text: Our enterprise cybersecurity program aligns with the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) standards, among others. The program includes processes and controls for the deployment of new IT systems by the Company and controls over new and existing system operations. We, or third parties we contract with, monitor and conduct regular testing of these controls and systems, including vulnerability management through active discovery and testing to regularly assess patching and configuration status. In addition, we require our employees to complete annual cybersecurity training, and we regularly conduct simulated phishing and cyber-related communications. Incident Response.


text: Our cybersecurity program includes monitoring for potential security threats that may lead to vulnerabilities. We evaluate and assign severity levels to incidents, escalate and engage an incident response team based on severity, and manage and mitigate the related risks. Incidents are reported internally to members of senior management and/or the Board of Directors as appropriate based on severity and incident type and are also analyzed for external reporting requirements. Our incident response process is also designed to coordinate functions to enable continuity of essential business operation in the event of a cyber crisis. Third Party Service Providers.

companyName: Vuzix Corp

ticker: VUZI

secItem: Item 1C


text: We engage third party service providers to expand the capabilities and capacity of our cybersecurity program, including for design, monitoring and testing of the program's risk prevention and protection measures, and process execution including incident detection, investigation, analysis and response, eradication, and recovery. Our main external service provider is US-based and utilizes a 24 x 7 x 365 Service Operation Center (SOC). Program Assessment.


text: We regularly evaluate and seek to improve and mature our cybersecurity processes. Our cybersecurity program is regularly assessed through management self-evaluation and ongoing monitoring procedures to evaluate our program effectiveness, including assessments associated with internal controls over financial reporting as well as vulnerability management through active discovery and testing to validate patching and configuration. As cybersecurity threats are continuously evolving, we also periodically engage with third parties to perform maturity assessments of our program to identify potential risk areas and improvement opportunities. This includes assessment of our overall program, policies and processes, compliance with regulatory requirements and an overall assessment of key vulnerabilities. We use these assessments to supplement our own evaluation of the overall health of our program and target improvement areas.


text: Board Oversight and Management's Role Our Board of Directors has primary oversight responsibility for enterprise cybersecurity risks. The Audit Committee also considers enterprise cybersecurity risks in connection with its financial and compliance risk oversight role. The Chief Financial Officer regularly reports to the Board of Directors on the status of the Company's cybersecurity program and provides the Board of Directors with the annual assessment by a third party on the Company's cybersecurity program. Cybersecurity risks are also included with the Company's annual business risk assessment which is provided to the Board of Directors.


text: In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents.

companyName: STARTENGINE CROWDFUNDING, INC.


text: Our Board has oversight of our strategic and business risk management and is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks to which the Company is exposed and to implement processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents. Our Board also oversees risks related to privacy and data use, including overseeing compliance with our comprehensive privacy program. Management is responsible for identifying, assessing, and managing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures, maintaining cybersecurity policies and procedures, and providing regular reports to our board of directors.


text: Cybersecurity is an important component of our overall approach to risk management. We have implemented cybersecurity processes, technologies and controls to facilitate our efforts to identify, assess and manage material risks from cybersecurity threats. We leverage industry associations, third-party benchmarking, results from internal and third-party testing, and other similar resources to inform our cybersecurity programs and processes. We also adhere to applicable Payment Card Industry Data Security Standards. We have prioritized improving our cyber security posture to safeguard our systems and mitigate risks. During fiscal 2023, we made significant investments in people and technology to detect, respond, and recover from security incidents. We have developed and are executing our cybersecurity roadmap which provides the framework to continually strengthen our capabilities.

companyName: Citi Trends Inc

ticker: CTRN


text: Our cybersecurity programs include physical, administrative and technical safeguards designed to help us detect and prevent cybersecurity threats and incidents. We monitor our cybersecurity programs and processes through assessments focused on evaluating effectiveness, including regular network and endpoint monitoring, vulnerability scanning and penetration testing. In addition, we have engaged third parties to perform reviews of our information security control environment, and to provide expertise on various cybersecurity programs and issues. During fiscal 2023, we partnered with an external cyber security firm to leverage their expertise and guidance in fortifying our systems from evolving threats. We also have third-party risk management processes in place used to address the risks involved with engaging third parties in our cybersecurity programs. Our cybersecurity team has established a written incident response plan in the event of an incident. We do not retain any sensitive customer data on our systems.


text: We provide routine awareness training for associates regarding cybersecurity best practices and their role in protecting the Company from cybersecurity attacks and testing to measure the effectiveness of our information security program.


text: As previously disclosed, we experienced a cybersecurity disruption at the end of Fiscal 2022, which did not result in a material impact to our business strategy, results of operations or financial condition. We have not experienced any material cybersecurity incidents in Fiscal 2023, and as of the date of this Report, we have not identified any material risks from active cybersecurity threats, including as a result of any prior cybersecurity incidents. However, despite our security measures, there can be no assurance that our cybersecurity risk management processes described will be fully implemented, complied with or effective in protecting our systems and information. While we maintain insurance to mitigate potential losses from a cybersecurity incident, such insurance may be insufficient to cover all losses or all types of claims that may arise. See Item 1A. Risk Factors in this Report for a discussion of whether and how risks from identified cybersecurity threats have materially affected or, if realized, are reasonably likely to materially affect our business strategy, results of operations or financial condition.


text: Management is responsible for implementing our cybersecurity program on an ongoing basis to identify, assess and manage cybersecurity risks. Our cybersecurity program is led by our Vice President of Information Systems with support from our Senior Manager of IT Security & Compliance and various other team members. Our Vice President of Information Systems has over 25 years of industry experience, including more than 10 years as the leader of the Company's technology function. On a bi-annual basis, or more frequently as needed, management informs the audit committee of material aspects of our cybersecurity program, including updates on key strategic and operational goals, assessments of cybersecurity risks, updates to any incidents, and the status of our ongoing investments in cybersecurity governance.


text: Our board of directors considers cybersecurity risk as part of its risk oversight function. Our audit committee oversees management's policies, programs and procedures related to cybersecurity risk management and reports to the board regarding these efforts. In addition, the audit committee receives briefings from management bi-annually, or more frequently as needed, on material aspects of our cybersecurity program.


text: In the ordinary course of business, we receive, process, use, and store digitally large amounts of data, including customer data as well as confidential, sensitive, proprietary, and personal information. Maintaining the integrity and availability of our information technology systems and this information, as well as appropriate limitations on access and confidentiality of such information, is important to us and our business operations. To this end, we have implemented a program designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing in them.

companyName: XCel Brands, Inc.

ticker: XELB


text: The program is managed by our executive management team, and includes mechanisms, controls, technologies, systems, policies, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the systems and data residing in them. We consult with and rely upon outside advisors and experts to assist us with assessing, identifying, and managing cybersecurity risks.


text: We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. Our Board of Directors has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate those risks. The Board of Directors receives periodic updates on cybersecurity and information technology matters and related risk exposures from management.


text: Mesabi Trust does not have any directors, officers or employees. The Corporate Trustee is responsible for oversight of Mesabi Trust's risks from cybersecurity threats as it relates to financial record keeping, cash and investment management, administration and reporting. The Corporate Trustee also serves as registrar and transfer agent for the Trust. The Corporate Trustee has dedicated personnel responsible for assessing and managing Mesabi Trust's cyber risk management efforts, informing senior management of the Corporate Trustee regarding the prevention, detection, mitigation and remediation of cybersecurity incidents and supervising such efforts. The Corporate Trustee's information technology team has significant experience selecting, deploying and operating cybersecurity technologies, initiatives and processes and relies on threat intelligence as well as other information obtained from governmental, public or private sources, including external consultants engaged by the Corporate Trustee to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. The Corporate Trustee works with leading firms in the cybersecurity industry, leveraging their technology and expertise to monitor and maintain the performance and effectiveness of products and services that are used by the Corporate Trustee. The Corporate Trustee maintains a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats, which processes are integrated into the Corporate Trustee's overall risk management process. The Corporate Trustee maintains robust cybersecurity protocols including, but not limited to technological capabilities that prevent and detect disruptions, computer workstations and programs protected with passwords and passphrases, as well as employee training throughout the year on financial regulations and cybersecurity followed up by testing of that knowledge. The protocols are based on recognized best practices and standards for cybersecurity and information technology. The Corporate Trustee has an annual assessment, performed by a third-party vendor, of the Corporate Trustee's cyber risk management program. Other non-technical protocols include securing of documents and work areas that could contain non-public information and independent verification of information changes by outside vendors. Mesabi Trust faces risks from cybersecurity threats that could have a material adverse effect on its financial condition, results of operations, cash flows or reputation. The Corporate Trustee has experienced, and will continue to experience, cyber incidents in the normal course of its business. However, prior cybersecurity incidents have not had a material adverse effect on Mesabi Trust's financial condition, results of operations, or cash flows. See "Risk Factors – General Risk Factors – The Trust faces risks from cybersecurity threats that could have a material adverse effect on its financial condition, financial record keeping, investment management, reporting, results of operations, cash flows or reputation."

