text: The Company has also established a dedicated Cybersecurity Working Group, with members from both the Traditional Business and Journal Technologies, to collaborate on threat intelligence, incident response strategies, policy alignment, and security technology advancements. This partnership ensures both entities remain proactive in addressing evolving threats and benefit from shared expertise to implement coordinated security measures. The Company's senior management works closely with the CISO and the Cybersecurity Working Group to identify matters requiring the attention of the Board of Directors.


text: The Company employs enterprise security systems as the backbone of a defense in depth (DiD) strategy, such as patch management, intrusion detection, and network segmentation. A managed detection and response (MDR) solution from a world-class security company unifies our antivirus/malware (NGAV), endpoint detection and response (EDR), cyber threat intelligence, managed threat hunting capabilities, and security hygiene.

companyName: DAILY JOURNAL CORP

ticker: DJCO

secItem: Item 1C


text: The Company provides regular cybersecurity training for employees to enhance awareness of common threats, such as phishing and ransomware. All Journal Technologies employees undergo annual CJIS training and certification.


text: The Company maintains a central Risk Register as part of its cybersecurity risk management framework. This Risk Register identifies risks and their potential impacts, mitigation strategies, and ongoing monitoring efforts.


text: The Company evaluates third-party vendors prior to onboarding to ensure they have industry standard best practices in place and, when applicable, verified by an external audit firm. The Company monitors third-party providers for breaches or other cybersecurity events and annually review each vendor's SOC 2 audit reports.


text: The Company maintains a formalized incident response (IR) plan to address and remediate cybersecurity incidents. The plan defines roles and responsibilities and includes runbooks for likely scenarios. The Company performs testing of the IR plan at least annually with the results reported to senior management.


text: Certifications: Several of the Company's security personnel on the CISO team have and maintain CISSP, GCIH (GIAC Certified Incident Handler) and OSCP (Offensive Security Certified Professional) certifications.


text: Business Continuity: The Traditional Business and Journal Technologies have each implemented a Business Continuity Plan and Disaster Recovery (BCP/DR) with procedures aimed at minimizing downtime and facilitating recovery of both internal and customer assets in the event of a service disruption. The plan includes clearly defined roles, step-by-step recovery processes, and prioritized action plans to address various scenarios, such as natural disasters, cyber incidents, and hardware failures. We regularly test and update our BCP/DRs.


text: Enforcing multi-factor authentication (MFA) for all systems Deploying anti-phishing solutions to detect and block suspicious emails Using single sign-on (SSO) solutions integrated with secure identity providers Simulating phishing attacks to measure awareness and improve training programs Implementing Security Information and Event Management (SIEM) systems for continuous monitoring and logging.


text: The Company adheres to strict protocols for evaluating and reporting cybersecurity incidents. Any incidents determined to have a material impact—assessed based on financial, operational, or reputational factors—are raised with the Board of Directors and, if necessary, disclosed in accordance with regulatory requirements.


text: We rely on our technology network infrastructure and information systems to operate our business, interact with vendors and customers, and collect and make payments, among other functions. Our internally developed infrastructure and systems, as well as those systems and processes provided by third-party vendors, may be susceptible to damage or interruption from cybersecurity threats and incidents, which include any unauthorized access to our information systems that may result in adverse effects on the confidentiality, integrity or availability of such systems or related information.

companyName: Concrete Pumping Holdings, Inc.

ticker: BBCP


text: Such attacks have become more sophisticated over time, especially as threat actors have become increasingly well-funded by or themselves include governmental actors with significant means. We expect that the sophistication of cyber-threats will continue to evolve as threat actors increase their use of AI and machine-learning technologies. The Company experiences cyber threats in the normal course of its business, and computer viruses, hackers, employee misconduct and other external hazards could expose our information systems to security breaches, cybersecurity incidents or other disruptions, any of which could materially and adversely affect our business. Refer to Item 1A. Risk Factors, for additional details on cybersecurity risks that could potentially materially affect the Company.


text: We manage our risks from cybersecurity threats through our overall enterprise risk management process, which is overseen by the Board. Our cybersecurity risks are considered individually as part of our enterprise risk management process alongside other risks, and priorities and discussed with our Board. The Company seeks to prioritize the management of cybersecurity risk and the protection of confidential information and systems, and the Company's program and processes are based on industry standards as guided by the National Institute of Standards and Technology ("NIST") framework. Under the supervision of the Chief Financial Officer ("CFO") and our Director of IT, we regularly work to identify all computing assets including hardware, software, and network infrastructure in order to conduct a risk assessment. We consider threats that may originate from both internal and external sources and maintain technical security controls internally. To identify risks, we complete vulnerability assessments on a recurring basis to help proactively identify potential weaknesses. We additionally engage a third-party vendor to conduct external and internal penetration testing on a periodic basis in order to assist in identifying additional vulnerabilities in our environment. We also perform business continuity planning and disaster recovery exercises throughout the organization annually by our in-house team.


text: In connection with our overall cybersecurity risk management processes, we receive recurring threat intelligence from our partners that help us recognize the updated tactics, techniques, and procedures being utilized by threat actors. Employees at the Company receive mandatory recurring cybersecurity training and phishing exercises to reduce the likelihood of success by threat actors. We also engage a third-party service provider to provide monitoring and detection of our cybersecurity environment, which allows us to timely respond to cybersecurity events with the goal of reducing its potential impact. The Company performs an IT security assessment of critical third-party vendors prior to establishing a formal relationship and has additional processes in place to continue to oversee and identify risks associated with the use of our third-party service providers once a formal relationship is established. We additionally have a cybersecurity incident response plan ("CIRP") that outlines the appropriate procedures, communication flow and response for potential cybersecurity incidents as well as categorizations of scope, incident and impact of such incidents.


