text: Nominating and Corporate Governance Committee Our Nominating and Corporate Governance Committee oversees risks associated with data privacy and information security, which encompasses cybersecurity. Our CISO and Chief Compliance Officer, among other executives, provide periodic reports to our Nominating and Corporate Governance Committee and also meet with our Nominating and Corporate Governance Committee to discuss any material events when they arise. The periodic reports are designed to keep our Nominating and Corporate Governance Committee abreast of the Company's cybersecurity practices, as well as risks and trends in cybersecurity threats. Our Nominating and Corporate Governance Committee also has discussions with management focused on evaluating our exposure to cybersecurity risks and cybersecurity practices in place to mitigate such risks. These discussions enable our Nominating and Corporate Governance Committee to be informed of the steps management is taking to detect, monitor and manage cybersecurity risks. These reports to our Nominating and Corporate Governance Committee typically include information on any incidents that have occurred, how they were managed, and any changes to the risk profile of the Company. Our Nominating and Corporate Governance Committee seeks these updates to facilitate proactive governance and to address emerging cybersecurity issues with management.


text: In 2024, we did not identify any privacy or cybersecurity threats that materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents. For additional information about these risks, see Part I, Item 1A, "Risk Factors" in this Annual Report on Form 10 -K.

companyName: AvePoint, Inc.

ticker: AVPT

secItem: Item 1C


text: Bel employs a full-time Cybersecurity Expert who reports directly into our Global Head of IT and Cybersecurity Services. During 2024, the Company worked with third-party cybersecurity specialists to continually enhance the programs Bel has in place. These relationships involve regular communication and collaboration between the Bel cybersecurity team and our third-party providers to share threat intelligence and implement proactive measures to safeguard our systems and data. The Company has continued to invest in IT security, including additional end-user training, using layered defenses, identifying, and protecting critical assets, strengthening monitoring and alerting, and engaging experts. Our cybersecurity team regularly monitors alerts and meets to discuss threat levels, trends, and remediation. Further, we conduct periodic external penetration tests. In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with the use of third-party service providers that host our applications. The internal business owners of the hosted applications are required to document user access reviews at least annually and provide from the vendor a System and Organization Controls (SOC) 1 or SOC 2 report. Third-party contractors or vendors that require access to our network are given specific limited access to only the specific resource. The access provided expires automatically after a period determined by the project and must follow all Company security measures.

companyName: BEL FUSE INC /NJ

ticker: BELFA


text: The Audit Committee of the Board of Directors is responsible for overseeing the management of cybersecurity risks. The Audit Committee is informed about cybersecurity risks through quarterly reports from the Global Head of IT and Cybersecurity Services and, as necessary, to the full Board. The Audit Committee also reviews and approves the company's cybersecurity policies and the Company's Global Head of IT and Cybersecurity Services is responsible for developing and implementing our information security program and reporting on cybersecurity matters to the Board. This includes our overall information security strategy, policy, security engineering, operations and cyber incident detection and response reporting in alignment with Company policies. The current Global Head of IT and Cybersecurity Services has more than 16 years of information technology and program management experience which includes information security, and others on our IT security team have extensive cybersecurity experience and certifications.


text: The Company recognizes the security of our banking operations is critical to protecting our customers, maintaining our reputation and preserving the value of the Company. The Board of Directors, through the Information Technology Steering Committee (ITSC) and Compliance Risk Management Committee (CRMC), provides direction and oversight of the risk management framework of the Company including cybersecurity risks. The ITSC and CRMC establish policies and procedures for the measurement of the effectiveness and efficiency of information security controls related to both design and operations. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cyber threats when they occur.

companyName: Waterstone Financial, Inc.

ticker: WSBF


text: The Committees have the authority to conduct or authorize reviews into areas within its scope of responsibility, which is all items impacting information security. The Committees focus on the following: Promote effective information technology and information security governance.


text: Critically evaluate and assess the direction and progress of major IT-related projects, IT security decisions, IT priorities, and overall IT and IT security performance. Review and approve significant IT and information security related policies, including annual changes. Review and approve IT and information security risk assessments on an annual basis. Discuss activities and requirements pertaining to the Information Security Program.


text: Oversee requirements of the Bank's Vendor Management Policy, including processes for approving third -party providers including the financial condition, business resilience, and IT security position of third -parties. Ensure risk assessments and New Vendor Relationship Information is completed for all vendor relationships. Review and approve risk assessments for significant, critical vendor relationships on an annual basis. Examine the Bank's Business Continuity and Disaster Recovery Plan, including updates and testing. Provide for comprehensive, effective, and, if required, independent audit coverage of IT risks and controls.


text: Analyze all regulatory examination reports and internal and external audit reports impacting information technology as well as any required responses and/or updates. Assess the performance of the Committee and the Committee's role and responsibilities on an annual basis.


text: Identify, analyze, and determine strategic risk tolerance and/or mitigation direction for compliance risks identified as high and/or those with an increasing risk profile.


text: Review all regulatory examination reports impacting compliance and/or risk as well as any required responses The Company leverages regular assessments to identify current and potential threats and vulnerabilities within the Company's environment. Technical vulnerabilities are identified using automated vulnerability scanning tools, penetration testing, and system management tools, whereas non-technical vulnerabilities are identified via process or procedural reviews. The Company conducts a variety of assessments throughout the year, both internally and through third parties. Vulnerability assessment and penetration tests are performed to provide the Company with an unbiased view of its environment and controls. Vulnerabilities identified during these assessments are inventoried in a centralized tracking system and reported to management on a regular basis. A multi-step approach is applied to identify, report and remediate these vulnerabilities, and the Company adjusts its information security policies, standards, processes and practices as necessary based on the information provided by these assessments. The results of key assessments are reported in summary to the Board of Directors annually.


text: The Board of Directors, through the ITSC and CRMC, provides direction and oversight of the enterprise-wide risk management framework of the Company, including the management of risks arising from cybersecurity threats. The Board of Directors review and approve the Information Security Policy. The Board of Directors receives regular presentations which include updates on cybersecurity risks, including the threat environment, evolving standards, projects and initiatives, vulnerability assessments, third-party and independent reviews, technological trends and information security considerations arising with respect to the Company's peers and third parties. The Board of Directors also receives information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, the full Board of Directors discusses the Company's approach to cybersecurity risk management with the Company's President.


text: The Chief Information Officer ("CIO") works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans including an assessment of the potential materiality of any cybersecurity incident. The CIO monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the ITSC and CRMC.


text: Management, including the CIO, regularly reviews with the Board of Directors the Company's cybersecurity programs, material cybersecurity risks and mitigation strategies and provides updates on notable developments in the cybersecurity threat landscape. Additionally, management follows a risk-based escalation process to notify the Board of Directors outside of the cycle of regular updates when an emerging risk or material issue is identified, such as a potentially significant cybersecurity threat or incident.


text: In 2024, we did not identify any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect the Company, including with respect to our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats or incidents, or provide assurances that we have not experienced an undetected cybersecurity threat or incident. To our knowledge, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Corporation, including its business strategy, results of operations or financial condition. With regard to the possible impact of future cybersecurity threats or incidents, see Item 1A, Risk Factors — Operational Risks.