companyName: MESABI TRUST

ticker: MSB


text: The underlying processes and controls of our cyber risk management program incorporate recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF"). We have an annual assessment performed by a third-party specialist of our cyber risk management program against the NIST CSF. The annual risk assessment identifies, quantifies, and categorizes material cyber risks. In addition, we, in conjunction with the third-party cyber risk management specialists, develop a risk mitigation plan to address such risks, and where necessary, remediate potential vulnerabilities identified through the annual assessment process.

companyName: Scorpius Holdings, Inc.

ticker: SCPX


text: In addition, we maintain policies over areas such as information security, access on/offboarding, and access and account management, to help govern the processes put in place by management designed to protect our IT assets, data, and services from threats and vulnerabilities. We partner with industry recognized cybersecurity providers leveraging third-party technology and expertise. These cybersecurity partners, including consultants and other third-party service providers, are a key part of our cybersecurity risk management strategy and infrastructure and provide services including, maintenance of an IT assets inventory, periodic vulnerability scanning, identity access management controls including restricted access of privileged accounts, network integrity safeguarded by employing web-based software, including endpoint protection, endpoint detection and response, and remote monitoring management on all devices, industry-standard encryption protocols, critical data backups, infrastructure maintenance, incident response, cybersecurity strategy, and cyber risk advisory, assessment and remediation.


text: Our management team, in conjunction with third-party information technology ("IT") and cybersecurity service providers, is responsible for oversight and administration of our cyber risk management program, and for informing senior management and other relevant stakeholders regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents. Scorpius Holdings' management team has prior experience selecting, deploying, and overseeing cybersecurity technologies, initiatives, and processes directly or via selection of strategic third-party partners, and relies on threat intelligence as well as other information obtained from governmental, public, or private sources, including external consultants engaged by us for strategic cyber risk management, advisory and decision making. Our Audit Committee also provides oversight of risks from cybersecurity threats.


text: As part of its review of the adequacy of our system of internal controls over financial reporting and disclosure controls and procedures, the Audit Committee is specifically responsible for reviewing the adequacy of our computerized information system controls and security related thereof. The cybersecurity stakeholders, including member(s) of management assigned with cybersecurity oversight responsibility and/or third-party consultants providing cyber risk services brief the Audit Committee on cyber vulnerabilities identified through the risk management process, the effectiveness of our cyber risk management program, and the emerging threat landscape and new cyber risks on at least an annual basis. This includes updates on our processes to prevent, detect, and mitigate cybersecurity incidents. In addition, cybersecurity risks are reviewed by our Board of Directors at least annually, as part of our corporate risk oversight processes.


text: We face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition, results of operations, cash flows or reputation. We acknowledge that the risk of cyber incident is prevalent in the current threat landscape and that a future cyber incident may occur in the normal course of its business. However, prior cybersecurity incidents have not had a material adverse effect on our business, financial condition, results of operations, or cash flows. We proactively seek to detect and investigate unauthorized attempts and attacks against our IT assets, data, and services, and to prevent their occurrence and recurrence where practicable through changes or updates to internal processes and tools and changes or updates to service delivery; however, potential vulnerabilities to known or unknown threats will remain. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, investors, and additional stakeholders, which could subject us to additional liability and reputational harm. In response to such risks, we have implemented initiatives such as implementation of the cybersecurity risk assessment process and development of an incident response plan. See Item 1A. "Risk Factors" for more information on cybersecurity risks.


text: We believe cybersecurity is of critical importance to our success. We are susceptible to a number of significant and persistent cybersecurity threats, including those common to most industries as well as those we face as a retailer, operating in an industry characterized by a high volume of customer transactions and collection of sensitive data. These threats, which are constantly evolving, include data breaches, ransomware, and phishing attacks. We, and our vendors and suppliers, regularly face attempts by malicious actors to breach our security and compromise our information technology systems, and a cybersecurity incident impacting us or any vendor or supplier could significantly disrupt our operations and result in damage to our reputation, costly litigation and/or government enforcement action. Accordingly, we are committed to maintaining robust cybersecurity and data protection and continuously evaluate the impact of cybersecurity threats, considering both immediate and potential long-term effects of these threats on our business strategy, operations, and financial condition.

companyName: Boot Barn Holdings, Inc.

ticker: BOOT


text: The Audit Committee, under oversight of the Board of Directors, has responsibility for oversight of risks from cybersecurity threats, and the assessment and management of cybersecurity risks is the responsibility of the Information Security ("INFOSEC") team. The INFOSEC team is managed by the Vice President, Information Technology, who reports to our Chief Executive Officer. Our current Vice President, Information Technology and other members of our INFOSEC team collectively have more than 60 years of experience in information technology and extensive education and industry experience managing cybersecurity risks, developing and implementing cybersecurity policies, and responding to cybersecurity incidents.


text: Under the oversight of the Audit Committee, our management and the INFOSEC team have established comprehensive processes for identifying, assessing and managing material risks from cybersecurity threats, and these processes are integrated into our overall enterprise risk management program. Our approach is proactive and adaptive, featuring regular security assessments, third-party audits, team member training, and continuous improvement of our cybersecurity infrastructure. We work to align our practices with industry best practices and regulatory standards. We continually evaluate our information technology systems to identify new and monitor existing cybersecurity risks based on observed activity on the systems. We evaluate the nature and severity of identified risks, and whether changes to the system are necessary. We perform annual cybersecurity training for all employees with access to our systems and conduct regular test phishing campaigns. We engage a third-party to assist in monitoring, preventing and detecting potential cybersecurity vulnerabilities and incidents, including performing scans of our information technology systems and penetration testing. We use the results of the various tests to inform our response plan, update our systems, and train employees.


text: Upon the identification of a cybersecurity incident, the Incident Response Team (IRT) initiates our Security Incident Response Policy. This includes determining the scope and risk level of the incident, the incident response, and the steps necessary to reduce the likelihood of reoccurrence. Depending on the severity of the incident, the IRT communicates with the appropriate stakeholders, which may include the Audit Committee. In addition, a summary of cybersecurity incidents, results of testing, corporate security training and planned enhancements are reported to the Audit Committee at least quarterly by the Vice President, Information Technology.


text: Our third-party vendors and service providers also play a role in our cybersecurity. These third parties are integral to our operations but pose cybersecurity challenges due to their access to our data and our reliance for various aspects of our operations, including our supply chain. We have developed a third-party vendor risk management program to assess and manage the risks associated with third-party partnerships, particularly in data security and cybersecurity. We conduct due diligence before onboarding new vendors and maintain ongoing evaluations to ensure compliance with our security standards.


text: As of the date of this report, no cybersecurity incidents have had, either individually or in the aggregate, nor are we aware of any cybersecurity risks that are reasonably likely to have, a material adverse impact our business strategy, results of operations, or financial condition. Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. For additional discussion of the risks we face from cybersecurity threats, see risk factor titled "Our management information systems and databases could be disrupted by system security failures, cyber threats or by the failure of, or lack of access to, our Enterprise Resource Planning system. These disruptions could negatively impact our sales, increase our expenses, subject us to liability and/or harm our reputation." in Item 1A. "Risk Factors."


text: We have certain processes for the identification, assessment, and mitigation of cybersecurity risks which are incorporated into our overall risk management processes, which we rely on information technology systems and networks managed and maintained by independent third parties. Our information technology personnel, responsible for cyber security, monitors daily and weekly backups of our system to protect against data loss and minimize disruption to our operations in the event of a cybersecurity incident. Our data is accessible by our assigned personnel and third parties as necessary and appropriate, to perform services or otherwise do business with us, and we have implemented two-factor identification for access to our third party systems to submit relevant data to our IND.

companyName: BURZYNSKI RESEARCH INSTITUTE INC

ticker: BZYR


text: We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations or financial condition.