text: The Company's Director of IT reports to our CFO and leads the Information Technology team (collectively "the IT Security Team"). The IT Security Team is responsible for the strategic oversight of cybersecurity risk management and strategy including the identification and assessment of cybersecurity threats and incidents. Periodically, they are also responsible, alongside the CFO and senior management, to keep the Audit Committee of the Board of Directors informed and briefed with respect to cybersecurity risks and incidents. Our Director of IT has extensive experience of over 15 years in various IT roles across a range of cyber technologies, processes and strategies and is supported by the IT Security Team and the wider IT team, including the IT Security Manager, to support the Company's cyber risk management processes, including the prevention, detection and mitigation of cybersecurity threats and incidents, and any required response to and remediation of such cybersecurity threats or incidents.


text: The Audit Committee is responsible for providing governance and oversight over the Company's operational cybersecurity program, risk management and incident response on behalf of the Board. The CFO reports the results of risk assessments, including the evaluation of cybersecurity risks, the actions that the Company has taken to mitigate these risks and an analysis of cybersecurity threats and incidents across the industry to the Audit Committee. This includes assessing the measures and controls in place to mitigate cybersecurity risks and providing oversight of the response of any significant cybersecurity threats and incidents.


text: We recognize the importance of assessing, identifying, and managing material risks from cybersecurity threats. Our policies, standards and procedures for assessing, identifying, and managing material risks from cybersecurity threats are integrated into our overall risk management system. In this regard, we use various tools and processes to help prevent, identify, and resolve any identified vulnerabilities and security incidents in a timely manner. These include, but are not limited to, internal reporting and routine employee awareness updates.

companyName: AmeriCann, Inc.


text: Our management team oversees efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, including monitoring systems and employee engagement.


text: Our board of directors is responsible for oversight over its risk management system, including review and approval of the risk management system and processes implemented by management to identify, assess, manage and mitigate cybersecurity risks. The Board is responsible for monitoring and assessing material risk exposure to cybersecurity risks, and our management is responsible for the day-to-day supervision of the material risks we may face.


text: Our risks from cybersecurity threats have not affected or are reasonably not likely to materially affect our business strategy, results of operations, or financial condition.


text: The Company has adopted policies and implemented certain controls and procedures that allow its management to assess, identify and manage material risks from cybersecurity threats and for its Board of Directors, through its Audit Committee, to actively oversee the strategic direction, objectives, and effectiveness of the Company's cybersecurity risk management framework.

companyName: R F INDUSTRIES LTD

ticker: RFIL


text: The Company's processes are integrated into its overall enterprise risk management program and compliments the Company's enterprise-wide risk assessment architecture, as implemented by the Company's management and as overseen by the Company's Board of Directors through its Audit Committee. The Company has in the past, and may continue to do so in the future, engage third-party consultants, to review and assess the Company's information technology and security.


text: The Company seeks to address cybersecurity risks through a cross-functional approach that is focused on preserving the confidentiality, security, and availability of the information that the Company collects and stores by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.


text: To identify and assess material risks from cybersecurity threats, we follow best practices in routine network and endpoint auditing, vulnerability assessments, penetration testing, and other forms of security auditing. We continuously monitor endpoint activity and network traffic for unusual or prohibited behavior to prevent, identify, and contain malicious actions.


text: We have developed incident response plans by using the information gained through testing and monitoring to manage any identified vulnerabilities and further improve our cybersecurity preparedness and response infrastructure. Such plans set forth the actions to be taken in responding to and recovering from cybersecurity incidents, which include triage, assessing the severity of incidents, escalation protocols, containment of incidents, investigation of incidents, and remediation. We also regularly perform phishing tests of our employees and provide annual privacy and security training for all employees. Our security training incorporates awareness of cyber threats including but not limited to malware, ransomware, and social engineering attacks, password hygiene and incident reporting processes.


text: We review our cybersecurity risk framework and related policies annually with senior management to help identify areas for continued focus and improvement. We also engage third party experts to review and assess our processes to ensure they are robust and consistent with the current security landscape. The data center where we host our critical data is SOC II complaint.


text: The Company has also implemented processes to identify, monitor and address material risks from cybersecurity threats associated with our use of third-party service providers, including those in our supply chain or who have access to our systems, data or facilities that house such systems or data by discussing issues to be addressed and recommending securities measures to be improved where possible.


text: Although in the periods reported we have not experienced any material cybersecurity incidents and the expenses we have incurred from cybersecurity incidents, including penalties and settlements, were immaterial, we may experience such incidents in the future and the scope and impact of any such future incidents cannot be predicted. To prepare for any such event, we have a full Disaster Recovery plan in place that is tested annually to ensure resilience against a myriad of threats.


text: Role of the Board of Directors and the Audit Committee As part of the Board of Directors' role in overseeing the Company's enterprise risk management program, which includes our cybersecurity risk management framework, the Board is responsible for exercising oversight of management's identification and management of, and planning for, material cybersecurity risks that may reasonably be expected to impact the Company. While the full Board has overall responsibility for risk oversight, the Board has delegated oversight responsibility related to risks from cybersecurity threats to the Audit Committee. The Audit Committee is responsible for overseeing the strategic direction, objectives, and effectiveness of the Company's cybersecurity risk management framework, taking into account the Company's risk exposures and progress of its risk management processes. The Audit Committee is informed of the Company's cybersecurity risk management and receives an overview of its cybersecurity program from management at least quarterly, which covers topics including, among others, recent cybersecurity risk landscape and trends, data security posture, results from third-party assessments, training and vulnerability testing, our incident response plan, material cybersecurity risks, whether developing or actual, as well as the steps management has taken to respond to such risks, emerging cybersecurity regulations, technologies and best practices. Material cybersecurity risks are also discussed during separate Board meetings as part of the Board's risk oversight generally.


text: Role of Management Our Chief Financial Officer is responsible for management's oversight of cybersecurity governance, decision-making, risk management, awareness, and compliance across the Company. Our Chief Financial Officer works to employ a cybersecurity program designed to protect the Company's information systems from cybersecurity threats and to respond to incidents in accordance with the Company's incident response plan and other policies and procedures.


