO"), works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the Vice President of Information Technology monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and reports such threats and incidents to the Audit Committee when appropriate.


text: The Vice President of Information Technology has been with the Company for over 25 years in various roles in information technology and information security. The Company's Interim CEO and CFO each hold undergraduate and graduate degrees in their respective fields, and each have over 25 years of experience managing risks at the Company and at similar companies, including risks arising from cybersecurity threats.


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected or are reasonably likely to affect the Company, including its business strategy, results of operations or financial condition.


text: In the ordinary course of our business, we collect, use, store, and transmit digitally large amounts of confidential, sensitive, proprietary, and personal information. The secure maintenance of this information and our information technology systems is important to our operations and business strategy. To this end, we have implemented processes designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein.

companyName: EXPRO GROUP HOLDINGS N.V.

ticker: XPRO


text: These processes are managed and monitored by a dedicated Cybersecurity and Infrastructure team, which is led by our Chief Information Officer, and include mechanisms, controls, technologies, systems, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data and maintain a stable information technology environment. For example, we conduct penetration and vulnerability testing, data recovery testing, security audits, and annual and ongoing risk assessments. We engage third parties to perform monitoring and regular penetration testing. We have adopted an Incident Response Policy that applies in the event of a cybersecurity threat or incident that follows the National Institute of Standards and Technology framework. We also conduct regular employee trainings on cyber and information security, among other topics. In addition, we consult with outside advisors and experts, when appropriate, to assist with assessing, identifying, and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on the Company's risk environment.


text: Our Chief Information Officer, who reports to the Chief Financial Officer, and has over 30 years of experience managing information technology and cybersecurity matters, together with our executive management team, is responsible for assessing and managing cybersecurity risks. We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. In the last fiscal year, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, but we face certain ongoing cybersecurity risks threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the heading "Risks Related to Legal and Regulatory Requirements."


text: The Board of Directors, as a whole and at the committee level, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate those risks. The Nominating and Governance Committee has been designated by our Board to oversee cybersecurity risks. The Nominating and Governance Committee receives periodic updates on cybersecurity and information technology matters and related risk exposures from our Chief Information Officer. The Board also receives updates from management and the ESG Committee on cybersecurity risks on at least an annual basis.


text: Risk management and strategy Our information technologies, system networks, information technology infrastructure, enterprise applications and financial reporting platforms are critical components of our operations. Our business operations rely on the secure processing, transmitting, collecting and storage of sensitive and confidential data. We recognize the importance of assessing, identifying and managing material risks associated with cybersecurity threats, as defined in Item 106 (a) of Regulation S-K.

companyName: Stabilis Solutions, Inc.

ticker: SLNG


text: Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. We partner with a third-party information technology company to address and manage each of the critical aspects of cybersecurity risk mitigation. The user aspect is addressed by deploying endpoint detection and response software on all endpoints, as well as extensive phishing testing and training for every user. This is further reinforced with additional monitoring to identify any aberrant activity within our network or software as a service ("SaaS") tools. A 3-2-1 backup strategy is used, resulting in a copy of all backup data offsite in the unlikely event that the disaster recovery plan is required. Our backup system is regularly confirmed through routine data recoveries, test recoveries and monitoring that alert to any unexpected errors or failures with the system.


text: In our business operation, we utilize various third -party service providers, including credit card companies, banks and financial platform providers, to process financial transactions and implement various software and information system processes. To that effect, we seek to engage reliable, reputable service providers that maintain cybersecurity programs.


text: We are not aware of any risks from cybersecurity threats, nor have we experienced any cybersecurity incidents, which have materially affected or are reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition. See Item 1A. "Risk Factors" in this Form 10 -K for discussion of risk factors.


text: Cybersecurity is an important part of our risk management processes. Our Board of Directors holds oversight responsibility for the Company's strategy and risk management, including material risks related to cybersecurity threats. The Audit Committee of the Board of Directors oversees the management of systemic risks, including cybersecurity threats, in accordance with its charter.


text: Our management, represented by senior management, leads the cybersecurity risk assessment and mitigation processes, along with information technology management staff and our third-party business technology partner. Our third-party business technology partner has over 21 years of experience in cybersecurity and information technology. Continuous monitoring and routine meetings are conducted in order for the Company's information technology team and third-party business technology firm to update senior management regarding prevention, detection, mitigation and remediation of any cybersecurity threats or incidents.


text: The Company's Board of Directors takes seriously both the responsibility to guard against cybersecurity threats and its compliance with the SEC Cybersecurity regulations adopted on July 26, 2023. Our Board of Directors has standing agenda to review and discuss on cybersecurity matters with management during each meeting. Management is updated on cybersecurity matters by the IT Senior Systems Administrator ("ITSSA").

companyName: UNIVERSAL BIOSENSORS INC


text: Our cybersecurity risk management program leverages a combination of processes, technologies and personnel with expertise in cybersecurity to comply with applicable regulations and detect and respond to cyber-attacks, data breaches, security incidents, and compromises of personal information, as well as to regularly and promptly inform management and our Board of Directors of any significant cybersecurity risks and developments.