text: Our information technology personnel and our senior management lead the operational oversight of the company-wide cybersecurity strategy and processes. The board of directors provides oversight of our cybersecurity risk. Additionally, the board of directors reviews our enterprise risk management processes and will be notified by management between management updates regarding significant new cybersecurity threats or incidents.


text: We recognize the critical importance of cybersecurity in upholding the safety and security of our systems, services and data and maintaining the trust of our customers. Cybersecurity risk management is an important part of, and is integrated into, the Company's overall enterprise risk management program. We maintain a cybersecurity risk management program that is designed to identify, assess, manage and mitigate cybersecurity risks and provides a framework for responding to cybersecurity threats and incidents. We continually assess and enhance our cybersecurity risk management program and our cybersecurity posture to protect the confidentiality, integrity and availability of the Company's infrastructure, resources and information and the information that our customers entrust to us.

companyName: Kyndryl Holdings, Inc.

ticker: KD


text: We designed a multi-faceted risk-management approach based on the National Institute of Standards and Technology (NIST) Cybersecurity Framework and informed by other industry standards and industry-recognized practices to identify and address cybersecurity risks. Our key cybersecurity processes include the following:


text: Risk-based, layered controls – We regularly assess and adjust our technical controls and methods to identify, respond to and mitigate emerging cybersecurity risks and use a layered approach with overlapping controls to defend against cybersecurity attacks and threats to our networks, end-user devices, servers, applications, data and cloud solutions and the data that our customers entrust to us.


text: Cybersecurity incident response plan and testing – We have a global incident response process and a dedicated team responsible for monitoring, detecting and responding to cybersecurity threats and attacks, whether external or internal, coordinating across multiple functions, periodically testing our protocols and regularly communicating and providing reports to our CISO.


text: Information sharing and collaboration – We utilize threat intelligence and security information collected from various sources, including but not limited to partners, suppliers, governments and information sharing and analysis centers, to identify, protect against, detect and respond to potential cybersecurity threats and events.


text: We use a combination of online training, including mandatory annual cybersecurity and privacy courses, educational tools, videos and other ongoing awareness initiatives, including phishing simulation exercises, throughout the year to foster a culture of security awareness and responsibility among our workforce.


text: Third-party supplier risk assessments – Recognizing that our suppliers can be subject to cybersecurity incidents which may impact us and our customers, our procurement process includes security and risk assessments to identify and evaluate risk associated with certain key suppliers, including reviewing relevant cybersecurity certifications and third-party audit results, assessing technical and organizational controls and evaluating their risk profile.


text: We periodically engage third-party security consultants to conduct evaluations of our cybersecurity controls and procedures, including through penetration testing, third-party audits or consulting on best practices to address new challenges. These evaluations include testing the design and operational effectiveness of our cybersecurity controls and procedures. Our internal audit function conducts additional reviews and assessments of our cybersecurity controls and procedures. Certain results of such assessments and reviews are reported to the Audit Committee and the Board of Directors as appropriate. We use the findings from these efforts to improve our practices, procedures, and technologies.


text: Cybersecurity Risk Oversight and Governance Our Board of Directors is responsible for the overall oversight of our enterprise risk management. The Audit Committee semi-annually reviews the Company's enterprise risk management framework, including enterprise risk management processes, and assists the Board of Directors in its oversight over certain key areas of risks, including overseeing cybersecurity, data governance and privacy risk and regularly reporting on such matters to the Board. The Audit Committee and full Board of Directors receive periodic updates from our CISO about Kyndryl's cybersecurity policies and practices, cybersecurity developments, trends, risks, notable incidents, mitigation strategies, maturity initiatives and other developments throughout the year, as well as periodic updates from our CIO, Security & Resiliency global practice leader and other senior leaders on cybersecurity-related matters.


text: Our information security program is led by our CISO, who reports to the CIO. Our CISO organization collaborates closely with key stakeholders across the businesses, including our Security & Resiliency and other global practice organizations, in developing and implementing our cybersecurity strategy, policy, operations, threat detection and incident response and remediation. Our information security teams that support these efforts are comprised of cybersecurity professionals with many years of experience in cybersecurity across multiple sectors, including heavily regulated industries such as financial services and defense, and many of them hold relevant industry certifications.


text: Under our global incident response process, cybersecurity incidents are assessed and classified by severity, and significant incidents are escalated as appropriate to senior executive leadership. In addition, we have a risk-based escalation process outside of our regular reporting process to promptly notify the Board of Directors in the event of any material cybersecurity incident impacting the Company.


text: Based on the information we have as of the date of this Form 10-K, we do not believe that any cybersecurity incident experienced by the Company has materially affected or is reasonably likely to materially affect Kyndryl, including our business strategy, results of operations or financial condition. For additional information about cybersecurity risks, s ee Item 1A. "Risk Factors."


text: Juniata's risk management program is designed to identify, assess and mitigate risks across various aspects of the Company, including credit, market, treasury, operational, compliance and reputational. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential for a cybersecurity incident to occur, which could disrupt business operations or compromise sensitive data. Juniata's Information Security Officer ("ISO") and SVP/IT Manager are primarily responsible for this cybersecurity component and are key members of the organization, both of which have a clear line of reporting directly to the board of directors and involved with the Information Technology ("IT") Steering Committee. To date, the Company has not, to its knowledge, experienced an incident materially affecting or reasonably likely to materially affect the Company.

companyName: JUNIATA VALLEY FINANCIAL CORP

ticker: JUVF


text: To prepare and respond to incidents, the Company has implemented a multi-layered cybersecurity program that is intended to comply with Gramm-Leach-Bliley Act 12 CFR 364, Appendix B, integrating people, technology, and processes. This includes employee training, the use of innovative technologies, and the implementation of policies and procedures in the areas of Information Security, Data Governance, Business Continuity and Disaster Recovery, Privacy, Third-Party Risk Management, and Incident Response. Juniata's objective for managing cybersecurity risk is to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse its systems or information. The cybersecurity program is built upon a foundation of advanced security technology, its internal employee team, and operations based on industry best practices recommendations from the Federal Financial Institutions Examination Council ("FFIEC") Guidelines and Cybersecurity Assessment Tool ("CAT"). This consists of controls designed to identify, protect, detect, respond and recover from information and cyber security incidents. Juniata's SVP/IT Manager and ISO, who report directly to the Board of Directors, along with key members of their teams, regularly collaborate with peer banks, industry groups, and policymakers to discuss cybersecurity trends and issues and identify best practices. The information security program is periodically reviewed by such personnel with the goal of addressing changing threats and conditions.


text: The Company also employs a variety of preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on suspected advanced persistent threats. The Company established processes and systems designed to mitigate cyber risk, including regular and on-going education and training for employees, preparedness simulations and tabletop exercises, and recovery and resilience tests. Juniata engages in regular assessments of its infrastructure, software systems, and network architecture, using internal cybersecurity experts and third-party specialists. The Company also actively monitors its email gateways for malicious phishing email campaigns and remote connections as some of its workforce has the option to work remotely.


text: The Company relies on third-party vendor solutions to support its operations. Many of these vendors, especially in the financial services industry, have access to sensitive and proprietary information. To mitigate the operational, informational and other risks associated with the use of vendors, the Company maintains a Vendor Management Policy, which includes a detailed onboarding process and periodic reviews of vendors with access to sensitive Company data. The Vendor Management Policy applies to any business arrangement between the Company and another individual or entity, by contract or otherwise, in compliance with the FFIEC guidelines for third-party risk management. The Vendor Management Policy is audited periodically in accordance with the board of directors approved Internal Audit plan.


text: Juniata leverages internal and external auditors and independent external partners to periodically review its processes, systems, and controls, including with respect to its information security program, to assess their design and operating effectiveness and make recommendations to strengthen its information security and risk management programs. Regular internal monitoring is integral to the Company's risk assessment process, which includes regular testing of internal key controls, systems, and procedures. In addition, independent third-party penetration testing of the effectiveness of security controls and preparedness measures is conducted at least annually or more often, if warranted by the risk assessment or other external factors. Management determines the scope and objectives of the penetration analysis.


text: The Company maintains a Business Continuity Plan (the "Plan") that provides a documented framework for responding to actual or potential cybersecurity incidents, including timely notification of and escalation to the appropriate board of directors-approved management committees, as discussed further below, and to the IT Steering Committee. The Plan is coordinated through the SVP/IT Manager and ISO and key members of management are embedded into the Plan by their design. The Plan facilitates coordination across multiple parts of the Company and is evaluated at least annually.