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106 (a) of Regulation S-K. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws.

companyName: COVENANT LOGISTICS GROUP, INC.

ticker: CVLG


text: Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through a multi-faceted approach including third -party assessments, internal information technology audit, information technology security, governance, and risk and compliance reviews. To defend, detect, and respond to cybersecurity incidents, we, among other things: conduct proactive privacy and cybersecurity reviews of systems and applications, audit applicable data policies, perform penetration testing using external third -party tools and techniques to test security controls, conduct employee training, and monitor emerging laws and regulations related to data protection and information security and implement appropriate changes.


text: We have implemented incident response and breach management processes which have four overarching and interconnected stages: 1) preparation for a cybersecurity incident, 2) detection and analysis of a security incident, 3) containment, eradication and recovery, and 4) post-incident analysis. Such incident responses are overseen by leaders from our Information Technology, Compliance, and Legal teams regarding matters of cybersecurity.


text: Security events and data incidents are evaluated, ranked by severity and prioritized for response and remediation. Incidents are evaluated to determine materiality as well as operational and business impact, and reviewed for privacy impact.


text: We also conduct tabletop exercises to simulate responses to cybersecurity incidents. Our team of cybersecurity professionals then collaborate with technical and business stakeholders across our business units to further analyze the risk to the company, and form detection, mitigation, and remediation strategies.


text: As part of the above processes, we regularly engage external auditors and consultants to assess our internal cybersecurity programs and compliance with applicable practices and standards.


text: Our risk management program also assesses third -party risks, and we perform third -party risk management to identify and mitigate risks from third parties such as vendors, suppliers, and other business partners associated with our use of third -party service providers. Cybersecurity risks are evaluated when determining the selection and oversight of applicable third -party service providers and potential fourth -party risks when handling and/or processing our employee, business, or customer data. In addition to new vendor onboarding, we perform risk management during third -party cybersecurity incidents to identify and mitigate risks to us from third -party incidents. We also carry business interruption insurance that provides protection against potential losses arising from certain cybersecurity incidents as part of our cybersecurity risk mitigation strategy.


text: As of the date of this report, we have not identified any cybersecurity threats that have materially affected or are reasonably anticipated to have a material effect on us. Although we have not experienced cybersecurity incidents that are individually, or in the aggregate, material, we have experienced cyberattacks in the past, which we believe have thus far been mitigated by cybersecurity strategies we have put in place. Despite the capabilities, processes, and other security measures we employ that we believe are designed to detect, mitigate, and remediate the risk of cybersecurity incidents, we may not be aware of all vulnerabilities or might not accurately assess the risks of incidents, and such preventative measures cannot provide absolute security and may not be sufficient in all circumstances or mitigate all potential risks. For more information about the cybersecurity risks we face, see the risk factor entitled "We depend on the proper functioning and availability of our management information and communication systems and other information technology assets (including the data contained therein) and a system failure or unavailability, including those caused by cybersecurity breaches internally or with third-parties, or an inability to effectively upgrade such systems and assets could cause a significant disruption to our business and have a materially adverse effect on our results of operations" included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K.


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management. Our Audit Committee is responsible for the oversight of risks from cybersecurity threats. Members of the Audit Committee receive updates on a quarterly basis from senior management, including leaders from our Information Technology, Compliance, and Legal teams regarding matters of cybersecurity. This includes existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any), and status on key information security initiatives. Our Board members also engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.


text: Our cybersecurity risk management and strategy processes are overseen by leaders from our Information Technology, Compliance, and Legal teams. Such individuals have an average of over 15 years of prior work experience in various roles involving information technology, including security, auditing, compliance, systems, and programming. These individuals are informed about, and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan, and report to the Audit Committee on any appropriate items.


text: The Company's cybersecurity risk management program, aligned with the National Institute of Standards and Technology Cybersecurity Framework (CSF) domains and HITRUST CSF, is designed to employ industry best practices, including ongoing enhancement of governance, risk, and compliance management, regular updates to our response planning and protocols, security policy and standards maintenance, and new technology implementation to proactively monitor vulnerabilities and reduce risk, including processes designed to identify material cybersecurity risks associated with our use of third -party service providers. This program includes the engagement of consulting firms and other third parties.

companyName: HEALTHSTREAM INC

ticker: HSTM


text: A key component of our cybersecurity risk management program is our incident response policy, which provides for evaluation, response, and reporting procedures in connection with a cybersecurity incident. Under this policy, we have established an incident response team (IRT), a multi-disciplinary management-level team led by the Company's Chief Technology Officer (CTO) and comprised of the Company's Chief Executive Officer (CEO), General Counsel/Compliance Officer, Chief Financial Officer, and EVP, Corporate Strategy. The policy provides that the IRT will conduct an initial assessment in the event of a cybersecurity incident meeting certain criteria elevated for the review of the IRT. In such event, the policy provides that the IRT will assess whether a cybersecurity incident has the potential to materially impact the Company and whether public disclosure is required or advisable in connection therewith, and further provides that, if appropriate, any such cybersecurity incident may be further elevated for the review of senior management, the Audit Committee and/or the Board of Directors.


text: The Company maintains cyber liability insurance to help mitigate potential liabilities resulting from cybersecurity matters. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. We do not believe that any risks we have identified to date, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, despite our security measures, there is no assurance that we or the third parties with which we interact have not identified or experienced, or will not experience, a cybersecurity incident in the future that will materially affect us. For additional information regarding the risks to us associated with cybersecurity incidents, see "A data breach or cybersecurity incident could result in a loss of confidential data, give rise to remediation and other expenses, expose us to liability, subject us to litigation and governmental inquiries and actions, damage our reputation, and otherwise adversely impact our financial results and business" included in Part I, Item 1A of this Form 10-K.


text: The Company's cybersecurity risk management processes are integrated into the Company's overall risk management program. In this regard, our Board of Directors has designated the Audit Committee as being primarily responsible for overseeing risk management at a board level, and has delegated certain specific categories of risk oversight matters to the Audit Committee as well as to the other standing committees of the Board, within their respective areas of responsibilities. Additionally, the Audit Committee makes periodic reports to the Board regarding briefing and reports provided by management and advisors regarding various risk oversight matters as well as the Audit Committee's own analysis and conclusions regarding the adequacy of the Company's risk management program.


text: As part of its board-level risk oversight responsibilities, the Audit Committee provides oversight of the Company's privacy, data, cyber security, and information security risk exposures. Further, at a management level, the Company's cybersecurity risk management program is led by our CTO, who reports to the Company's CEO. Our CTO was appointed as the Company's senior vice president and chief technology officer in July 2017. Our CTO has expertise in cybersecurity risk management through his more than 20 years of experience in healthcare technology, including his service with us as well as his service as chief technology officer at other organizations prior to joining the Company in 2017. On a quarterly basis, the Company's CTO reports to the Audit Committee regarding the Company's cybersecurity program. The CTO also reports to the Audit Committee on a quarterly basis regarding remediation activities, if any, along with related security metrics, in connection with any areas where cybersecurity threats have been identified.


text: We recognize the importance of assessing, identifying, and managing material risks from cybersecurity threats to our business and operations and developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems. CoreCard's information technology network, infrastructure, and software systems, including integration points to third parties related to the FinTech services the Company offers, are critical to the Company's business and operations. The Company holds confidential, proprietary, and personal information about its customers, its customers' customers, employed or contracted personnel, and third-party vendors. In addition, the Company's business in the FinTech industry requires it to be compliant with Payment Card Industry (PCI) Data Security Standards and U.S. and foreign data and information security mandates specific to its operations and services. To address these items, CoreCard has developed a robust cybersecurity risk management program focused on identifying, assessing and managing cybersecurity risk. The program involves a dedicated team responsible for operational cybersecurity, and includes an internal IT Security Team, PCI Compliance Force, and Emergency Management Team, which together are responsible for developing and executing the Company's cybersecurity strategy and identifying and mitigating related risks.

companyName: CoreCard Corp

ticker: CCRD


text: The IT Security Team consists of five members, led by the VP of IT of the Company's CoreCard Software subsidiary, and focuses on the Company's overall data and cybersecurity. The PCI Compliance Force consists of six members, is led by the subsidiary's Chief Technology Officer, and focuses on the Company's compliance with PCI standards. Both teams hold regular meetings to discuss and report on, as applicable, meaningful cybersecurity risks, threats, incidents, and vulnerabilities, and changes in and compliance with industry data and cybersecurity standards. The teams also develop and oversee mitigation and remediation activities within their areas of responsibility. The teams, in conjunction with senior management, work to ensure that the Company is meeting requirements of applicable regulations and that the Company's third-party vendors are also meeting compliance requirements. The teams are also tasked with the development and maintenance of business continuity plans, security policies and procedures. The Company's Emergency Management Team, which consists of seven members and is led by the Company's Chief Executive Officer, has developed business incident response runbooks designed to guide operational staff with a set framework for response and mitigation to cybersecurity incidents and threats.


text: The Company has also designed its information technology systems and infrastructure to protect its and its customers' data with industry standard security, and the Company must pass an annual PCI audit with rules specific to the Company's operation of cardholder data environments. The Company's cybersecurity defensive protections are focused on detecting and mitigating cybersecurity threats before they can cause harm. The Company performs periodic penetration and vulnerability scan testing on both its internal and external facing infrastructure and systems. All Company employees are required to take cybersecurity training on an annual basis and must pass an examination designed to ensure knowledge transfer. CoreCard also utilizes a third-party security auditor for PCI audits, security training, and cybersecurity risk consulting. This partnership enables us to leverage specialized knowledge and insights, with the goal of ensuring our cybersecurity strategies and processes remain current.