text: In the event of a material cybersecurity incident or investigation, management will, in compliance with escalation protocols in place, promptly report to the Audit Committee and the Board, as appropriate, in accordance with the Company's incident response plan, and other policies and determine the timing of action, and necessary response.


text: The Company places a high priority on safeguarding its data, systems, and infrastructure from cybersecurity threats. To manage this critical aspect of operations, the Company partners with a third-party IT provider that specializes in cybersecurity services. Established in 1997, this provider brings over two decades of expertise in managing and mitigating cyber risks, including network security, vulnerability assessments, and incident response planning. The provider's comprehensive approach ensures the protection of the Company's sensitive information and critical systems, while also adhering to industry best practices and regulatory requirements. By leveraging the expertise of its third-party IT provider, the Company is able to implement robust cybersecurity measures that support operational continuity and reduce exposure to potential security incidents.


text: Cybersecurity protection and data privacy are important to maintaining our proprietary information and the trust of our customers, suppliers and employees, and we recognize the importance of working to secure our data and information systems from potential cybersecurity and data privacy incidents. We are a large global manufacturer with sites around the world, and we identify and assess our cybersecurity risk through that lens. Securing the execution and control of our manufacturing operations, to the extent implemented through digital technology, is a primary area of focus. We also face risks encountered by substantially all large global companies such as the risks of intellectual property and information being compromised, fraud and violation of privacy or security laws.

companyName: FULLER H B CO

ticker: FUL


text: Our cybersecurity risk is managed as part of our broader enterprise risk management program. Specifically, a risk management workstream focused on our information technology function (including cybersecurity) is designed to assess, identify and manage cybersecurity-related risks and mitigation measures. Our cybersecurity risk program also includes a documented incident response plan to be used in the event of a cybersecurity incident. The incident response plan provides for certain responses based on various factors of a cybersecurity incident.


text: We periodically assess and test our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents, including those from third-party service providers who have access to our systems, data or are critical to our continued business operations. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We regularly engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to senior management and, if warranted, to our audit committee, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: While some of our third-party service providers have experienced cybersecurity incidents and have experienced threats to their data and systems, as of the date of this report, we are not aware of any cybersecurity threats or incidents that have materially affected our business strategy, results of operations, or financial condition. This does not guarantee that future incidents or threats will not have a material impact by interrupting operations, causing reputational harm, increasing operating costs, or exposing the Company to litigation. For additional commentary on cybersecurity risks, see Part 1, Item 1A. Risk Factors.


text: Governance and Management's Responsibilities Our Board of Directors views the identification and effective management of cybersecurity threats as a critical component of overall risk management and oversight responsibilities, and has delegated responsibility for oversight of this risk to the audit committee. The audit committee oversees the management of risks arising from cybersecurity threats and regularly reports to the Board of Directors regarding cybersecurity. Our audit committee oversees our enterprise risk management ("ERM") process, and cybersecurity represents an important component of our overall approach to ERM. Our cybersecurity policies, standards, processes and practices are informed by the National Institute of Standards and Technology (NIST) Cybersecurity Framework and applicable industry standards. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional program that is focused on identifying, assessing, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.


text: To manage our cybersecurity program, management has established a cybersecurity steering committee and cybersecurity incident response team, both led by our chief information officer. Our cybersecurity steering committee and cybersecurity incident response team include multidisciplinary groups of corporate and operational leaders, external cyber-specialist resources and technical experts in cybersecurity risk management, incident response and security operations. Many members of our cybersecurity team have extensive experience in the operations of networks, network security and infrastructure management. Our chief information officer has over 20 years of information technology experience, including leadership roles at large, global, publicly-traded companies, and is informed about and monitors prevention, detection, mitigation, and remediation efforts through regular communication and reporting from professionals on the cybersecurity steering committee and cybersecurity incident response team, and through the use of technological tools and software. Our chief information officer is also responsible for updating the audit committee on cybersecurity on a quarterly basis and, where appropriate, escalating certain cybersecurity incidents to the full Board of Directors.


text: Cybersecurity risk management is an integral part of Mullen's overall enterprise risk management framework. We have implemented comprehensive measures to safeguard our information systems, protect sensitive data, and identify, assess and manage material risks from cybersecurity threats. Our cybersecurity program encompasses threat prevention, detection, mitigation, and remediation strategies tailored to the dynamic risk landscape in the automotive sector.

companyName: BOLLINGER INNOVATIONS, INC.

ticker: BINI


text: Our risk management efforts include threat intelligence gathering, vulnerability assessments, and the integration of advanced cybersecurity technologies. These measures are designed to help protect Mullen's proprietary systems and customer data from both internal and external cybersecurity threats. From time to time, Mullen has engaged third parties, on an as needed basis, to perform various cybersecurity services and risk assessments. Additionally, we maintain third-party tools to monitor for vulnerabilities.


text: We perform diligence, which includes reviewing SOC II reports, on certain third-party service providers who provide critical data and cloud services in order to oversee and identify risks from cybersecurity threats associated with such critical third-party service providers.


text: Despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident.


text: As a function of its oversight role, the Board is responsible for ensuring that material risks are identified and managed appropriately. While the Board of Directors has the ultimate responsibility for risk oversight, the Board of Directors has delegated responsibility for the oversight of data privacy and cybersecurity to the Audit Committee. Senior management of Mullen regularly report to the full Board regarding risks we face, however, there has been no specific reports of risks related to cybersecurity threats that have been discussed with the Board.


text: Our VP of IT and our Director of IT Operations are responsible for assessing and managing risks from cybersecurity threats. Our VP of IT and Director of IT Operations each have over 20 years of experience in information technology, with cybersecurity comprising a significant role in their experience. The VP of IT and the Director of IT Operations are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents as a function of their management of our cybersecurity program.