text: Identifying the appropriate team and any appropriate sub-teams to address specific information and/or cyber security incidents, or categories of information and/or cyber security incidents.


text: Coordinating Incident Response or Crisis Management activities, including developing, maintaining, and following appropriate procedures to respond to and document identified information and/or cyber security incidents.


text: Conducting post-incident reviews to gather feedback on information and/or cyber security incident response procedures and address any identified gaps in security measures. Providing training and conducting periodic exercises to promote employee and stakeholder preparedness and awareness of the Plan.


text: Reviewing the Plan at least annually, or whenever there is a material change in the Company's business practices that may reasonably affect its cyber incident response procedures.


text: Notwithstanding Juniata's defensive measures and processes, the threat posed by cyber-attacks is severe. Juniata's internal systems, processes, and controls are designed to mitigate loss from cyberattacks and, while it has experienced cybersecurity incidents in the past, to date, risks from cybersecurity threats have not materially affected the Company.


text: The Company's ISO is accountable for managing enterprise information security and delivering the information security program. These responsibilities include cybersecurity risk assessment, defense operations, cyber incident response, vulnerability assessment, threat intelligence, identity access governance, and the evaluation of third party risk management and business resilience as it relates to the cybersecurity program.


text: The foregoing responsibilities are covered on a day-to-day basis by the SVP/IT Manager and ISO. The ISO has substantial relevant expertise and formal training in the areas of information security and cybersecurity risk management, including 22 years of cybersecurity experience, 18 of which was spent at a CPA firm specializing in banking industry financial and information technology audits.


text: The ISO provides guidance, oversight, monitoring and challenge of the first line's activities. The second line of defense function is separated from the first line of defense function through organizational structure and ultimately reports directly to the board of directors.


text: The Company has established the IT Steering Committee, which focuses on technology and business impact, and the Audit Committee of the board of directors, which focuses on the identification, monitoring, assessment, and management of risk associated with its cyber and information security programs. These committees provide oversight and governance of the technology program and the information security program and include the ISO and SVP/ IT Manager, respectively, and other key departmental managers throughout the entire company. The IT Steering Committee meets at least quarterly, and the Audit Committee meets at least quarterly to provide oversight of the risk management strategy, standards, policies, practices, controls, and mitigation and prevention efforts employed to manage security risks. More frequent meetings occur from time to time in accordance with the Incident Response Plan (part of the Plan) to facilitate timely informing and monitoring efforts. The ISO reports summaries of key issues, including significant cybersecurity incidents, discussed at committee meetings and the actions taken to the IT Steering Committee on at least a quarterly basis, or more frequently as may be required by the Incident Response Plan, and the board of directors on at least an annual basis.


text: The IT Steering Committee is responsible for overseeing the Company's information security and technology programs, including management's actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks. The ISO and SVP/IT Manager provide quarterly reports to the IT Steering Committee regarding the information security program and the technology program, key enterprise cybersecurity initiatives and other matters relating to cybersecurity processes. The IT Steering Committee reviews and approves the information security and technology budgets and strategies annually. Additionally, the Audit Committee reviews key metrics summarizing the Company's cyber security risk profile on a quarterly basis. The IT Steering Committee and Audit Committee each provide a report of their activities to the full board of directors at least annually.


text: Lastly, at least annually, the ISO reports directly to the board of directors the overall status of the Information Security Program and the Company's compliance with the Interagency Guidelines for Safeguarding Customer Information. Any material findings related to the risk assessment, risk management and control decisions, service provider arrangements, results of testing, security breaches or violations are discussed as are management's responses and any recommendations for program changes.


text: We have established a robust framework for the assessment, identification, and management of material risks arising from cybersecurity threats. Our approach to cybersecurity risk management includes ongoing assessments of potential threats and vulnerabilities, coupled with the implementation of safeguards and controls to mitigate these risks. We maintain vigilance over the cybersecurity landscape to identify emerging threats, adapting our strategies accordingly. Our cybersecurity risk management process includes: Regular risk assessments to systematically identify and prioritize cybersecurity risks; Implementation of advanced technical controls, encryption, and intrusion detection systems to safeguard sensitive data; Employee training and testing programs designed to enhance awareness about cybersecurity best practices;

companyName: URBAN ONE, INC.

ticker: UONE


text: Collaboration with third-party cybersecurity experts for conducting penetration testing; vulnerability assessments and providing support in the triage of any cybersecurity event; and Select processes to review and manage the risks associated with third-party service providers.


text: We acknowledge the potential material impact that cybersecurity threats and incidents can have on our operations, financial condition, and reputation. While we did not experience any significant cybersecurity incidents during the reporting period, we recognize that such incidents could include: Disruption of our operations, potentially leading to revenue loss;


text: Unauthorized access to or theft of sensitive customer information, resulting in legal and regulatory implications; and Damage to our brand and reputation, which could affect customer trust and investor confidence.


text: Our Board of Directors plays a significant role in overseeing our cybersecurity risk management efforts. The Board receives periodic updates from the Chief Information Officer ("CIO") on our cybersecurity posture, encompassing reports on potential threats, vulnerabilities, and the efficacy of our risk mitigation measures. These updates are provided based on internal reports from the tools employed and managed by the IT organization and reports generated by a managed security service provider overseen by the Chief Information Security Officer ("CISO"). The Board is committed to ensuring that cybersecurity is a priority for the organization, providing the necessary resources and expertise to address evolving threats effectively.


text: Our management team is actively involved in the assessment and management of cybersecurity risks. We have a CIO overseeing the Company's technology infrastructure and a designated a CISO responsible for cybersecurity program oversight. The CISO possesses over two decades of comprehensive experience in the information technology landscape, augmented by a robust background in program management. With a portfolio enriched by industry certifications and advanced academic degrees, including an MBA, the CISO stands as a seasoned leader within our corporate information security domain. The CISO collaborates with cross-functional teams to implement and uphold our cybersecurity policies and practices. Our executive leadership team is aligned with our cybersecurity objectives and regularly reviews our cybersecurity-related initiatives.


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, internal operational risks; system security risks; data protection; risks to proprietary business information; intellectual property theft; fraud; extortion; harm to employees, partners, or customers; violation of privacy or security laws and other litigation and legal risk; and reputational risks. We have implemented several cybersecurity processes, technologies, and controls to aid in our efforts to identify, assess, and manage such material risks.

companyName: GSI TECHNOLOGY INC

ticker: GSIT


text: To aide in identifying and assessing material risks from cybersecurity threats, our Enterprise Risk Management program considers cybersecurity risks alongside other significant company risks as part of our overall risk assessment process. We employ a range of tools and services, including regular network and endpoint monitoring and vulnerability assessments to inform our professionals' risk identification and assessment.


text: We manage these known risks by using internal security controls designed to align with standards set the International Organization for Standardization ("ISO"). In connection with the identification, assessment and management of material risks and cybersecurity threats, we also conduct the following activities at various intervals during the year: monitor emerging data protection laws and implement changes from time-to-time to our processes designed to comply with such laws; undertake regular reviews of our customer facing policies and statements related to cybersecurity;


text: run exercises to simulate a response to a cybersecurity incident and use the findings to improve our processes and technologies; run exercises to simulate a response to a cybersecurity incident to provide training to our cyber incident response team;


text: conduct a variety of information security and privacy trainings, including new employee training, job-specific security training, specialized training for IT and security personnel, and phishing simulations; and carry information security risk insurance to help defray potential losses that might arise from a cybersecurity incident.


text: Our cybersecurity incident response plan was developed to respond to the threat of security breaches, the threat of cyberattacks, and to protect and preserve the confidentiality, integrity, and continued availability of information owned by, or in the care of, the Company. Our incident response plan coordinates the activities that we take to prepare for, detect, respond to, and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate material cybersecurity incidents to our global crisis management plan, contain, investigate, and remediate the incident.


text: We regularly engage with auditors to review our cybersecurity program to help identify areas for continued focus, improvement and compliance.


text: In our risk factors, we describe how potential risks from cybersecurity threats may affect us, including our business strategy, results of operations, or financial condition. See our risk factor disclosures at Item 1A of this Annual Report on Form 10-K.