text: Our business is managed under the direction of our Board of Directors (the "Board"), which guides our long-term strategy and represents the highest level of oversight at the Company. Our full Board oversees our enterprise risk management, which includes oversight of risks from cybersecurity threats. Our Board views the identification and effective management of cybersecurity threats as a critical component of its overall risk management and oversight responsibilities. Our management team provides regular updates to the Board on cybersecurity risks and threats. These updates cover, among other things, our cyber risks and threats, the status of projects to strengthen our information security systems, and the emerging threat landscape. In turn, the Board reviews and discusses these cyber risks and threats and provides advice and guidance on the adequacy of our initiatives on cybersecurity risk management.


text: The Company faces a number of cybersecurity risks in connection with its business. Based on the information the Company has as of the date of this Form 10-K, the Company does not believe that any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company's business strategy, results of operations or financial position. However, cybersecurity threats are constantly evolving, and many of the security measures that the Company has implemented must also evolve over time. While CoreCard seeks to utilize industry standard measures and tools to monitor and address these evolving threats, the Company may not be able to anticipate, prevent or mitigate its cybersecurity risks, the occurrence of which could result in significant legal and financial exposure, theft, damage to the Company's reputation, interruption of the Company's business operations, the loss of confidence in the Company's security measures, and harm to the Company's business.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: NATURAL RESOURCE PARTNERS LP

ticker: NRP


text: Our cyber risk management program is integrated into our overall risk management system, which includes a cybersecurity risk assessment process, that routinely evaluates potential impacts of cybersecurity risks on our business, including our operations, financial stability, and reputation. These assessments inform our cybersecurity risk mitigation strategies. The results are regularly shared with management and the Audit Committee as part of their involvement in managing and overseeing cybersecurity risks.


text: Key aspects of our cybersecurity risk management program include: risk assessments designed to help identify material cybersecurity risks to our critical systems and information;


text: a security team principally responsible for managing ( 1) our cybersecurity risk assessment processes, ( 2) our security controls, and ( 3) our response to cybersecurity incidents;


text: the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls;


text: cybersecurity awareness training for our employees, incident response personnel, and management; and a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.


text: We have established separate processes and procedures to oversee and identify cybersecurity risks associated with our use of third -party service providers. All third parties involved in our cybersecurity risk assessments and risk management are required to provide reports designed to allow us to monitor and assess such third parties' security controls.


text: As of the date of this report, though the Partnership and our service providers have experienced certain cybersecurity incidents, we have not identified any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. Despite implementation of our cybersecurity process, we face ongoing risks from certain cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Item 1A. Risk Factors – Our business is subject to cybersecurity risks" included elsewhere in this Annual Report on Form 10-K.


text: Our Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated to its Audit Committee oversight of cybersecurity and other information technology risks. Our Audit Committee oversees management's implementation of our cybersecurity risk management program.


text: Our Audit Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates our Audit Committee, as necessary, regarding significant cybersecurity incidents. Our Audit Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity. Our Board of Directors also receives, as necessary, briefings from management on our cybersecurity risk management program and receive presentations on cybersecurity topics from IT leadership, which includes our Chief Sustainability and Administrative Officer ("CSAO"), or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our cybersecurity team, led by the CSAO, is responsible for coordinating and executing on the cybersecurity response procedures and for seeking assistance from other Partnership stakeholders and external advisors. Our cybersecurity team includes the CSAO and IT leadership. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our cybersecurity team includes professionals with deep cybersecurity expertise across multiple industries. The CSAO has over 20 years of audit, risk management and cybersecurity experience covering the energy, pipeline, utilities, manufacturing, and financial services industries.


text: Our management team stays informed about and monitors efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal information technology personnel, threat intelligence and other information obtained from public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in the IT environment.


text: Our risk management program is designed to identify, assess, and mitigate risks across various aspects of our company, including financial, operational, regulatory, reputational, and legal. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential cyber threats. Our Chief Information Security Officer is primarily responsible for this cybersecurity component and is a key member of the risk management organization, reporting directly to the Chief Risk Officer and as discussed below, periodically to board committees.

companyName: CATHAY GENERAL BANCORP

ticker: CATY


text: We rely on a series of processes to identify threats, hazards, and other risks to our assets. In addition to regular risk assessments, we rely on independent assessments, audits, and cybersecurity feeds from vendors, including directly into patch and vulnerability management tools. Our processes and practices are reviewed by audits, regulators, and independent reviews of information security and cybersecurity practices and processes carried out by professional services organizations retained by us against industry requirements, such as the Federal Financial Institutions Examination Council (FFIEC) Information Technology Examination Handbooks, and the FFIEC Cybersecurity Assessment Tool. These frameworks also provide guidance that we leverage for overseeing and identifying cybersecurity threats associated with the use of third-party service providers. The Bank also retains third-party experts to conduct intrusion and penetration testing on an annual basis.


text: Our assets are classified and protected based on the results of our risk assessment practices, which assess a variety of critical factors, including the type of data stored, system availability needs, confidentiality requirements, recovery time objectives, transactional processing, the number of users, and the volume and magnitude of transactions. Our Information Technology and Information Security teams meet weekly across several disciplines to ensure that risks are timely identified, patch and vulnerability requirements are monitored, and the necessary changes are implemented.


text: The Information Security and Information Technology teams support the business through early engagement in the Project Management Office routines and the Vendor Management Office's requirements, to ensure that new products, projects, and third -party vendors are onboarded with appropriate oversight.


text: Identified Cybersecurity Risks Federal regulators have issued multiple statements regarding cybersecurity and that financial institutions need to design multiple layers of security controls to establish lines of defense and to ensure that their risk management processes also address the risk posed by compromised client credentials, including security measures to reliably authenticate clients accessing internet-based services of the financial institution. In addition, a financial institution's management is expected to maintain sufficient business continuity planning processes to ensure the rapid recovery, resumption and maintenance of the institution's operations in the event of a cyber-attack. A financial institution is also expected to develop appropriate processes to enable recovery of data and business operations and address rebuilding network capabilities and restoring data if the institution or its critical service providers fall victim to a cyber-attack. If we fail to observe the regulatory guidance, we could be subject to various regulatory sanctions, including financial penalties.


text: State regulators have also been increasingly active in implementing cybersecurity standards and regulations. Recently, several states, notably including California where our banking business is concentrated, have adopted laws and/or regulations requiring certain financial institutions to implement cybersecurity programs and providing detailed requirements with respect to these programs, including data encryption requirements. Many such states (including California) have also recently implemented or modified their data breach notification and data privacy requirements. We expect this trend of state-level activity in those areas to continue, and we continue to monitor relevant legislative and regulatory developments in California where most of our clients are located.


text: In the ordinary course of business, we rely on electronic communications and information systems to conduct our operations and to store sensitive data. We employ a layered, defensive approach that leverages people, processes and technology to manage and maintain cybersecurity controls. We employ a variety of preventative and detective tools to monitor, block, and provide alerts regarding suspicious activity, as well as to report on any suspected advanced persistent threats. Notwithstanding the strength of our defensive measures, the threat from cyber-attacks is severe, attacks are sophisticated and increasing in volume, and attackers respond rapidly to changes in defensive measures. While to date we have not detected a significant compromise, significant data loss or any material financial losses related to cybersecurity attacks, our systems and those of our clients and third-party service providers are under constant threat and it is possible that we could experience a significant event in the future. Risks and exposures related to cybersecurity attacks are expected to remain high for the foreseeable future due to the rapidly evolving nature and sophistication of these threats, as well as due to the expanding use of Internet banking, mobile banking and other technology-based products and services by us and our clients. See Item 1A. Risk Factors for a further discussion of risks related to cybersecurity.