text: As of the date of this filing, we do not believe that any risks from cybersecurity threats, including as the result of past cybersecurity incidents, have had, or are reasonably likely to have, a material effect on our business strategy, results of operations, or financial condition. While we strive to employ safeguards, no system can guarantee absolute security and we cannot guarantee that any future risk from cybersecurity, including any future cybersecurity incidents, will not be material to our business strategy, results of operations or financial condition.


text: Our business is highly dependent on our information systems, including our ability to operate them effectively and to successfully implement new technologies, methods, and processes, as well as adequate controls and cybersecurity incident recovery plans. We rely on our information systems to manage our business. In addition, we must protect the confidentiality and integrity of the data of our business, employees, customers, and other third parties. Our business involves the collection, processing, storage, and transmission of personally identifiable information and other sensitive and confidential information. This data is wide-ranging and relates to our employees, customers, and third parties.

companyName: Byrna Technologies Inc.

ticker: BYRN


text: Our management, led by our Chief Executive Officer, has the overall responsibility for identifying, assessing and managing any material risks from cybersecurity threats, and our Board of Directors, assists in overseeing and monitoring cybersecurity risks and risk management. Our cybersecurity posture is designed to comply with key global financial regulations and cybersecurity laws in the jurisdictions in which we operate. This posture includes taking several proactive steps to prepare for attempts to compromise our information systems. To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material cybersecurity risks, and protect against, detect, and respond to cybersecurity threats and incidents, we undertake the following activities: Closely monitor emerging data protection laws and implement changes to our processes designed to comply; Undertake reviews of our consumer-facing and internal policies and statements related to cybersecurity; Proactively inform our customers of substantive changes related to customer data handling; Conduct annual cybersecurity training for all our employees;


text: Conduct regular phishing email simulations for all employees and all contractors with access to corporate email systems to enhance awareness and responsiveness to such possible threats;


text: Through policy, practice, and contract (as applicable), require employees, as well as third parties who provide services on our behalf, to treat customer information and data with care;


text: Update and assess our cybersecurity technologies to address threats and vulnerabilities; and Carry cybersecurity insurance to protect against potential losses from incidents. Cybersecurity Risk Assessment Program We do not have a formal cybersecurity risk assessment program.


text: Policies and Procedures for Third-Party Service Providers We do not have specific policies and procedures to oversee, identify, or mitigate the cybersecurity risks associated with our use of third-party service providers, other than relying on SOC 1 Type 2 reports for materially in-scope applications.


text: Activities to Prevent, Detect, and Minimize Cybersecurity Incidents We undertake various activities to prevent, detect, and minimize the effects of cybersecurity incidents. These activities include: ensuring that company data accessed via a desktop or laptop computer is only accessible from company-owned computers ensuring that company-owned computers are regularly updated and maintained, are running the latest versions of our Endpoint Detection and Response antivirus software ensuring that company-owned computers access the internet through secure connections via our corporate VPN solution updating and assessing our cybersecurity technologies such as our firewall and various cybersecurity software Impact of Previous Cybersecurity Incidents At this time, we have not identified any risks from known cybersecurity threats, including as a result of prior cybersecurity incidents, that have materially affected us. However, we face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us.


text: Impact on Results of Operations or Financial Condition Cybersecurity risks and incidents have not materially affected our results of operations or financial condition. However, we face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us.


text: Consideration of Cybersecurity Risks in Business Strategy, Financial Planning, and Capital Allocation Cybersecurity risks are considered as part of our business strategy, financial planning, and capital allocation. We regularly review and update our cybersecurity posture to address emerging threats and ensure the protection of our information systems.


text: The Company has developed a standards-based information security program to address risks from cybersecurity threats. The program includes policies and procedures that identify how security measures and controls are developed, implemented, and maintained. The maturity and effectiveness of the security program is reviewed biennially by a reputable third party.

companyName: BASSETT FURNITURE INDUSTRIES INC

ticker: BSET


text: A risk assessment is conducted annually. The risk assessment along with risk-based analysis and judgment are used to select security controls to address risks. During this process, the following factors, among others, are considered: likelihood and severity of risk, impact on the Company and others if a risk materializes, feasibility and cost of controls, and impact of controls on operations and others. Specific controls that are used to some extent by the Company include endpoint threat detection and response (EDR), identity and access management (IAM), multi-factor authentication (MFA), firewalls and intrusion detection and prevention, and vulnerability and patch management. An internal information security audit program is in place to ensure controls remain operational and effective.


text: Third-party security firms are used by the Company in different capacities to provide or operate some of these controls and technology systems. Third parties are also used to conduct assessments, such as vulnerability scans and penetration testing of the Company and its systems. The Company uses a variety of processes to address cybersecurity threats related to the use of third-party technology and services.


text: The Company has a written incident response plan ("IRP") and conducts tabletop exercises to enhance incident response preparedness. Disaster recovery plans are used to prepare for the potential for a disruption in technology we rely on. Employees undergo security awareness training, including phishing simulation training, when hired and periodically throughout the year.


text: The Company's executive leadership team meets regularly to address enterprise risks, and cybersecurity is a risk category addressed by that group. In addition to assessing major risks, management identifies and monitors such risks. At least annually, the Company's executive leadership reviews with the Board of Directors the major risks identified in the enterprise risk management process, as well as the steps identified to mitigate such risks. Each of the business and functional leaders responsible for the management of these identified risks also regularly discuss with the Board changes in assessment of these risks and mitigation plans.


text: The Company (or third parties it relies on) may not be able to fully, continuously, and effectively implement security controls as intended. As described above, we utilize a risk-based approach and judgment to determine the security controls to implement and it is possible we may not implement appropriate controls if we do not recognize or underestimate a particular risk. In addition, security controls, no matter how well designed or implemented, may only mitigate and not fully eliminate risks. And events, when detected by security tools or third parties, may not always be immediately understood or acted upon.