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board of Directors and management. The Board has oversight responsibility for the Company's Enterprise Risk Management framework. The Board as a whole and through the various Board committees oversees the Company's management of material enterprise level risk, focusing on four areas of risk: strategic, compliance, operational, and financial. To fulfill its oversight responsibility, the Board also regularly reviews, consults, and discusses with management on strategic direction, challenges, and risks faced by the Company. Board members, including members of the Audit Committee, have expertise and/or operational experience in cybersecurity matters. We are committed to maintaining robust governance and oversight of these risks and to implementing mechanisms, controls, technologies, and processes designed to help us assess, identify, and manage these risks.


text: As part of our entire Board's operational risk management responsibilities, it has oversight of risks from cybersecurity threats. The Audit Committee has been designated with the responsibility to regularly review the Company's processes and procedures around managing cybersecurity threat risks and cybersecurity incidents. As discussed below, members of management report to the Audit Committee which reports to the entire Board about cybersecurity threat risks, among other cybersecurity related matters, at least annually.


text: In support of the Board's oversight of the Company's cybersecurity risk management program, the Audit Committee receives quarterly cybersecurity updates from members of management. These updates include topics, such as threat risk management updates, the results of exercises and response readiness assessments, our incident response plan, and steps management has taken to respond to such threat risks, if any.


text: Members of the Board and Audit Committee are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.


text: We face various cybersecurity threats, including denial-of-service attacks, ransomware, phishing, and advanced persistent threats. In addition, as an aerospace and defense company that provides sophisticated defense products and services to the U.S. and foreign governments, we are also subject to cybersecurity risks from organized adversaries, including groups affiliated with various nation states. Our customers, suppliers, subcontractors and vendors also face similar threats. Cybersecurity incidents impacting us or any of these third parties could have a material adverse effect on our operations, financial condition and results of operations. Given the cybersecurity risks we face, we believe it is imperative that we dedicate ample resources to addressing and mitigating our cyber risks.

companyName: AeroVironment Inc

ticker: AVAV


text: Our cybersecurity program is designed to identify, detect, protect against, respond to, and recover from cyber risks from the cyber threats we face. Our cybersecurity program is part of our internal risk management processes. We continually improve and revise our cybersecurity practices as new threats and vulnerabilities emerge.


text: Our Chief Information Security Officer ("CISO") and our Director of Global Cybersecurity ("Cybersecurity Director") lead our Detection and Response Team ("DART"), which is responsible for our cybersecurity incident response processes pursuant to our Incident Response Plan and playbooks. The DART consists of members of our IT department responsible for protecting against, detecting, containing, mitigating, and recovering from cybersecurity incidents. The DART evaluates and assigns severity levels to cybersecurity incidents, and based on the severity, escalates and engages incident response teams based on severity, and responds to and mitigates the related risks.


text: Our cybersecurity team proactively hunts for cyber threats and vulnerabilities in our networks and information systems as part of our cyber risk management program, including by monitoring our networks and systems for intrusions and other suspicious activity. The cybersecurity team stays apprised of existing and emerging cybersecurity threats, including by partnering with third parties, such as the U.S. government, law enforcement agencies, customers, and other defense industry participants to share and receive information on emerging threats and expanding our cybersecurity knowledge and global monitoring practices. We also engage third parties to conduct evaluations of our cybersecurity controls, such as penetration testing and controlled cybersecurity framework audits. We also review the cybersecurity practices of our third-party service providers.


text: We have aligned our cybersecurity program to the National Institute of Standards and Technology's ("NIST") published cybersecurity standards and our policies and processes are compliant with NIST Special Publication 800-171 and other applicable publications. Given our status as a defense contractor, we are subject to numerous regulations, including those pursuant to the Defense Federal Acquisition Regulation Supplement, ("DFARS") requiring us to have controls in place to protect U.S. Government controlled unclassified information ("CUI") and to report cybersecurity incidents to the DoD. We will also be subject to the DoD Cybersecurity Maturity Model Certification ("CMMC") requirements, which will require companies like AeroVironment that do business with the DoD to obtain specific third-party certifications relating to specified cybersecurity standards to be eligible for new contract awards. We are in the process of preparing for the CMMC requirements. While we believe we are in a good position to meet the requirements of CMMC, if we fail to achieve certification in advance of contract awards, or we fail to achieve certification at the level required for a particular contract award, we will be unable to bid on such contract awards or follow-on awards for existing work with the DoD, which could adversely impact our results of operations. Additionally, our subcontractors, and certain of our vendors, may also need to comply with CMMC requirements and, potentially obtain CMMC certification. We may be negatively impacted if our subcontractors or vendors are not compliant with CMMC requirements.


text: We require our employees to take cybersecurity-related training regularly that promotes awareness of how to detect, report, and respond to cybersecurity threats. Employees with certain roles and responsibilities are also assigned cyber training for their specific functions. We also maintain an Insider Threat program, headed by our Director of Security, to identify, assess and deal with potential risks from within our company, including cyber risks.


text: Our CISO and our Cybersecurity Director are responsible for the day-to-day management of our cybersecurity program and cybersecurity risks. Our CISO, who has approximately 24 years in various information technology and cybersecurity roles, and our Cybersecurity Director, who has approximately 20 years of experience in various cybersecurity roles, are primarily responsible for our overall cybersecurity risk management program and supervise both internal and external resources to identify, protect against, detect, respond to, and recover from cybersecurity risks, threats, and incidents.


text: Our Cybersecurity Director leads our internal Cybersecurity Council, which meets monthly to help implement management's cybersecurity strategy and to monitor and manage our cybersecurity threats and risks. Our Cybersecurity Council consists of the Cybersecurity Director, CISO, Chief Financial Officer, General Counsel and Chief Compliance Officer, Chief Technology Officer, Vice President of Internal Audit, Vice President of Global Supply Chain, Director of Security, and Sr. Manager of Contracts Operations and Compliance. The CISO and/or Cybersecurity Director report cybersecurity incidents to members of the company's senior management, including the Cybersecurity Council, and/or the Board of Directors based on the severity and type of the incident to ensure that proper external reporting is completed thoroughly and timely. Pursuant to its charter, the Cybersecurity Committee of our board of directors is responsible for reviewing, discussing, and making recommendations to the full board of directors regarding cybersecurity matters. Our CISO and Cybersecurity Director provide presentations to the Cybersecurity Committee on our cybersecurity program at each of the committee's regularly scheduled quarterly meetings. These briefings include assessments of the cyber risk and threats landscape, updates on incidents, policies and procedures, and our investments and plans in cybersecurity risk mitigation and governance. The Cybersecurity Committee also meets with members of the Cybersecurity Council to discuss various aspects of our cybersecurity program in between regular meetings. All members of the board of directors are invited to attend all meetings of the Cybersecurity Committee and the committee regularly briefs the entire board of directors regarding their oversight of our cybersecurity program.


text: We have experienced cybersecurity incidents in the past and will experience cybersecurity incidents in the future. Prior cybersecurity incidents have not materially affected, or are reasonably likely to affect, our business strategy, results of operations or financial condition, however, there is no guarantee that a future cybersecurity incident would not have a material adverse effect on such items. While we believe our cybersecurity program is designed to mitigate cybersecurity risks, we cannot eliminate all risks from cybersecurity threats. See Item 1A. Risk Factors for more information on our cybersecurity risks.


text: Risk Management and Strategy Assessing, Identifying and Managing Material Risks Our cybersecurity program is focused on assessing, identifying, and managing risks arising out of our use of information technology including the risk of cybersecurity incidents and threats. Our program is informed by recognized frameworks (such as the U.S. Department of Commerce's National Institute of Standards and Technology Cybersecurity Framework) and leverages external and internal expertise. Our program is integrated into our operations and is widely communicated to employees through annual employee and contractor cybersecurity awareness training, regular awareness exercises, and employee outreach activities including cybersecurity tech talks, on-site digital signage, intranet resources, CEO cybersecurity champion recognition at quarterly town hall meetings, and other targeted communications. These awareness measures are coupled with ongoing implementation of technology aimed to reduce vulnerabilities (including external testing and validation) and to monitor and assess threats. Our program includes monitoring on an ongoing basis by automated tools that detect threats and trigger alerts for assessment, investigation, and remediation by our internal cybersecurity team.

companyName: CONAGRA BRANDS INC.