text: Management and Board Oversight of Cybersecurity Risks Our Information Security Program is managed by a dedicated Chief Information Security Officer ("CISO"), who leads our Information Security team responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. Our CISO holds a BSc degree in the combined studies of Computer Science & History of Science from Herriot-Watt University and a graduate of the Carnegie Mellon University's Heinz College of Information Systems and Public Policy + Software Engineering Institute's Chief Risk Officer Executive Education and Certificate Program. He holds the following professional certifications from the Information Systems Audit and Control Association: Certified Information Systems Auditor (CISA), Certified in the Governance of Enterprise IT (CGEIT), and Certified in Risk and Information Systems Control (CRISC). Additionally, he has more than 20 years of experience in financial services, including management experience with Globally Systemically Important Banks, as well as experience in cybersecurity, information security & information technology risk management, governance, risk, and compliance.


text: The CISO provides periodic reports to the executive risk management committee and the board-level risk committees of the Company and the Bank, as well as the cross-functional management steering committee that oversees the information security and information technology programs. These reports address key cybersecurity topics, including the implementation and operation of preventative controls and the detection, mitigation and remediation of cybersecurity incidents. Our CISO also provides reports to our Chief Executive Officer and other members of our senior management, as appropriate. The Chief Risk Officer and the board-level risk committees of the Company and the Bank report to the full board of directors on key cybersecurity risk management topics, as appropriate.


text: OPKO Health, Inc. ("OPKO" or the "Company") is committed to the highest standards of cybersecurity, adhering to the SEC's definitions for 'Cybersecurity Incident,' 'Cybersecurity Threat,' and 'Information Systems.' Our focus is on safeguarding our digital infrastructure and sensitive data against unauthorized access and threats.

companyName: OPKO HEALTH, INC.

ticker: OPK


text: Risk Management and Strategy Risk Assessment and Management: OPKO employs rigorous assessment and management of cybersecurity risks, aligning with NIST and other industry standards. Our strategy is integrated into our overall risk management program, reflecting our commitment to safeguarding data.


text: Collaborative Approach: We utilize a cross-functional strategy, involving key security, risk, and compliance stakeholders, to preserve data confidentiality and manage cybersecurity threats. Technical Safeguards: Regular assessments and updates of technical safeguards are based on ongoing vulnerability analyses and threat intelligence.


text: We have established comprehensive incident response and recovery plans, ensuring readiness and effective response to cybersecurity incidents.


text: Rigorous controls are in place to mitigate risks associated with third -party service providers, including security risk assessments and contractual security requirements.


text: Regular privacy and security training for employees is conducted to enhance awareness and response to cybersecurity threats.


text: External Assessments and Attestations, and Certifications: Annual vulnerability and penetration tests and data privacy and protection reviews are performed by third -party experts. No significant findings were identified. OPKO maintains industry certifications such as SOC 2 Type 2 and PCI DSS attestations.


text: No Material Breaches or Incidents: There have been no material breaches or cybersecurity issues affecting the Company. Consequently, no risks from cybersecurity threats or previous cybersecurity incidents have materially affected, nor are they reasonably likely to materially affect, the company's business strategy, results of operations, or financial condition. As of the date of this filing, the company maintains that its cybersecurity measures have been effective in mitigating potential risks associated with cybersecurity threats.


text: The Audit Committee of the Board has direct oversight, regularly reviews reports on cybersecurity risks and vulnerabilities. The Audit Committee is informed about risk assessments, progress of risk reduction initiatives, and feedback from external auditors. Our chief compliance & audit officer ("CCO/CAO") and his direct report, chief information security officer ("CISO"), have primary responsibility for assessing and managing material cybersecurity risks. The CCO/CAO reports to the Audit Committee, which is the primary governing body that drives alignment on security decisions across the Company. The Audit Committee meets at least four times a year on cybersecurity and such meetings are attended by the CCO/CAO, CISO, in-house counsel, chief financial officer ("CFO"), corporate controller, associate general counsel, and other senior company executives as needed to review security performance metrics, identify security risks, and assess the status of approved security enhancements. The Audit Committee also considers and makes recommendations on security policies and procedures, security service requirements, and risk mitigation.


text: Our Chief Compliance & Audit Officer (CCO/CAO) possesses over 28 years of experience in Cyber Security and IT Controls across various complex organizations, including initial tenure at Boston University Medical Center, followed by roles at PricewaterhouseCoopers, Biogen, Vertex Pharmaceuticals, and currently OPKO Health for the past 7 years. The CCO/CAO has a master's degree in Computer Science with a specialization in Cyber Security from Boston University, a qualifying UK law degree from the University of Edinburgh, an MBA in Accounting, and a Master's of Finance from Northeastern University, in addition to a BA in Economics from Dartmouth College.


text: The CISO brings over 28 years of experience in Cyber Security and IT Controls, with the last 16 years serving as CISO of the Company and previously at Everest Insurance Corp. Prior experience includes several years at PricewaterhouseCoopers as an IT auditor and Cyber Security consultant. The CISO holds comprehensive Cyber Security accreditations and certifications, including CISSP, CISA, CRISC, CHP, CDRE, and MBCI, and has completed undergraduate degrees in Accounting and Computer Information Systems from Baruch College. The CISO oversees a department comprising five cyber security engineers with extensive experience.


text: The Company's strategic approach to cybersecurity governance, characterized by our rigorous third-party assessments, industry certifications, and a clear organizational reporting structure, underscores our unwavering dedication to safeguarding sensitive information and maintaining trust.


text: Our enterprise risk management program is designed to identify, assess, and mitigate risks across various aspects of our company, including financial, operational, regulatory, reputational, and legal. Cybersecurity is a critical component of this program given the increasing reliance on technology and potential of cyber threats. Our Chief Information Security Officer (the "CISO") is primarily responsible for this cybersecurity component and is a key member of the risk management organization, reporting directly to the Senior Management Team ("SMT") and our Tech Oversight Committee. Our Tech Oversight Committee includes members of our Board and management. Our CISO has served in this capacity for more than a decade and maintains multiple certifications issued by the Information Systems Audit and Control Association ("ISACA") and the SANS Institute. As part of our overall enterprise risk management program, we maintain both an Information & Cyber Security Program Policy ("ICSPP") and Information & Cyber Security Incident Response Policy ("ICSIRP").

companyName: MERCANTILE BANK CORP

ticker: MBWM


text: Our ICSPP is overseen by the SMT, which is responsible for designating the CISO. The CISO is responsible for leading company-wide cybersecurity strategy, policy, standards, architecture, and processes. The CISO is charged with all logical security related matters, which include but are not limited to, PC/server security, network security, internet security, and database and application security. Our ICSIRP is based on applicable federal and state laws as well as cybersecurity incident response best practices. The purpose of the ICSIRP is to define procedures for reporting and responding to cybersecurity incidents. It creates objectives for actionable procedures that can be measured, evaluated, scaled and revised as necessary for each specific incident. These objectives include maximizing the effectiveness of our company's operations through an established plan of action and assigning responsibilities to appropriate personnel and/or third -party contractors.


text: Our company has engaged a third -party managed detection and response company to monitor the security of our information systems around-the-clock, including intrusion detection and response, and to provide instantaneous alerting should a cybersecurity event occur. If a cybersecurity threat or cybersecurity incident is identified through our company's information systems, the CISO and Incident Response Team ("IRT") will take immediate steps to mitigate the threat and assess any damages. Upon report from the CISO, the SMT will evaluate the materiality of the cybersecurity threat or cybersecurity incident to determine if any public disclosures are required under the Security and Exchange Commission's cybersecurity disclosure rule. If deemed necessary, third -party consultants, legal counsel, and assessors will be engaged to evaluate the materiality assessment.


text: Our company has training and awareness programs designed to educate its employees about cybersecurity risks and how to protect our company, our customers and themselves from cyber-attacks and to keep its employees informed about cybersecurity threats and how to stay safe online, including secure access practice, phishing schemes, remote work and response to suspicious activities.


text: Our cybersecurity program interfaces with other functional areas within our company, including but not limited to, our company's business segments and information technology, legal, risk, human resources and internal audit departments, as well as external third -party partners, to identify and understand potential cybersecurity threats. We regularly assess and update our processes, procedures and management techniques in light of ongoing cybersecurity developments.


text: Recognizing the complexity and evolving nature of cybersecurity threats, we also engage with a range of external experts, including cybersecurity assessors, consultants, and auditors in evaluating and testing our risk management systems. These partnerships enable our company to leverage specialized knowledge and insights, ensuring its cybersecurity strategies and processes remain at the forefront of industry best practices. Our company's collaboration with these third parties includes regular audits, testing, threat assessments and consultation on security enhancements.