text: The Company activated their incident response plan to address a security incident in 2024. The Company is not aware of additional cybersecurity threats or any material cybersecurity incidents to date that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition.


text: On July 10, 2024, we detected unauthorized occurrences on a portion of our information technology (IT) systems. Upon detecting the unauthorized occurrences, we immediately began taking steps to contain, assess and remediate the cybersecurity incident, including beginning an investigation with leading external cybersecurity specialists, activating our incident response plan, and shutting down some systems. As a result of these and other measures, we believe the threat actor was ejected from our IT systems on July 10, 2024.


text: After we shut down some of our systems, we experienced disruption to certain of our operations, including interrupted manufacturing at our domestic plants and delayed order fulfillment for our retail network and delay of some wholesale shipments. Within a few days of the incident, we were able to resume retail order fulfillment and caught up on fulfilling wholesale orders that were delayed as a result of the cybersecurity incident. We have fully restored the IT systems and data and our investigation has not found evidence that any of our core operating systems for manufacturing, wholesale and retail order processing and fulfillment, or financial reporting were impacted.


text: While we believe the impacts were not material to our financial condition and results of operations for the fiscal year, we estimate that between $1,000 and $2,000 of sales were lost due to the shutdown during the cybersecurity incident. During the third quarter of 2024, we also incurred legal and remediation costs related to the incident of approximately $98 which are included in selling, general and administrative expenses. In addition, cost of goods sold for year ended November 30, 2024 includes $609 for wages paid to hourly production employees during the work stoppage resulting from the cybersecurity incident. Because no inventory was produced during the temporary shutdown of our manufacturing operations, these wages were charged directly to expense. We are seeking reimbursement of certain costs, expenses and losses stemming from the cybersecurity incident and have submitted a claim to our cybersecurity insurer. We expect final resolution and payment of the claim during the first half of 2025.


text: Additionally, in Item 1A Risk Factors under the heading of "Risks Related to Electronic Data Processing and Digital Information," forward-looking cybersecurity threats that could have a material impact on the Company are discussed. That section of Item 1A should be read in conjunction with this Item 1C.


text: The Chief Information Officer ("CIO") holds primary oversight responsibility for the team managing the development, operation, and maintenance of our information security program. This team also has responsibility to maintain and enhance the Company's written cyber security incident response plan, which identifies incident severity classifications and serves as a trigger for escalation for the response team.


text: With over 25 years of experience across diverse IT technologies, the CIO brings extensive expertise to the role. The CIO is also a member of the Company's executive leadership team, meeting regularly with the CEO, CFO, and other senior leaders. The CIO directly reports to the Board at least annually, addressing cybersecurity risks and strategy, and attends Board meetings to discuss cybersecurity matters as needed. The Audit Committee provides oversight of the information security program. The CIO reports to the Audit Committee annually on cybersecurity risks and related internal controls and attends quarterly meetings to provide updates and address any questions regarding cybersecurity and information technology systems.


text: Our cybersecurity risk management process is a component of our overall enterprise risk management process, through which our Chief Executive Officer and other members of senior management assess, identify, and manage material risks from cybersecurity threats we face. Our cybersecurity process seeks to protect our information systems by managing and reducing material risks from cybersecurity threats and by responding to and mitigating cybersecurity incidents. The Board of Directors (the "Board"), and the Audit Committee of the Board (the "Audit Committee"), provide oversight of our cybersecurity risk management process. The Audit Committee reviews our cybersecurity program and cybersecurity risk management process quarterly, and our Board reviews our cybersecurity program annually. Our cybersecurity program is directly managed by the Chief Information Officer ("CIO"), who is experienced in information systems and cybersecurity and whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. The CIO provides periodic updates to our Board and Audit Committee, as well as our Chief Executive Officer and other members of our senior management. These updates cover the Company's material cybersecurity threats, the status of projects to strengthen our cybersecurity posture, and assessments of the cybersecurity program. Our cybersecurity risk management process is evaluated by internal and external cybersecurity experts, and the material results of those reviews are reported to senior management and the Board and Audit Committee as part of their oversight role. We also engage with third-party service providers deemed to have subject matter expertise in cybersecurity matters, industry participants, and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our cybersecurity policies and processes. We require each third-party service provider to certify that they implement and maintain appropriate security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect us. We use various tools and methodologies to manage cybersecurity risk and to prevent, detect, and mitigate cybersecurity incidents. Our tools and methodologies are tested regularly, including vulnerability scans, red-teaming exercises and other penetration testing, and review of cybersecurity threat intelligence feeds. We face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition, results of operations, cash flows or reputation. We have experienced, and will continue to experience, cybersecurity incidents in the normal course of our business. However, prior cybersecurity incidents have not had a material adverse effect on our business, financial condition, results of operations, or cash flows. See "Risk Factors – Factors Related to Overall Business & Operations – Our business depends on the use of information technology systems. A failure of these systems, cybersecurity incidents, or cyber-fraud may cause business disruptions, compromise our intellectual property or other sensitive information, or result in losses."

companyName: LATTICE SEMICONDUCTOR CORP

ticker: LSCC


text: We believe cybersecurity is critical to advancing our technological developments. As a biopharmaceutical company, we face a multitude of cybersecurity threats that range from attacks common to most industries, such as ransomware and denial-of service. Our customers, suppliers, subcontractors, and business partners face similar cybersecurity threats, and a cybersecurity incident impacting us or any of these entities could materially adversely affect our business strategy, performance, and results of operations. These cybersecurity threats and related risks make it imperative that we expend resources on cybersecurity.

companyName: Kiromic Biopharma, Inc.


text: We engage third-party services to conduct evaluations of our security controls, whether through penetration testing, independent audits, or consulting on best practices to address new challenges. We have established cybersecurity security awareness training and ongoing monitoring.