ticker: CAG


text: Integration with Enterprise Risk Management The cybersecurity program is an important part of the Company's enterprise risk management (ERM), with our Senior Vice President & Chief Information Officer serving on our ERM Committee and our Vice President of ERM serving as the strategic crisis management coordinator under our cybersecurity incident response plan. We have developed processes for managing cybersecurity incidents including clear allocation of responsibilities and defined incident classifications, escalation requirements based on materiality, and prioritization parameters. Our cybersecurity incident response plan is integrated into our ERM Committee risk mitigation action plan process, our Senior Leadership Team (SLT) strategic crisis management action plan process, and our Disclosure Committee protocol for cybersecurity incidents. We also maintain business continuity and disaster recovery plans to prepare for potential information technology disruptions.


text: Cybersecurity Program Components Our cybersecurity program structure consists of our cybersecurity operations center; identity and access management; governance, risk, and compliance; architecture; and operational technology. Aspects of our program include:


text: Activities to assess vulnerabilities including penetration testing, red teaming, tabletop exercises, and phishing and social engineering drills Engagement with law enforcement and U.S. government agencies, directly and through memberships in various cybersecurity intelligence and risk sharing organizations to help us stay informed about evolving threats Utilization of third-party experts to test, validate, and strengthen our plans, practices, and policies Technology team collaboration sessions to share information across different teams, geographic areas, and areas of responsibilities Assessing and managing cybersecurity risks arising out of the use of third-party technology and services, including pre-contract diligence, imposition of contractual obligations, and performance monitoring Learnings from these activities are used to inform our training, guide our incident response preparedness and enhance our plans and processes. We have also participated in discussions with third-party service providers who have experienced cybersecurity incidents to inform our cybersecurity program.


text: Investment in Cybersecurity Program The cybersecurity threat landscape is dynamic and volatile, and requires significant investment on the part of the Company in terms of investing in our employees through talent recruitment, retention, training and development, investing in external resources including procuring and deploying the correct tools to monitor, evaluate, and address threats, investing employee resources to maintain effective processes, and investing in strategic relationships to monitor evolving risks including third-party service provider vulnerabilities. While our third-party services providers have experienced cybersecurity incidents and we have experienced threats to our data and systems, to date, we are not aware that we have experienced a breach that had a material impact on our operations or business, however, cybersecurity risks that may materially impact the Company are discussed in more detail in Item 1A of Part I, "Risk Factors," under the heading "Cybersecurity and Information Technology Risks," which should be read in conjunction with the foregoing information.


text: Our management is responsible for identifying, assessing, and managing our exposure to cybersecurity risk. Management identifies and assesses risks through its cross functional ERM committee that is responsible for: Facilitating risk conversations with cross-functional leaders and teams


text: Partnering with risk owners to develop risk management action plans focused on mitigating the drivers of the enterprise risks Identifying key metrics to objectively assess the risk to the Company applying both a short-term and long-term perspective Informing our strategic planning based on risks assessments after consideration of action plans and residual risk Developing a risk-aware culture throughout the organization Our Board of Directors and its Audit / Finance Committee play an active part in overseeing cybersecurity risks relevant to the Company. The Board and its Audit / Finance Committee routinely receive reports from our management and external advisors on critical risk areas.


text: The Company maintains a dedicated internal cybersecurity team that is supported by internal and external software, third-party experts, and threat intelligence resources. Members of our cybersecurity team provide cybersecurity reports to our Board, SLT, and cross-functional leaders and teams. The internal cybersecurity team is responsible for implementing our cybersecurity strategy including policies, standards, architecture, and processes including our processes for identifying cybersecurity risks and threats and recommending mitigating actions to strengthen cybersecurity resilience. In addition, our internal cybersecurity team is responsible for managing detection, mitigation, and remediation of all cybersecurity incidents.


text: Conagra's Cybersecurity Team is led by our Chief Information Security Officer (CISO). Our CISO, a certified information security professional, has over 25 years of cybersecurity leadership experience across multiple industries and holds a Doctor of Science (DSc) degree in Cybersecurity. The CISO reports to our Chief Information Officer (CIO), who has been with Conagra for more than 20 years serving in various leadership roles in information technology, finance, and business services. We believe our CIO possesses a firm understanding of the Company's cybersecurity landscape, risks, and knowledge of the capabilities of our cybersecurity and information systems personnel.


text: Additionally, members of our internal cybersecurity team have experience in cybersecurity risk management, threat monitoring, threat emulation, penetration testing, cyber incident response management, and data protection. Team members have both individual responsibilities and a team focus, and manage both internal and third-party cybersecurity risk mitigation, covering areas such as network, endpoint device, and e-mail security as well as operations and threat management, monitoring, and response. Our CISO, CIO and CFO are responsible for determining that the Company has appropriate people, process and technology capabilities to identify, mitigate and report on cybersecurity risks to the SLT and Board of Directors.


text: Our cybersecurity incident response plan provides that our ERM, strategic crises management coordinator is informed about significant cybersecurity incidents for escalation to our internal Incident Disclosure Committee, SLT, and Board, as appropriate in accordance with our strategic crisis management action plan. Our cybersecurity incident response team is responsible for maintaining our cybersecurity incident response plan, which is periodically tested through our tabletop exercises. We have involved outside experts, our strategic crises management coordinator, members of our SLT, and members of our Incident Disclosure Committee in our tabletop exercises and preparedness drills to strengthen these response plans.


text: Additionally, our Corporate Cybersecurity Steering Committee, chaired by the CISO and whose members include our Senior Vice President, Corporate Controller (our principal accounting officer), as well as other members of the information technology, finance, supply chain, security and facilities, research and development, product, human resources, and legal teams, meets regularly to provide a forum for senior leaders and key stakeholders to strengthen their understanding and strategize on managing cybersecurity challenges at the Company.


text: Board of Directors and its Audit/Finance Committee Our Board and its Audit/Finance Committee exercises oversight over our enterprise risk management including our cybersecurity program. The Audit/Finance Committee receives updates from our CIO or CISO at each of its regularly scheduled meetings regarding matters related to information technology and cybersecurity including the state of the Company's cybersecurity programs, emerging cybersecurity developments and threats, and the Company's strategy to mitigate cybersecurity risks. Additionally, our full Board receives reports on our cybersecurity program at least annually which includes a review of our cybersecurity incident response plans which are described above.


text: Cyber Risk Management Strategy Adtalem recognizes the importance of safeguarding sensitive information pertaining to our students, employees, institutions, and operations. Our Cyber Risk Management Framework is designed to fortify our defenses against potential cyber threats and to protect the integrity, confidentiality, and availability of critical data.

companyName: Covista Inc.

ticker: CVSA


text: Program Highlights Our program is anchored by our Enterprise Information Security Framework ("EISF"), which adheres to the guidelines set forth by the National Institute of Standards and Technology ("NIST") 800-53 Framework. To enhance comprehensiveness, our policies also harmonize with other leading frameworks such as the ISO 27001 Standard, Family Educational Rights and Privacy Act of 1974 ("FERPA"), Payment Card Industry Data Security Standard ("PCI DSS"), Gramm-Leach-Bliley Act ("GLBA"), California Consumer Privacy Act ("CCPA"), General Data Protection Regulation ("GDPR"), and other pertinent local, state, national, and international regulations governing data privacy and information security.


text: Our Chief Information Security Officer ("CISO") manages Adtalem's enterprise-wide cybersecurity program and reports to Adtalem's Chief Financial Officer. The CISO has been responsible for assessing and managing material risks from cybersecurity threats at Adtalem since 2018. The CISO has over twenty years of information technology and cybersecurity experience, including executive leadership roles at Fortune 500 organizations within regulated sectors including financial services and healthcare. The CISO leads a team of experienced subject matter experts with focus on strategy formulation, architecture design, incident response, colleague training, risk management, and governance functions. This team includes diverse industry backgrounds spanning Financial Services, Healthcare, and Government.


text: The CISO team is supported by a Security Operations team reporting into the Information Technology ("IT") function. This IT team provides engineering and technical expertise. The team is further supported by a 24x7 Security Operations Center ("SOC"). Adtalem has a Cyber Incident Response Plan ("Response Plan") that delineates the requirements of notification, classification, analysis, and communication of cybersecurity incidents based on the identified severity level. The Response Plan includes initial steps to convene a response team, contain the incident, consider insurance notification requirements, determine the type of incident and escalation, consider the communications protocol and possible disclosure requirements, and consider involving law enforcement. The Response Plan also provides for a lessons learned review to identify improvements that could be made. Adtalem's Legal and Compliance teams also provide incident response support to the CISO and manage cybersecurity-related legal and compliance issues. Processes are in place to escalate cybersecurity incidents promptly so that decisions regarding public disclosure and regulatory reporting can be made by management in a timely manner.