text: To date, risks from cybersecurity threats or incidents have not materially affected our company. However, the sophistication of and risks from cybersecurity threats and incidents continue to increase, and the preventative actions that we have taken and continue to take to reduce the risk of cybersecurity threats and incidents and protect our systems and information may not successfully protect against all cybersecurity threats and incidents. For more information on how cybersecurity risk could materially affect our company's business strategy, results of operations, or financial condition, please refer to Item 1A Risk Factors.


text: Our company recognizes the importance of safeguarding company and customer information. Therefore, the Board of Directors recognizes that the protection of this information ranks as one of our highest priorities. The Board of Directors is responsible for reviewing and approving the ICSPP and ICSIRP at least annually and monitoring material risks facing our company. The Board recently added a member who possesses specialized expertise in cybersecurity matters. Director Sara A. Schmidt currently serves as chief information security officer for US Foods and executive sponsor of the West Michigan Cyber Security Consortium.


text: The Board has tasked the SMT with overseeing efforts to develop, implement and maintain an effective information and cybersecurity program. The SMT designates the CISO who also serves as the IRT leader. As part of its oversight responsibilities, the Board of Directors is responsible for discussing with the SMT our company's major risk exposures, such as cybersecurity, and the steps management has taken to monitor and control those exposures, including our risk assessment and risk management policies. The Board of Directors also monitors our compliance with legal and regulatory requirements and the risks associated therewith. On a regular basis, our Tech Oversight Committee reviews with the SMT significant areas of risk exposure involving cybersecurity.


text: At the direction of the SMT, the CISO and IRT monitor internal and external cybersecurity threats and review and revise our company's cybersecurity defenses on an ongoing basis. The CISO, together with other members of the IRT, bring a wealth of expertise to their respective roles, including expertise in security technologies; designing and implementing security strategies; security standards such as NIST, ISO, COBIT and ITIL; and risk management and incident response. The CISO prepares reports on IT general controls and cybersecurity metrics for the SMT and Tech Oversight Committee periodically. The Board of Directors meets with the CISO periodically to discuss cybersecurity.


text: We have implemented and maintain various information security processes designed to mitigate cybersecurity risks, on a case-by-case basis, to our critical computer networks, third party-hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data related to patients and clinical trials (IT Assets). The Company's information security program, which is integrated into our overall risk management processes, evaluates threats posed by internal and external factors and supports daily operational functions that prevent unauthorized access or compromise.

companyName: TG THERAPEUTICS, INC.

ticker: TGTX


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our IT Assets, which include implementing policies and guidelines governing the individual use and protection of IT Assets by employees, employee training, and leveraging the capability of third -party service providers to support our internal cybersecurity processes. These processes are aligned with standard industry frameworks, such as the National Institute of Standards and Technology, Committee of Sponsoring Organizations, International Organization for Standardization 27001, and other industry standards. We have also implemented a well-established information security incident response plan, which is designed to escalate cybersecurity incidents, depending on the circumstances, to appropriate stakeholders as defined by internal standard operating procedures. We continue to monitor proposed cybersecurity disclosure rules from the SEC and alter our procedures accordingly.


text: To further improve the effectiveness of our information security processes, we engage third -party service organizations to monitor the Company's information technology (IT) environment, conduct evaluations of the effectiveness of our security controls and provide aggregate monthly reports to our corporate IT Security Team regarding the results of such third -party assessments, training and vulnerability testing, data security posture, material cybersecurity risks and areas of improvement.


text: Risks from cybersecurity threats have not materially affected or are currently viewed as not reasonably likely to materially affect us, our business strategy, results of operations or financial condition. However, the scope and impact of any future cybersecurity incidents cannot be predicted and there can be no assurance that our information security program will be effective in preventing material cybersecurity incidents in the future. For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the risk factor captioned "Our internal information technology systems, or those of our third-party CROs, CMOs, or other contractors or consultants, may fail or suffer security breaches, which could result in a material disruption of our drug candidates' development programs and our commercialization of any products for which we receive regulatory approval."


text: The Board and our Chief Executive Officer is responsible for oversight of the Company's overall risk management program, including as to cybersecurity related risks, while management is responsible for the day-to-day risk management processes. The Board receives regular reports from our Chief Executive Officer, Chief Financial Officer and other members of management, regarding material cybersecurity threats and risks, effectiveness of our information security processes and status of ongoing cybersecurity initiatives and strategies. Our information technology (IT) team, which is overseen by our Vice President of IT, is responsible for the identification, assessment and management of cybersecurity risks we face and ensuring effective implementation of the Company's overall cybersecurity efforts. Our Vice President of IT has over 25 years of experience in IT systems, including cybersecurity risk management and incident response, and holds multiple industry-recognized certifications. Our Vice President of IT receives regular reports from the corporate IT Security Team, together with information provided by our third-party service organizations that monitor the Company's IT environment, regarding the Company's material cybersecurity threats and risks and the processes the Company has implemented to address them, which are reported to the Chief Financial Officer.


text: We perform a formal risk assessment each year. As part of the Company's risk assessment, we consider the potential for cybersecurity threats, including but not limited to interruptions, outages and breaches to its operational and financial systems. We have policies, processes, internal controls and tools to assess, identify, and manage material risks from potential cybersecurity threats. We utilize a combination of cybersecurity awareness training, manual processes, specialized software and automated tools, and third-party assessments to build our cybersecurity program. We engage third-party service providers, with significant information technology and cybersecurity experience, to assist with designing, implementing and managing our information technology infrastructure and cybersecurity program. We are also currently developing a cybersecurity incident response plan that establishes a formal framework for responding to cybersecurity incidents, including defining what constitutes a reportable cybersecurity incident; establishing specific escalation and communication channels; identifying parties responsible for managing and responding to each incident; and other preparedness and response activities.

companyName: EKSO BIONICS HOLDINGS, INC.

ticker: EKSO


text: The Audit Committee of our Board of Directors (the "Audit Committee") provides oversight over our internal control program, including the adequacy and effectiveness of our information technology infrastructure and cybersecurity program. Each quarter, management provides updates to the Audit Committee regarding its internal control program, including any significant changes to its information technology infrastructure or cybersecurity program. Management also reports any material risks from cybersecurity threats to the Audit Committee. Management periodically provides the Audit Committee with updates on cybersecurity risks and/or trends.


text: Our management team, specifically the chief executive officer and the chief financial officer, are responsible for the day-to-day administration of our business operations, including our risk management of cybersecurity risks. Management is responsible for the design and implementation of policies, processes and internal controls to manage our cybersecurity risks. Our management team regularly meets with their information technology resources, including its third-party service providers, to ensure that we are appropriately positioned to manage our cybersecurity risks. Our management team also sponsors periodic cybersecurity awareness training for employees.


text: As of the date of this Annual Report on Form 10 -K, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. For further discussion of the cybersecurity risks, see "Part I—Item 1A. Risk Factors," specifically the risks titled " We are subject to cybersecurity risks to our systems, infrastructure, and technology, and data processed by us or third -party vendors. " No matter how well designed or implemented our internal controls are, we will not be able to anticipate all cybersecurity threats, and we may not be able to implement effective preventive or detective measures against cybersecurity threats. While we maintain insurance that may cover certain liabilities in connection with certain disruptions, security breaches, and incidents, there can be no guarantee that our insurance coverage will be adequate to compensate us for the potential losses.


text: In the normal course of business, we collect and store sensitive information, including proprietary and confidential business information, intellectual property, information regarding clinical and non-clinical trials, sensitive third -party information and employee information.

companyName: FILANA THERAPEUTICS, INC.

ticker: FLNA


text: We have processes designed to protect our information systems, data, assets, infrastructure, and computing environments from cybersecurity threats and risks. Our cybersecurity strategy includes the use of managed detection and response services to monitor our network infrastructure and associated endpoints for possible cybersecurity threats. In addition, we use multi-factor authentication, perform periodical penetration testing and other logical, physical and technical controls designed to deter, prevent, mitigate and respond to cybersecurity threats. Further, our information systems include continuous alert plans, and we provide periodical cybersecurity reminders to our employees to emphasizes the importance of adherence to our security policies.


text: We conduct organizational risk assessment, which help management in identifying data assets and recognizing and assessing potential threats, and investigating potential vulnerabilities. We are in the process of reviewing and implementing incremental information technology strategies to mitigate cybersecurity risks and their possible impacts. Risk assessments enable management to make risk management decisions and assign resources to mitigate risk. We also periodically engage third parties to assess the effectiveness of our cybersecurity practices.