text: In the event of an incident, we intend to follow our cybersecurity incident response plan, which outlines the steps to be followed from incident detection to mitigation, and notification. We contract with external firms that have extensive information technology and program management experience. We have implemented a governance structure and processes to assess, identify, manage, and report cybersecurity risks. As a biopharmaceutical company, we must comply with extensive regulations, including requirements imposed by the Federal Drug Administration related to adequately safeguarding patient information and reporting cybersecurity incidents to the SEC. We believe we are positioned to meet the requirements of the SEC. In addition to following SEC guidance and implementing pre-existing third party frameworks, we have developed our own practices and frameworks, which we believe enhance our ability to identify and manage cybersecurity risks. Assessing, identifying, and managing cybersecurity related risks are factored into our overall business approach. We rely heavily on our supply chain to deliver our products and services, and a cybersecurity incident at a clinical site, subcontractor, or business partner could materially adversely impact us. We require that our subcontractors report cybersecurity incidents to us so that we can assess the direct impact of the incident.


text: The Audit Committee has oversight responsibility for risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements, cooperation with law enforcement, and related effects on financial and other risks, and it reports any findings and recommendations, as appropriate, to the full Board for consideration. Senior management regularly discusses cyber risks and trends and, should they arise, any material incidents with the Audit Committee.


text: While we have not experienced any material cybersecurity threats or incidents in recent years, there can be no guarantee that we will not be the subject of future threats or incidents. Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. See "Risk Factors" for a discussion of cybersecurity risks.


text: We have a multi-layered approach to assess, identify and manage material risks from cybersecurity threats. This approach includes a wide variety of mechanisms, controls, technologies, methods, systems, and other processes that are designed to prevent, detect, or mitigate data loss, theft, misuse, unauthorized access, or other cybersecurity incidents or vulnerabilities affecting the data.

companyName: ARTS WAY MANUFACTURING CO INC

ticker: ARTW


text: The data includes confidential, proprietary, and business and personal information that we collect, process, store, and transmit as part of our business, including on behalf of third parties. We also use systems and processes designed to reduce the impact of a cybersecurity incident at a third-party vendor or customer. Additionally, we use processes to oversee and identify material risks from cybersecurity threats associated with our use of third-party technology and systems, including technology and systems we use for encryption and authentication; employee email; content delivery to customers; back-office support; and other functions.


text: As part of our risk management process, we conduct regular application security assessments to identify vulnerabilities within our IT infrastructure. These assessments include both automated scans and manual reviews by our cybersecurity team. Threat intelligence feeds and security reports are continuously monitored, with the goal of staying ahead of emerging threats. In the event of a cybersecurity incident, we maintain incident response plans that are utilized when incidents are detected. We require employees with access to information systems, including all corporate employees, to undertake data protection and cybersecurity training and compliance programs annually along with random internal phishing campaigns.


text: We are led by our Director of IT, who is responsible for implementing and maintaining centralized cybersecurity and data protection practices in close coordination with our senior leadership team. We also engage assessors, consultants, or other third parties to assist with assessing, identifying, and managing cybersecurity risks. Our cybersecurity risks and associated mitigations are evaluated by senior leadership and routinely by our Board of Directors.


text: Our Director of IT, who has extensive cybersecurity knowledge and skills gained from over 10 years of work experience in various information technology roles, heads the team responsible for implementing and maintaining cybersecurity and data protection practices and reports directly to the Chief Financial Officer.


text: As of the date of this report, we have not encountered any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. Cybersecurity threats are continually evolving, and no assurances can be given that our risk management systems and processes will fully mitigate all cybersecurity threats and risks.


text: We recognize the importance of developing, implementing and maintaining cybersecurity measures to safeguard our information systems, shield our operational technologies in our manufacturing plants and protect the confidentiality, integrity and availability of our data.

companyName: HUNTSMAN INTERNATIONAL LLC


text: We have a qualitative cybersecurity risk management program within our Enterprise Information Security function to promote a company-wide culture of cybersecurity risk management for our information technology and operational technology. This program supports cybersecurity considerations as part of our decision-making processes. Our Enterprise Information Security team works closely with our global information technology organization ("Global IT"), operational technology teams and business units to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs. We are aligned with the U.S. National Institute of Standards and Technology Cybersecurity Framework, against which we periodically assess our readiness.


text: Recognizing the complexity and evolving nature of cybersecurity threats, we engage with a range of external experts, including cybersecurity assessors, consultants and auditors, in evaluating and testing our cybersecurity posture. These partnerships enable us to leverage specialized knowledge and insights in the development of our cybersecurity program consistent with industry best practices. Our collaboration with these third parties includes regular audits, threat assessments and consultation on security enhancements.


text: Because we are aware of the risks associated with third parties, we have implemented a third-party security risk management program to oversee and manage these risks. We conduct security assessments of third-party providers contracted by Global IT before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. The program includes tools and services, which continuously monitor third parties for potential security concerns, data leaks and cyber posture, as well as periodic renewals of due diligence commensurate with their risk. This approach is designed to mitigate risks related to data breaches or other security incidents originating from these third parties.


text: As of the date hereof, we have not identified any cybersecurity threats or previous cybersecurity incidents that have materially affected, or are reasonably likely to materially affect, our business strategy, results of operations or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats or provide assurances that we have not experienced undetected cybersecurity incidents. For additional information about these risks, see "Part I. Item 1A. Risk Factors."


text: The Board of Directors is aware of the importance of managing risks associated with cybersecurity threats. The Board of Directors has established oversight mechanisms for effective governance in managing risks associated with cybersecurity threats, because they recognize the significance of these threats to our operational integrity and stakeholder confidence.


text: The Audit Committee is responsible for the Board of Directors' oversight of cybersecurity risks. The Audit Committee is composed of board members with diverse expertise including, cyber operations, risk management, technology and finance, equipping them to oversee cybersecurity risks effectively. The Audit Committee reviews our cybersecurity programs and the effectiveness of its risk management strategies. This review helps management identify areas for improvement and align our cybersecurity program with the overall risk management framework.