text: An integral component of Adtalem's Response Plan is our Privacy Incident Response Plan (the "Privacy Response Plan") which addresses privacy of our students' records, including under the Family Education Rights and Privacy Act of 1974. The Privacy Response Plan requires annual training for our employees on how to recognize and report potential privacy incidents.


text: We regularly conduct Cyber Incident Response Plan (the "Incident Response Plan") tabletop exercises, including simulations of malware and ransomware attacks. Our IT environment and cybersecurity-related controls are reviewed by our internal audit function and external third parties. We sponsor third-party assessments, including cyber risk reviews and penetration testing, to evaluate our cybersecurity program independently.


text: Adtalem subjects its systems to penetration testing to identify potential exposures, ensuring that our infrastructure maintains an acceptable level of cyber risk. In addition, Adtalem leverages third-party experts to enhance its cybersecurity program and Incident Response Plan. Our organization has not identified or discovered any cybersecurity threats over the past three fiscal years that have materially impacted or are reasonably likely to materially impact our business strategy, operations, or financial condition. Expenses related to cybersecurity incidents have been immaterial.


text: Our year-round cybersecurity awareness program mandates training for all system users, covering essential topics such as safeguarding sensitive information, identifying phishing attempts, securing mobile devices, and understanding the risks associated with artificial intelligence ("AI") platforms. Recognizing the importance of third-party risk, our strategic sourcing protocols mandate detailed cybersecurity assessments for potential third-party suppliers. New engagements with third parties are contingent upon affirmative evaluations or adherence to risk mitigation/acceptance protocols. Contracts with third parties include provisions for breach notification, investigation, root cause analysis, and remediation.


text: We maintain a cybersecurity insurance policy covering costs that we may incur in connection with incidents. Our policy limits are commensurate with the size and the nature of our operations. However, Adtalem may incur expenses and losses related to a cyber incident that are not covered by insurance or are in excess of our insurance coverage.


text: Cybersecurity is acknowledged as an important enterprise risk at Adtalem. Our Audit and Finance Committee ("AFC"), comprised entirely of independent directors, is responsible for oversight of risks from cybersecurity threats. The Chair of our AFC has received a CERT certificate in Cybersecurity Oversight from Carnegie Mellon University in partnership with the National Association of Corporate Directors. Our CISO briefs the AFC on cybersecurity matters, including the evolving threat landscape and Adtalem's threat mitigation efforts, four times a year. At each quarterly meeting, the Chair of our AFC also briefs the full Board on cybersecurity matters discussed at AFC meetings. Cybersecurity risks are also reviewed and discussed with the AFC and the full Board as part of our annual enterprise risk management ("ERM") assessment. In February 2024, our full Board reviewed and discussed best practices for cybersecurity and cybersecurity disclosures with an external third party. The subsequent Board discussion included a focus on the cyber threat landscape, responses to cyberattacks, risks posed by third-party vendors, and best practices to address cyber risks.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: Stride, Inc.

ticker: LRN


text: Our cybersecurity risk management program is guided by the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) and the National Institute of Standards and Technology Special Publication (SP) 800-53. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF and SP 800-53 as a framework to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Key elements of our cybersecurity risk management program include: risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment;


text: a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents;


text: the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; cybersecurity awareness training of our employees, including incident response personnel, and senior management;


text: a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and a third-party risk management process for key service providers, suppliers, and vendors based on our assessment of their criticality to our operations and respective risk profile.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – We operate in markets that are dependent on Information Technology (IT) systems and technological change. Failure to maintain and support customer facing services, systems, and platforms, including addressing quality issues and execution on time of new products and enhancements, could negatively impact our revenues and reputation" and "Risk Factors – The failure to prevent a cybersecurity incident affecting our systems could result in the disruption of our services and the disclosure or misappropriation of sensitive information, which could harm our reputation, decrease demand for our services and products, expose us to liability, penalties, and remedial costs, or otherwise adversely affect our financial performance".


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to its Audit Committee (the "Committee") oversight of cybersecurity and other information technology risks, including oversight of management's implementation of our cybersecurity risk management program.


text: The Committee receives regular reports from management on our cybersecurity risks. In addition, management updates the Committee on any incidents it considers to be significant or potentially significant.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program.


text: Our management team, including our Chief Information Security Officer (CISO), is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our CISO has more than 20 years of experience managing the security and compliance organization for global companies, providing online and cloud-based services to more than a majority of the Fortune 500 and the United States Government.


text: Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our IT environment.


text: We have established processes for assessing, identifying and managing cybersecurity risks, which are built into our information technology function and are designed to safeguard our information assets and operations from internal and external cyber threats, including protecting employee and patient information from unauthorized access to or attacks on our networks and systems. These processes include physical, procedural and technical safeguards, response plans, regular tests on our systems, incident simulations and routine reviews of our policies and procedures to identify risks and enhance our practices. We also employ processes to identify material risks from cybersecurity threats associated with our use of third-party service providers.

companyName: CytoDyn Inc.

ticker: CYDY


text: We have engaged external parties, including risk management consultants and computer security firms, to enhance our cybersecurity oversight. In an effort to deter and detect cyber threats, we periodically provide training programs to our employees on issues related to privacy and data protection, cybersecurity risks, and the importance of reporting all incidents immediately. Topics include identifying phishing, password protection, securing confidential data, and mobile security. In addition, we use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs. We also perform annual vulnerability assessments, conducted by independent, third-party cybersecurity firms.


text: Additionally, as part of our overall risk mitigation strategy, the Company obtains certain insurance policies. However, such insurance may not be sufficient in type or amount to cover us fully against claims related to security breaches, cyber-attacks and other related breaches.


text: The Audit Committee of our Board of Directors provides direct cybersecurity risk oversight. Our management provides timely disclosure and related updates to the Audit Committee regarding potential cybersecurity threats, incidents and general risks.


text: Our management periodically evaluates information provided by its consultants on evolving cybersecurity risks and, based on its assessment of the processes the Company has put in place, does not believe there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations, or financial condition.


text: Governance and Oversight Bio-Techne's cybersecurity program is led by the Company's Chief Information Security Officer ("CISO"), with day-to-day management and administration of our cybersecurity program performed by the IT Security Operations team. The CISO reports to the Chief Information Officer ("CIO"), and the CIO reports to the Chief Executive Officer. The CISO is supported by the Incident Response Team ("IRT"), a multi-disciplinary management committee comprising senior members from the Security Operations Team, legal, finance, internal audit and other functions. The IRT supports the CISO and CIO in supporting and reviewing information security risks and in the event of a cybersecurity incident provides leadership with respect to incident response, investigation, mitigation and remediation. In addition to leadership and support within management, we also work with security service providers to monitor for vulnerabilities and threats, and which are reported to the Security Operations team. All employees are trained and tested annually on cybersecurity risks, and we continually perform simulated phishing exercises with a focus on roles and functions with access to sensitive company and financial information. We also conduct periodic tabletop exercises for key personnel involved in cybersecurity risk management, including the IRT.

companyName: BIO-TECHNE Corp

ticker: TECH


text: Our Board of Directors ("Board") holds overall oversight responsibility for the Company's strategy and risk management, including in relation to cybersecurity risks. The Board exercises its oversight function through the Audit Committee, which oversees the management of risk exposure across various areas, including data security risks, in accordance with its charter. In addition, the Audit Committee is specifically responsible for the review and approval of any cybersecurity incident disclosure, as set forth in the Committee's charter. In the event of a potentially significant cybersecurity incident, the Audit Committee's charter requires that management promptly communicate and consult with the Audit Committee.


text: Bio-Techne's General Counsel updates the Audit Committee multiple times per year regarding Bio-Techne's cybersecurity programs, including regularly-tracked metrics on incident response, internal security testing, and measures implemented to monitor and address cybersecurity risks and threats, as appropriate. The Audit Committee regularly updates the full Board on these matters. In addition, the CISO and/or CIO provides the full Board with a thorough review of the Company's cybersecurity program, including current status, industry risks and exposure, and future strategy.


text: Based on the information we have as of the date of this Annual Report, we do not believe any risks from cybersecurity threats have materially affected or are reasonably likely to materially affect Bio-Techne, including our business strategy, results of operations or financial condition. However, please see Item 1A. Risk Factors – "A significant disruption in, or breach of security of, our information technology systems or data, or violation of data privacy laws, could result in damage to our reputation, data integrity and/or subject us to costs, fines, or lawsuits under data privacy or other laws or contractual requirements."