text: As of the date of this Annual Report, we do not believe that any past cybersecurity incidents that have been detected have materially affected, or are reasonably likely to materially affect, our business strategy, results of operations, or financial condition.


text: See "Risk Factors - Risks Related to Our Business and Operations" for additional information about the risks to our business associated with cybersecurity or a breach or compromise to our information security systems.


text: Our Director of Information Technology has responsibilities which include preventing and monitoring cybersecurity threats and utilizes the assistance of external vendors in this effort. Our Director of Information Technology regularly reports to senior management regarding the status of our cybersecurity program, emerging cybersecurity threats, long-term cybersecurity investments and strategies, and oversight of our cybersecurity profile.


text: Our full Board of Directors oversees the risk management process for the Company, which includes identifying, assessing and managing enterprise-level risks. The Board administers this oversight function directly through the Board of Directors as a whole, as well as through its standing committees that address risks inherent in their respective areas of oversight. The risk oversight responsibility of the Board of Directors and its committees is supported by the management reporting processes, which are designed to provide visibility to the Board of Directors and to the personnel who are responsible for risk assessment and information about the identification, assessment and management of critical risks, and management's risk mitigation strategies. Our cybersecurity risk program directly integrates and is intended to align with the Board of Directors' overall risk management process.


text: Our management team views cybersecurity risk management as an important strategic topic. Our cybersecurity strategy utilizes the cybersecurity framework developed by the National Institute of Standards and Technology ("NIST CSF"). The NIST CSF is a voluntary framework of practices to identify, protect, detect, respond to, and recover from cybersecurity risks. Using the NIST CSF does not mean that we meet any particular technical standards or certifications, but rather that we use the NIST CSF to help us identify, assess, and manage cybersecurity risks relevant to our business. Using the NIST CSF, we form our cybersecurity plans and prioritize our activities using a risk-based approach which begins with the identification and evaluation of cybersecurity risks and threats that could disrupt our operations, safety procedures and regulatory compliance. Cybersecurity risks and related mitigation efforts are prioritized based on their potential impact severity, likelihood and vulnerability. Risk mitigation strategies include the application of cybersecurity policies and procedures, implementation of technology-based tools and controls, as well as employee training, education, and awareness initiatives. Our cybersecurity risk management includes ongoing monitoring of networks and systems for potential signs of suspicious activity. We track key performance indicators and cybersecurity metrics to evaluate the effectiveness of our cybersecurity safeguards and practices. We have established an incident response plan designed to promptly contain and remediate cybersecurity incidents.

companyName: Air Transport Services Group, Inc.


text: We rely increasingly on software applications, data transmissions and cybersecurity safeguards provided by or in conjunction with third parties to maintain our cybersecurity posture and evolve with the threat environment. We engage third party resources to assess our procedures, test safeguards, provide training and monitoring, and assess our vulnerabilities. We evaluate third party service providers from a cybersecurity risk perspective, which may include an assessment of that service provider's cybersecurity posture and data security standards.


text: ATSG management has overall responsibility for assessing and managing risks from cybersecurity threats to our operations. Management has a supervisory team that consists of the Chief Executive Officer, Chief Financial Officer, Chief Operating Officer, Vice President and Controller, and the Vice President of Information Technology, which meets regularly. The Vice President of Information Technology has primary responsibility for the execution of our cybersecurity risk management program and keeps the broader team informed about the detection, mitigation, and remediation of cybersecurity risks and incidents. The Vice President of Information Technology and the Company's other information technology and security department personnel include individuals with advanced university degrees in cybersecurity and years of technology management experience in matters such as conducting threat assessments, cyber mitigation and incident response.


text: While the Board has the primary responsibility for risk oversight, the Audit Committee assists the Board in fulfilling its oversight responsibility with respect to the management of cybersecurity-related risks. Through its Cybersecurity Subcommittee, the Audit Committee periodically reviews and discusses with management, including the Vice President of Information Technology, (i) the Company's information security strategy, priorities and objectives; (ii) the Company's technology and information security risks, including with respect to cybersecurity and data privacy; and (iii) the steps management has taken to manage cybersecurity risk.


text: In 2024, we did not identify any risks from cybersecurity threats, including as a result of any cybersecurity incidents, that have materially affected or that are reasonably likely to materially affect us, including our business strategy, results of operations and financial condition. However, the nature of potential cybersecurity risks and threats are uncertain, and any future incidents, outages or breaches may materially affect our business strategy, results of operations or financial condition. For additional discussion of potential risks regarding cybersecurity, please see the information contained in Risks Related to Business Interruptions and Cybersecurity Incidents in Part 1A of this Form 10-K.


text: The operation of our business is dependent on the secure functioning of our computer infrastructure. This infrastructure is used to maintain key processes including management of sensitive company information and operation of sales, record-keeping, and accounting functions.

companyName: RADNOSTIX INC

ticker: INIS


text: We employ a specialized third-party information technology ("IT") management firm to monitor and manage our cybersecurity functions. Processes employed include real-time monitoring of company communications and IT activities and also consultation and risk assessment of company procedures. Additionally, our third-party IT firm provides education to management and employees regarding our IT risks. All our employees receive information security training (including data protection and fraud awareness) on an annual basis. Department managers are given additional risk management training as part of periodic management meetings. Our activities are monitored at all times by our IT firm. The IT firm reports all matters of cybersecurity including any threats, breaches, or risks directly to our Chief Financial Officer who reports directly to the Chief Executive Officer. Our Chief Financial Officer regularly meets with the IT firm to review our cybersecurity response plans, discuss any needed updates, and identify risk management actions to be taken. Updates regarding cybersecurity are provided to our directors at least annually and as needed for any important developments including cybersecurity breaches and risks. As of the date of this Annual Report, we know of no cybersecurity incident that has or is likely to materially affect us, our business strategy, our results of operations, or our financial condition.


text: We carry a cybersecurity insurance policy to help cover any costs that may occur from a cybersecurity incident. Although risks from cybersecurity threats and implementation of our cybersecurity program have not materially affected our business strategy, business operations or our financial condition, a cybersecurity incident could have a material adverse effect in the future if it were to cause business disruption or data loss.


text: We have processes in place to assess, identify, and manage material risks from cybersecurity threats. Our business is dependent on the communications and information systems of our Advisor and other third-party service providers. Our Advisor manages our day-to-day operations and has implemented a cybersecurity program that applies to us and its operations.

companyName: Horizon Technology Finance Corp

ticker: HRZN


text: Cybersecurity Program Overview Our Advisor has instituted a cybersecurity program designed to identify, assess, and mitigate cyber risks applicable to us. The cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which we rely. Our Advisor actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by us.


text: Our Advisor has identified a Cyber Incident Response Team, or Response Team, who is responsible for providing appropriate oversight, strategic direction, and decision making for an event that potentially could cause a material impact to our business. Our Response Team includes our Chief Financial Officer, Chief Compliance Officer and General Counsel, and Vice President of Operations and these individuals are responsible for coordinating the incident response, including any required notification to our Audit Committee or our Board.


text: We rely on our Advisor to engage external experts, including cybersecurity assessors, consultants, and auditors to evaluate cybersecurity measures and risk management processes, including those applicable to us. We rely on our Advisor's risk management program and processes, which include cyber risk assessments.


text: We depend on and engage various third parties, including suppliers, vendors, and service providers, to operate our business. We rely on the expertise of risk management, legal, information technology, and compliance personnel of our Advisor when identifying and overseeing risks from cybersecurity threats associated with our use of such entities.


text: Audit Committee Oversight of Cybersecurity Risks Our Audit Committee provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. Our Audit Committee receives periodic updates from our Response Team regarding the overall state of our Advisor's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting us.


text: Management's Role in Cybersecurity Risk Management Our management, including our Response Team, is responsible for assessing and managing material risks from cybersecurity threats. Our management continuously assesses, meets and prioritizes cybersecurity risks and actions taken to mitigate these risks. Members of our management possess relevant expertise in various disciplines that are key to effectively managing such risks. We leverage the resources of Monroe, including the Head of Information Technology, who provides resources and expertise to assist us in our cybersecurity program. Our management is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting us, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, information technology, and/or compliance personnel of our Advisor.