text: The Chief Information Officer ("CIO") plays a pivotal role in informing the Audit Committee on cybersecurity risks. The CIO provides briefings to the Audit Committee on a quarterly basis. These briefings encompass a broad range of topics, including: current cybersecurity landscape and emerging threats; status of ongoing cybersecurity initiatives and strategies;


text: incident reports and learnings from any cybersecurity events; and compliance with regulatory requirements and industry standards. In addition to our scheduled meetings, select members of the Audit Committee and CIO maintain an ongoing dialogue regarding potential cybersecurity threats and mitigation strategies and updates to our cybersecurity posture. The Audit Committee oversees strategic decisions related to our cybersecurity program, offering guidance and approving investments in major initiatives. This ongoing oversight enables cybersecurity considerations to be integrated into our broader strategic planning objectives.


text: Reporting to our CIO, our cybersecurity function is led by our Chief Information Security Officer ("CISO"). The CISO manages a team of cybersecurity professionals and third-party support functions with broad experience and expertise, including in cybersecurity threat assessments and detection, mitigation technologies, cybersecurity training, incident response, cyber forensics, insider threats and regulatory compliance.


text: Our CISO and CIO are regularly informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques, for the effective prevention, detection, mitigation and remediation of cybersecurity incidents. The CISO implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, we have an incident response plan that includes immediate actions to contain and eradicate the threat, mitigate the impact, and long-term strategies for remediation and prevention of future incidents.


text: The CIO regularly informs the Chief Executive Officer and management regarding cybersecurity risks and incidents, so they are kept abreast of the cybersecurity posture and potential risks. Significant cybersecurity matters and strategic risk management decisions are reported to the Audit Committee.


text: The Trust does not have any officers, directors or employees. The Sponsor, a subsidiary of BlackRock, is responsible for the oversight and overall management of the Trust. The Sponsor relies on BlackRock's ERM framework for the Trust's cybersecurity risk management and strategy. Key aspects of the ERM framework are summarized below. The board of directors of the Sponsor (the "Board of Directors") periodically receives reports from BlackRock regarding BlackRock's cybersecurity program.

companyName: ISHARES GOLD TRUST

ticker: IAU


text: As of December 31, 2024, cybersecurity risks have not materially affected the Trust's objective, results of operations or financial condition.


text: BlackRock ' s Enterprise Risk Management Framework BlackRock recognizes the importance of identifying, assessing, and managing material risks associated with cybersecurity threats. Cybersecurity represents an important component of BlackRock's approach to ERM. BlackRock leverages a multi-lines-of-defense model with cybersecurity operational processes executed by global information security and other teams and dedicated internal audit technology and technology risk management ("TRM") teams that independently review technology risks. BlackRock's cybersecurity program is fully integrated into its ERM framework and is aligned with recognized frameworks, including NIST CSF, FFIEC CAT, FedRAMP, SOC 1/2, ISO 27001/2 and others. BlackRock aims to inform and continuously improve its cybersecurity program through engagement with regulatory, client, insurer, vendor, partner, peer, government and industry organizations and associations, as well as external audit, technology risk, information security and other assessments.


text: BlackRock seeks to address cybersecurity risks through a global, multilayered strategy of control programs that is designed to preserve the confidentiality, integrity and availability of the information that BlackRock collects and stores by identifying, preventing and mitigating cybersecurity threats and incidents. As one of the critical elements of BlackRock's overall ERM framework, BlackRock's cybersecurity program is focused on the following key areas:


text: As discussed in more detail under the heading "BlackRock's Cybersecurity Governance" below, the oversight by BlackRock's board of directors ("BlackRock's Board") of cybersecurity risk management is supported by BlackRock's Risk Committee, which regularly interacts with BlackRock's risk management function, BlackRock's Chief Risk Officer ("CRO") and Chief Information Security Officer ("CISO"), along with other members of management. In addition, technology and cybersecurity risks are formally overseen by a dedicated management risk governance committee, the Technology Risk and Cybersecurity Committee ("TRCC"), which is a sub-committee of the firmwide Enterprise Risk Committee ("ERC").


text: Cross-Functional Approach: BlackRock has implemented a global, cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and incidents, while also implementing layered preventative, detective, reactive and recovery controls to identify and manage cybersecurity risks.


text: Safeguards: BlackRock deploys a range of people, process and technical controls that are designed to protect BlackRock's information systems from cybersecurity threats, which may include, among others: physical security controls perimeter controls, including technical assessments, firewalls, network segregation, intrusion detection and prevention tabletop exercises, ongoing vulnerability and patch management vendor due diligence multi-factor authentication device encryption application security, code testing and penetration testing endpoint security, including anti malware protection, threat intel and response, managed detection and response, security configuration management, portable storage device lockdown, restricted administrative privileges employee awareness, training, and phishing testing data loss prevention program and monitoring information security incident reporting and monitoring and layered and comprehensive access controls.


text: Incident Response and Recovery Planning: BlackRock has established and maintains incident response and recovery plans that address BlackRock's response to a cybersecurity incident, including processes designed to assess, escalate, contain, investigate and remediate the incident, as well as to comply with applicable legal obligations and mitigate potential reputational damage. Such plans are evaluated on a periodic basis.


text: Third-Party Risk Management: BlackRock maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers, counterparties and clients, as well as the systems of third parties that could significantly and adversely impact BlackRock's business in the event of a cybersecurity incident affecting those third-party systems. Third-party risks are included within BlackRock's ERM framework, and risk identification and mitigation are supported by BlackRock's cybersecurity program. BlackRock also performs diligence on certain third parties and monitors cybersecurity threats and risks identified through such diligence.


text: Education and Awareness: BlackRock's employees and contractors are required to complete an annual information security training to equip them with effective tools to address cybersecurity threats, and to receive communications on BlackRock's evolving information security policies and procedures.