text: Our ITSSA, who has significant experience in managing cybersecurity risks is directly responsible for establishing cybersecurity strategies and structures and managing ongoing cybersecurity risk management activities, reports relevant information regarding cybersecurity threats and risks to management. Management can then further elevate matters to the full Board of Directors, as necessary or required.


text: The Company and the Board of Directors are committed to remaining updated on evolving cybersecurity regulations and best practices, as well as the development and amendment of processes to meet these changing demands. The Company did not experience any cybersecurity incident during 2024.


text: Our Audit Committee, composed of two independent Board of Director members, has oversight responsibility for the Company's cyber-security risk. The internal members of management that oversee cybersecurity is the Chief Financial Officer, ("CFO") and the Director of Franchise Operations/Staff Attorney, ("DFO"). The CFO reports to the Audit Committee prior to each quarterly and annual 10-Q and 10-K filing, respectively, on any current cyber changes, procedures and any identified risks. The CFO provides the Audit Committee any cyber insurance information and will obtain approval for any changes in cyber insurance coverage. The CFO will also provide the Audit Committee any information on any possible third-party information technology, ("IT") service and consultant changes. The Audit Committee will review and approve any change in IT service providers. The Audit Committee will be immediately notified of any cyber security threats or incidents.

companyName: BAB, INC.

ticker: BABB


text: At BAB, Inc. we recognize the importance of safeguarding our systems, data and assets, even in an environment where the risk of cyber incidents is minimal due to the nature of our business. The CFO has over 30 years of experience in risk management and working with computer systems across various industries, providing strong oversight of the cybersecurity efforts. The DFO has several years of experience in IT operations within the company. The internal management team of the CFO and DFO are both familiar and knowledgeable of the company's computer systems and operations and they are familiar with the company's policies, procedures and accountability for safeguarding critical data and assets. Cybersecurity tools as listed below aid in mitigating cybersecurity risk.


text: Our cybersecurity infrastructure includes a combination of technical, administrative and physical safeguards designed to mitigate cybersecurity risks. As part of our risk management process, the CFO also regularly engages with the outside IT consultants to review and minimize the Company's cyber risk.


text: The Company has a firewall that protects the whole network, including intrusion protection, virus protection and other subscription-based protection that updates regularly. For those with remote access there is end-to-end encryption with a secure VPN to access the server. All computers, including those in office and any remote user's computers have an antivirus software from a company that specializes in cybersecurity that has been installed and maintained by an outside IT consultant. The software is updating and reviewing any cyber threats on a continual basis. Additional services provide email filters to minimize phishing and spam emails. Employees are trained to not open suspicious emails and to never open attachments unless they are expecting an attachment from that Company or individual.


text: Sensitive files are password protected and accessible by only select individuals. These files are maintained on a separate drive. Computer files are backed up and redundancy protocols are in place so that minimal downtime would occur in the event of a cyber breach. The Company also maintains cyber insurance coverage to ensure that the Company is adequately prepared in the event of an unforeseen cyber incident.


text: No system is entirely immune to cyber threats and although our risk is low, the impact of a cybersecurity incident could impact our business, cause reputational harm, subject us to increased operating costs and/or expose us to litigation. To date, we have had no cybersecurity incidents that have materially impacted, or are reasonably likely to materially impact our operations or financial condition. Should an incident occur, the CFO and/or DFO will immediately report the incident to the Audit Committee with all details. The communication will identify what steps are currently being taken to resolve the incident, and what actions are being taken to prevent any further security incidents from occurring.


text: Risk Management, Strategy, and Governance Our enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes are led by a dedicated, outsourced Chief Information Officer, in collaboration with outside cybersecurity partners, is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. Qualified third-party service providers are tasked with developing, implementing, and executing that strategy. These third parties play a key role in our cybersecurity risk assessment and management processes, as we rely on their cybersecurity experience and expertise to assess, identify, and manage emerging trends and risks from cybersecurity threats on an ongoing basis.

companyName: Laird Superfood, Inc.

ticker: LSF


text: Our Chief Executive Officer and other members of our senior management, as appropriate, provide oversight and monitoring of these third parties, who provide regular reports to management. Management provides periodic reports to our Board as a whole, who are ultimately responsible for the oversight of risks from cybersecurity threats, which include updates on the Company's cyber risks, the status of projects to strengthen our information security systems, assessments of the information security program, the emerging threat landscape, and any recommendations for additional internal controls, systems, or insurance coverage for board approval.


text: Our cybersecurity policies are focused on ensuring the security and protection of our systems, networks, and proprietary data, which includes trade secrets, intellectual property, corporate strategic plans, marketing plans, material non-public financial information, and personally identifiable information, such as employee and customer information. We also actively engage with key vendors as part of our continuing efforts to actively monitor system access, identify and quarantine potential cybersecurity threats, to assess and implement cybersecurity systems and tools, and to enhance the effectiveness of our information security policies and procedures.