text: Assessment of Cybersecurity Risk In the past three years, we have not experienced a material cybersecurity breach. Our Advisor, including our Response Team, and our management assess on an on-going basis the potential impact of risks from cybersecurity threats on us, and regularly evaluate how such risks could materially affect our business strategy, operational results, and financial condition. During the reporting period, we have not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that we believe have materially affected, or are reasonably likely to materially affect, us, including our business strategy, operational results, and financial condition.


text: Risk Assessment and Strategy Fuel Tech regularly evaluates cybersecurity risk from computer viruses and more sophisticated and targeted cyber-related attacks such as ransomware, as well as cybersecurity failures resulting from human error and technological errors. Such risks are reviewed by our Information Technology Steering Committee on a quarterly basis, or more frequently if deemed appropriate.

companyName: FUEL TECH, INC.

ticker: FTEK


text: Our overall strategy in combatting known cybersecurity risks includes a variety of individual tactics, including: the use of antivirus software, virtual private networks, email security, as well as other software to prevent and detect data intrusions.


text: the deployment of updates and patches as they are available and maintaining the current versions of major software to reduce the exposure to vulnerabilities.


text: the use of third -party service to conduct mandatory online training for all employees regarding identifying and avoiding cyber-security risks.


text: the review of the security procedures used by third parties that may host or otherwise have access to Fuel Tech's data.


text: the deployment of third -party cyber-security experts to perform penetration testing on our internal and external networks and systems in an effort to identify potential vulnerabilities.


text: if necessary, the use of third -party security experts if and when an incident is detected We are not aware of having experienced any material cybersecurity incidents. We are not aware of any existent cybersecurity threats that would materially affect, or are reasonably likely to materially affect, our business strategy, results of operations or financial conditions. For more information, please see "Cybersecurity" under Item 1A "Risk Factors" above.


text: Management Oversight Day-to day management of cybersecurity threats is conducted by our Information Technology department which is charged with identifying and reporting threats to senior management. On a quarterly basis, cybersecurity is reviewed by our Information Technology Steering Committee, which is comprised of our Chief Executive Officer, Chief Financial Officer, General Counsel and Head of Information Technology.


text: The Audit Committee of our Board of Directors, which is composed of all non-employee directors, is responsible for oversight of management's efforts to eliminate cybersecurity risks.


text: The Trust does not have any officers, directors or employees. The Sponsor, an indirect subsidiary of BlackRock, is responsible for the oversight and overall management of the Trust. The Sponsor relies on BlackRock's ERM framework for the Trust's cybersecurity risk management and strategy. Key aspects of the ERM framework are summarized below. The board of directors of the Sponsor (the "Board of Directors") periodically receives reports from BlackRock regarding BlackRock's cybersecurity program.

companyName: iShares Bitcoin Trust ETF

ticker: IBIT


text: As of December 31, 2024, cybersecurity risks have not materially affected the Trust's objective, results of operations or financial condition.


text: BlackRock ' s Enterprise Risk Management Framework BlackRock recognizes the importance of identifying, assessing, and managing material risks associated with cybersecurity threats. Cybersecurity represents an important component of BlackRock's approach to ERM. BlackRock leverages a multi-lines-of-defense model with cybersecurity operational processes executed by global information security and other teams and dedicated internal audit technology and technology risk management ("TRM") teams that independently review technology risks. BlackRock's cybersecurity program is fully integrated into its ERM framework and is aligned with recognized frameworks, including NIST CSF, FFIEC CAT, FedRAMP, SOC 1/2, ISO 27001/2 and others. BlackRock aims to inform and continuously improve its cybersecurity program through engagement with regulatory, client, insurer, vendor, partner, peer, government and industry organizations and associations, as well as external audit, technology risk, information security and other assessments.


text: BlackRock seeks to address cybersecurity risks through a global, multilayered strategy of control programs that is designed to preserve the confidentiality, integrity and availability of the information that BlackRock collects and stores by identifying, preventing and mitigating cybersecurity threats and incidents. As one of the critical elements of BlackRock's overall ERM framework, BlackRock's cybersecurity program is focused on the following key areas:


text: As discussed in more detail under the heading "BlackRock's Cybersecurity Governance" below, the oversight by BlackRock's board of directors ("BlackRock's Board") of cybersecurity risk management is supported by BlackRock's Risk Committee, which regularly interacts with BlackRock's risk management function, BlackRock's Chief Risk Officer ("CRO") and Chief Information Security Officer ("CISO"), along with other members of management. In addition, technology and cybersecurity risks are formally overseen by a dedicated management risk governance committee, the Technology Risk and Cybersecurity Committee ("TRCC"), which is a sub-committee of the firmwide Enterprise Risk Committee ("ERC").


text: Cross-Functional Approach: BlackRock has implemented a global, cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and incidents, while also implementing layered preventative, detective, reactive and recovery controls to identify and manage cybersecurity risks.


text: Safeguards: BlackRock deploys a range of people, process and technical controls that are designed to protect BlackRock's information systems from cybersecurity threats, which may include, among others: physical security controls perimeter controls, including technical assessments, firewalls, network segregation, intrusion detection and prevention tabletop exercises, ongoing vulnerability and patch management vendor due diligence multi-factor authentication device encryption application security, code testing and penetration testing endpoint security, including anti malware protection, threat intel and response, managed detection and response, security configuration management, portable storage device lockdown, restricted administrative privileges employee awareness, training, and phishing testing data loss prevention program and monitoring information security incident reporting and monitoring and layered and comprehensive access controls.


text: Incident Response and Recovery Planning: BlackRock has established and maintains incident response and recovery plans that address BlackRock's response to a cybersecurity incident, including processes designed to assess, escalate, contain, investigate and remediate the incident, as well as to comply with applicable legal obligations and mitigate potential reputational damage. Such plans are evaluated on a periodic basis.


text: Third-Party Risk Management: BlackRock maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers, counterparties and clients, as well as the systems of third parties that could significantly and adversely impact BlackRock's business in the event of a cybersecurity incident affecting those third -party systems. Third-party risks are included within BlackRock's ERM framework, and risk identification and mitigation are supported by BlackRock's cybersecurity program. BlackRock also performs diligence on certain third parties and monitors cybersecurity threats and risks identified through such diligence.


text: Education and Awareness: BlackRock's employees and contractors are required to complete an annual information security training to equip them with effective tools to address cybersecurity threats, and to receive communications on BlackRock's evolving information security policies and procedures.


text: BlackRock's global information security team, in collaboration with the technology risk and internal audit teams, engages in the periodic assessment and testing of BlackRock's cyber risks and cybersecurity program. These efforts may include a wide range of activities, including audits, assessments, wargames and "tabletop" exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. BlackRock also participates in financial services industry and government forums in an effort to improve both internal and sector cybersecurity defense. BlackRock regularly engages third parties and advisors to assess its cybersecurity control environment. The results of certain program and control assessments are reported to BlackRock's Risk Committee, and BlackRock adjusts its cybersecurity program as appropriate based on the information provided by these assessments.


text: As of December 31, 2024, cybersecurity risks have not materially affected BlackRock's business strategy, results of operations or financial condition.


text: BlackRock ' s Cybersecurity Governance BlackRock's Board is actively engaged in the oversight of BlackRock's risk management program. BlackRock's Risk Committee assists BlackRock's Board with its oversight of BlackRock's levels of risk, risk assessment, risk management and related policies and processes, including risks arising from cybersecurity threats. BlackRock's Risk Committee receives regular reports on BlackRock's cybersecurity program, technology resilience risk management and related developments from members of our information security team, including the CISO. BlackRock's Board and BlackRock's Risk Committee also receive information regarding cybersecurity incidents that meet certain reporting thresholds. On an annual basis, senior members of BlackRock's technology, risk and information security teams provide a comprehensive overview of BlackRock's cyber risk and related programs to a joint session of BlackRock's Board's Risk and Audit Committees.


text: Technology and cybersecurity risks at BlackRock are also overseen by the TRCC, a dedicated management risk governance committee and sub committee of the firmwide ERC. The chair of the TRCC is appointed by the head of Enterprise Risk Management at BlackRock and its members include the CISO as well as a broad range of senior business stakeholders across BlackRock. The TRCC is responsible for oversight of BlackRock's technology and cybersecurity risk management practices and helps ensure that technology and cybersecurity risks remain within firmwide risk tolerances and technology and cybersecurity risk issues are escalated as appropriate to the ERC and other committees. The TRCC also reviews any relevant technology and cybersecurity risk related issues and helps ensure that they are appropriately escalated, reported, and remediated.