text: Cybersecurity Risk Management and Strategy Bio-Techne's cybersecurity strategy is to maintain and fortify a secure, actively-monitored environment for our and our customers' data that complies with legal requirements [and industry best practice] while supporting our and our customers' business needs. Our cybersecurity program follows industry standards and best practice for preventing, detecting, remediating, and mitigating potential cybersecurity threats, including regular processes to identify, evaluate and manage potential risks.


text: Our IT Security Operations team administers and monitors the prevention, detection, mitigation, and remediation of potential cybersecurity risks. This team leverages both Bio-Techne's internal IT resources, including its personnel, as well as managed security service providers and other third-party security software and technology services, as well as through other means. We also have implemented processes and technologies for network monitoring and data loss prevention procedures.


text: We conduct periodic risk assessments, including with support from external vendors, to assess our cyber program, identify areas of enhancement, and develop strategies for the mitigation of cyber risks. We also conduct regular security testing and have established a vulnerability management process supported by security testing, for the treatment of identified security risks based on severity, including risks arising from our use of third party providers software and service providers. In addition to our evolving processes and systems, we foster a culture of cybersecurity education, training, and testing. Every year, employees in sensitive job categories must take and pass rigorous information security and protection training.


text: We partner with experienced external consultants to assess our cybersecurity program, and to perform penetration testing as well as other testing programs designed to identify vulnerabilities and areas for fortification. Also, as part of our cybersecurity risk management program we maintain cyber insurance, with coverage amounts and terms that are typical and appropriate for a company of our size and type. This insurance may not be sufficient to cover us against all types of claims related to security breaches, cyberattacks and other related breaches.


text: As a leading global diversified animal health and mineral nutrition company, we are increasingly reliant on information technology systems and infrastructure to conduct critical operations and generally operate our business, which includes using information technology systems to process, transmit and store electronic information, including customer, employee and company data. The use of information technology systems makes us vulnerable to breaches of data security and cybersecurity attacks. For information on the potential risks related to cybersecurity, see "Item 1A. Risk Factors — Risk Factors Relating to Our Business — We may be subject to information technology system failures, network disruptions and breaches in data security."

companyName: PHIBRO ANIMAL HEALTH CORP

ticker: PAHC


text: Although the aggregate impact on our operations and financial condition has not been material to date, the Company has been the target of cybersecurity attacks and expects them to continue as such attacks are becoming more sophisticated and frequent, and the techniques used in such attacks change rapidly. Any such future incidents could have a material impact on our business.


text: Our information security team, headed by our Director of IT Cyber Security and Compliance, who reports to our Chief Information Officer ("CIO"), monitors our technology systems to prevent, detect, mitigate and remediate any cybersecurity incidents. Our enterprise-wide cybersecurity program is aligned with the U.S. National Institute of Standards Technology Cybersecurity Framework and the Israel National Cyber Directorate, and we are members of the New Jersey Cybersecurity and Communications Integration Cell. This collaboration enables us to increase our cybersecurity knowledge, threat awareness, and awareness of cyber incidents within the industry. It also helps us take proactive measures to prevent incidents by defining attack group identifiers and implementing learning and improvement processes.


text: We use tools and techniques to continually assess, monitor, manage, and mitigate security risks to our technology systems. Our processes extend to third-party service providers, who have access to data on our systems. We engage a third party to perform an independent assessment of our cybersecurity penetration test and risk assessment program at least once every two years.


text: Security Operations Center (SOC) and Managed Detection and Response (MDR) services to ensure continuous monitoring and response to potential threats.


text: A cyber training and awareness process based on an annual work plan, which includes monthly training, bi-weekly simulations, an interactive magazine sent once a month to all users and a cyber incident simulation for the infrastructure team. The contents are based on relevant market trends.


text: In cybersecurity or privacy incidents, the probable frequency and magnitude of loss are evaluated by the triage team. The incidents are categorized as either high- or low-level severity and communicated to the CIO and Chief Executive Officer and the Senior Vice President, General Counsel and Corporate Secretary ("Legal Counsel"), at which time a determination is made on any additional communication requirements. Our Board of Directors is notified of high-level severity incidents. Our approach to incidents generally includes a process of investigation, learning, and subsequent improvement. In addition, we believe cyber insurance is a key mechanism for supporting and managing critical cyber incidents. Aligning the policy involves a thorough review of our protection layers and processes.


text: Our information technology systems are managed by our CIO. He has over 45 years of experience in digital systems and technology in the animal health, bio-tech pharmaceutical, pharmaceutical and oil and gas industries. He has held multiple leadership roles driving business value for investments in digital solutions. He also spent six years as a leader within internal auditing, providing experience and wisdom in business-driven risk management.


text: The CIO provides periodic reports to the Board of Directors and the executive management team, including our Legal Counsel. These reports include updates on our cybersecurity risks and threats, assessments of our information security program, and any changes in the threat landscape. Our information technology systems are regularly evaluated by internal and external consultants with the results of the review reported to the executive management team and the Board of Directors.


text: Cybersecurity risk management is part of the Company's overall enterprise risk management program. Our cybersecurity risk management program is designed to provide a framework for handling cybersecurity threats and incidents, including those associated with the use of third-party services and service providers. This framework includes steps for assessing a cybersecurity threat's severity and source, including whether the cybersecurity threat is associated with a third-party service provider, implementing cybersecurity countermeasures and threat mitigation strategies, and informing management and our Board of material cybersecurity threats and incidents. To prevent and detect material cybersecurity incidents, our framework further includes, among other things, ongoing security awareness training for employees, regular cybersecurity risk and vulnerability assessments, and mechanisms to detect and monitor unusual network activity. We recognize the complex and evolving nature of cybersecurity threats and engage with various third-party service providers, including cybersecurity assessors and consultants, to evaluate and test our cybersecurity risk management systems. This enables us to leverage knowledge and insights to align our cybersecurity strategies and processes with best practices for our industry and size.

companyName: EVOLUTION PETROLEUM CORP

ticker: EPM


text: Our Board is ultimately responsible for overseeing our risk management, including cybersecurity risk management. Management is responsible for identifying, considering, and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, implementing appropriate mitigation measures, and maintaining cybersecurity programs. Our cybersecurity programs are under the direction of our Principal Financial Officer, who receives reports from our cybersecurity consultants and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents. Any significant cybersecurity incidents are reported to our independent Audit Committee and ultimately to our Board. There were no such cybersecurity incidents or threats that have materially impacted our business or operations. Management presents an assessment of our cybersecurity processes, procedures, and testing results to the Audit Committee at least annually.


text: Despite our efforts, we cannot eliminate all risks from cybersecurity threats nor provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see discussion captioned "Our business could be negatively affected by security threats. A cyber-attack or similar incident could occur and result in information theft, data corruption, operational disruption, damage to our reputation, and/or financial loss." in Item 1A. Risk Factors.


text: Protecting our business information, intellectual property, customer and employee data, and technology systems is crucial for our business continuity, regulatory compliance, and stakeholder trust. We have implemented enterprise cybersecurity risk mitigation and governance processes, detailed in our Information Security Protection Program ("Security Plan"). Our strategy is guided by the Security Plan's principles, which involve monitoring threats and vulnerabilities, assessing and monitoring related controls, and supporting the Chief Information Security Officer (CISO). Our cybersecurity policies, standards, processes, and practices are integrated into our overall risk management system to enhance our ability to protect our operations and information. This includes annual cybersecurity reporting to the board of directors by senior leadership.

companyName: EGAIN Corp

ticker: EGAN


text: We engage third-party providers to conduct evaluations of our security controls, through penetration testing, independent audits or consulting on best practices. These evaluations include testing both the design and operational effectiveness of our security controls.


text: Our Security Plan Our Security Plan, developed in collaboration with third-party consultants, aligns with the National Institute of Standards and Technology (NIST) and ISO 27001. This program encompasses security and privacy, risk-based controls, and integrates lessons learned from past cybersecurity incidents. Under the Security Plan, cyber risks, including threats and incidents, are continuously assessed, treated, and monitored. We incorporate insights from incident response and risk mitigation into our cyber risk management strategy to enhance overall cybersecurity. The Security Plan is led by specific management positions selected for their expertise, as detailed below.


text: Following best practices in cyber risk management, we have worked with recognized third-party experts to align the foundational processes, metrics, monitoring, and reporting of the Security Plan with common frameworks such as NIST.