text: BlackRock's cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by BlackRock's CISO. As of December 31, 2024, the CISO had over 30 years of experience in information technology with a 25-year concentration in information security, including previously serving as the CISO at several global financial institutions, and held the Certified Information Systems Security Professional certification. The CISO works closely with the leadership team and other subject matter experts in the global cybersecurity group, who collectively have extensive prior work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs and overseeing cybersecurity controls in technology risk and audit functions, as well as having relevant degrees and industry-leading certifications.


text: The CISO and members of the TRCC monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management processes described above, including the operation of BlackRock's incident response plan.


companyName: iShares Ethereum Trust ETF

ticker: ETHA


text: We rely on information systems to obtain, rapidly process, analyze, and manage data in order to effectively operate our business. We are committed to protecting our business information, intellectual property, customer, supplier and employee data and information systems from cybersecurity risks and maintain an active cybersecurity risk management program.

companyName: BROADWIND, INC.

ticker: BWEN


text: We maintain enterprise-wide information security policies, processes and standards that set the requirements around acceptable use of information systems and data, risk assessment and management, identity and access management, data security, security operations, security incident response and threat and vulnerability management. We work to align to the National Institute of Standards and Technology (NIST) 800-171 Cybersecurity Framework, as its program controls are designed to protect and maintain confidentiality, integrity, and continued availability of our data and information systems. Our team of information system professionals and third-party providers monitors our information systems for cybersecurity threats, breaches, intrusions and other weaknesses, responds to cybersecurity incidents, develops and implements plans to mitigate cybersecurity threats and facilitates training for our employees.


text: We also engage consultants and other third -party advisors to conduct independent assessments of our cybersecurity readiness and control effectiveness. In collaboration with our third -party providers, we seek to gain insights into emerging threats and vulnerabilities, industry trends, and leading practices to inform our cybersecurity response.


text: Management plays a critical role in assessing and managing material risks from cybersecurity threats. Our Director of Information Technology leads an internal team and works directly with our third-party information security professionals to manage our cybersecurity risk management program and activities. This includes monitoring our information systems for cybersecurity threats, reviewing cybersecurity incidents, analyzing emerging threats, and the development and implementation of risk mitigation strategies.


text: Our Director of Information Technology reports directly to our executive leadership team on cybersecurity matters, providing the leadership team with updates on enterprise risks, cybersecurity incidents, the status of ongoing initiatives, key metrics, and additional cybersecurity topics. Our information technology team, led by the Director of Information Technology, meets regularly to discuss the progress of ongoing program initiatives, cybersecurity priorities, identified risks and metrics.


text: The Board of Directors exercises direct oversight of strategic risks to the Company. The Board has delegated the responsibility for cybersecurity oversight to the Audit Committee. The Audit Committee's responsibilities include reviewing and discussing with management the strategies, process and controls pertaining to the management of information technology operations, including cybersecurity risks and information security. The Director of Information Technology reports to the Audit Committee annually and more frequently, as needed, on cybersecurity matters, including the cybersecurity threat landscape, key metrics demonstrating the overall management of our cybersecurity risk and risk management program, related key initiatives, enterprise program framework alignment, annual risk mitigation strategy, and review of cybersecurity incidents. Our Board is committed to maintaining a well-informed and cybersecurity-aware posture, engaging through regular and requested updates on our strategy and evolving threat landscape.


text: The Sponsor has an information security program and policy in place, as mandated by New Regulation S-K Item 106. The Sponsor engages Align to provide fully outsourced IT services, including 24x7x365 support, cybersecurity monitoring, and disaster recovery. Align's services encompass Office365 security features such as anti-phishing, encryption, and advanced threat protection, alongside endpoint security via Microsoft Entra ID and Intune, enforcing policies like MFA, BitLocker encryption, and geo-blocking. This program is designed to assess, identify, and manage material risks from cybersecurity threats. Regular reviews of cybersecurity and information technology plans are conducted for key service providers, as part of the Sponsor's disaster recovery and business continuity planning process. Additionally, the Sponsor evaluates whether any cybersecurity threats, including those resulting from previous incidents, have materially affected or are reasonably likely to materially affect the Trust and the Funds.

companyName: Teucrium Commodity Trust

ticker: CANE


text: Management provides oversight of cybersecurity risks, ensuring alignment with regulatory requirements and industry best practices. Management also plays a crucial role in overseeing the implementation and effectiveness of cybersecurity measures.


text: Furthermore, the Sponsor conducts regular training sessions for all employees, covering various cybersecurity topics, and disseminates real-time information on cybersecurity matters, as necessary. The information security plan undergoes periodic reviews and updates, at least annually, to adapt to evolving threats and changes in the operating environment, ensuring its continued effectiveness in safeguarding sensitive information and mitigating cybersecurity risks.


text: As part of our operational risk management strategy, led by our chief operating officer, we have implemented processes to assess, identify, and manage material risks facing the Company, including from cybersecurity threats. Components of this strategy includes the use of industry standard traffic monitoring tools, training users to detect, report, and prevent unusual behavior, and working with reputable service providers capable of ensuring their ability to operate with strategies equal to or better than our own. The implementation and management of these processes are integrated with the Company's overall operational risk management processes that seeks to limit our exposure to unnecessary risks across our operations. For cybersecurity threat management and mitigation, the Company engages with expert consultants and third party services providers for the design and implementation of these industry standard strategies to identify any potential threats or vulnerabilities in our system. We have developed a cyber crisis response plan which provides a documented framework for handling high severity security incidents and facilitates coordination across multiple parts of the Company. Our incident response team constantly monitors threat intelligence feeds, handles vulnerability management and responds to incidents.

companyName: Comstock Inc.

ticker: LODE


text: To date, risks from cybersecurity threats have not previously materially affected us, and we currently do not expect that the risks from cybersecurity threats are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. The sophistication of cyber threats continues to increase, and the preventative actions we take to reduce the risk of cyber incidents and protect our systems and information may be insufficient. Accordingly, no matter how well designed or implemented our controls are, we will not be able to anticipate all security breaches of these types, including security threats that may result from third parties improperly employing AI technologies, and we may not be able to implement effective preventive measures against such security breaches in a timely manner. See Item 1A: Risk Factors above for additional information on risk related to cyber attacks.


text: Role of the Board The Audit and Finance Committee of the Board of Directors is responsible for the primary oversight of our information security programs, including relating to cybersecurity, and are integrated into the Company's Cybersecurity Incident response process. Our chief operating officer is responsible for reporting to the Audit and Finance Committee on our incident response plan, which includes an evaluation of cyber risks and threats, and notifies the Audit and Finance Committee of a cybersecurity threat. In the event of an incident, the Audit and Finance Committee reviews and approves the material incident disclosure plan and recommendation for determination of materiality using the guidelines approved by the Audit and Finance Committee. The Board of Directors and Audit and Finance Committee receive regular updates throughout the year on cybersecurity.


text: Role of the Management Our chief operating officer, together with our principal accounting officer, is responsible for the day-to-day management of our cybersecurity risks. We have an incident response framework in place. We use this incident response framework as part of the process we employ to keep our management and Board of Directors informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. The framework is a set of coordinated procedures and tasks that our incident response team, under the direction of the chief operating officer, executes with the goal of ensuring timely and accurate resolution of cybersecurity incidents. The chief operating officer activates the incident response plan to assess and mitigate a cybersecurity incident. In the event of an incident, the chief operating officer and principal accounting officer consult with cybersecurity consultants and other involved parties to identify the undesirable effects of the cybersecurity incident and develop a material incident disclosure plan for review and approval by the Audit and Finance Committee.


text: We have certain processes in place to assess, identify and manage material cybersecurity risks. We also periodically monitor and test our information systems for potential vulnerabilities. We use various tools designed to help identify, investigate and resolve cybersecurity incidents, and to help recover from them in a timely manner. These processes, policies and tools comprise our cybersecurity risk program and are integrated into our overall risk management program.

companyName: Contineum Therapeutics, Inc.

ticker: CTNM