text: BlackRock's global information security team, in collaboration with the technology risk and internal audit teams, engages in the periodic assessment and testing of BlackRock's cyber risks and cybersecurity program. These efforts may include a wide range of activities, including audits, assessments, wargames and "tabletop" exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. BlackRock also participates in financial services industry and government forums in an effort to improve both internal and sector cybersecurity defense. BlackRock regularly engages third parties and advisors to assess its cybersecurity control environment. The results of certain program and control assessments are reported to BlackRock's Risk Committee, and BlackRock adjusts its cybersecurity program as appropriate based on the information provided by these assessments.


text: As of December 31, 2024, cybersecurity risks have not materially affected BlackRock's business strategy, results of operations or financial condition.


text: BlackRock ' s Cybersecurity Governance BlackRock's Board is actively engaged in the oversight of BlackRock's risk management program. BlackRock's Risk Committee assists BlackRock's Board with its oversight of BlackRock's levels of risk, risk assessment, risk management and related policies and processes, including risks arising from cybersecurity threats. BlackRock's Risk Committee receives regular reports on BlackRock's cybersecurity program, technology resilience risk management and related developments from members of our information security team, including the CISO. BlackRock's Board and BlackRock's Risk Committee also receive information regarding cybersecurity incidents that meet certain reporting thresholds. On an annual basis, senior members of BlackRock's technology, risk and information security teams provide a comprehensive overview of BlackRock's cyber risk and related programs to a joint session of BlackRock's Board's Risk and Audit Committees.


text: Technology and cybersecurity risks at BlackRock are also overseen by the TRCC, a dedicated management risk governance committee and sub committee of the firmwide ERC. The chair of the TRCC is appointed by the head of Enterprise Risk Management at BlackRock and its members include the CISO as well as a broad range of senior business stakeholders across BlackRock. The TRCC is responsible for oversight of BlackRock's technology and cybersecurity risk management practices and helps ensure that technology and cybersecurity risks remain within firmwide risk tolerances and technology and cybersecurity risk issues are escalated as appropriate to the ERC and other committees. The TRCC also reviews any relevant technology and cybersecurity risk related issues and helps ensure that they are appropriately escalated, reported, and remediated.


text: BlackRock's cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by BlackRock's CISO. As of December 31, 2024, the CISO had over 30 years of experience in information technology with a 25-year concentration in information security, including previously serving as the CISO at several global financial institutions, and held the Certified Information Systems Security Professional certification. The CISO works closely with the leadership team and other subject matter experts in the global cybersecurity group, who collectively have extensive prior work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs and overseeing cybersecurity controls in technology risk and audit functions, as well as having relevant degrees and industry-leading certifications.


text: The CISO and members of the TRCC monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management processes described above, including the operation of BlackRock's incident response plan.


companyName: iShares Gold Trust Micro

ticker: IAUM


companyName: iShares Silver Trust

ticker: SLV


companyName: iShares S&P GSCI Commodity-Indexed Trust

ticker: GSG


text: Safeguards: BlackRock deploys a range of people, process and technical controls that are designed to protect BlackRock's information systems from cybersecurity threats, which may include, among others: physical security controls perimeter controls, including technical assessments, firewalls, network segregation, intrusion detection and prevention tabletop exercises, ongoing vulnerability and patch management vendor due diligence multi factor authentication device encryption application security, code testing and penetration testing endpoint security, including anti malware protection, threat intel and response, managed detection and response, security configuration management, portable storage device lockdown, restricted administrative privileges employee awareness, training, and phishing testing data loss prevention program and monitoring information security incident reporting and monitoring and layered and comprehensive access controls.


text: The Company's management and Board recognize the importance of strong oversight of cybersecurity risk, information security and technology in maintaining the trust and confidence of our customers, partners, employees and stockholders. Our processes for assessing, identifying and managing material risks from cybersecurity threats is incorporated into our Enterprise Risk Management (ERM) program in a similar fashion to other legal, compliance, operational, and financial risk areas. The Company maintains cybersecurity measures aligned with the National Institute of Standards and Technology Cybersecurity Framework (Framework) which organizes cybersecurity risks into six categories: identify, protect, detect, respond, recover and govern, and looks to other standards as well to help identify, assess, and manage cybersecurity risks relevant to our business.

companyName: GENERAC HOLDINGS INC.

ticker: GNRC


text: Our Chief Information Officer (CIO) oversees our information systems and cybersecurity function and reports to our Chief Executive Officer (CEO). He has over 20 years of experience in leading information systems management, strategy, and operational execution, including incident prevention, management, and response. Our Company's Chief Information Security Officer (CISO) is responsible for developing and implementing our information security program and reports to our CIO. The CISO has over 25 years of experience supporting cybersecurity and information technology. They are supported by a direct and cross-functional team of professionals with expertise and experience in threat assessment and detection, mitigation strategies, incident response, training, and regulatory compliance.


text: In addition, we have established a Cybersecurity Steering Committee comprised of members of executive leadership. The Steering Committee, in which our CIO and CISO participate, meets regularly and has established Company-wide policies and standards concerning cybersecurity matters. These policies cover areas such as malware protection, remote access, multifactor authentication, containment of confidential information and the use of the internet, email and wireless devices. We have an established incident response plan led by our CIO and CISO and depending on the nature and severity of the incident, requires escalating notifications up to our CEO and Board.


text: Our Board oversees our enterprise risk management activities. The Board receives periodic updates on our cybersecurity risk management program as well as regular updates and education on relevant legislation and trends related to cybersecurity. Our Audit Committee assists the Board in its oversight role and receives regular reports from management on the Company's information systems and cybersecurity program. Several members of our Board's Audit Committee have expertise and experience in cybersecurity, and one director is the President of a major cybersecurity services provider.


text: The CISO and information technology security team conduct regular risk assessments to assess the overall technology infrastructure and related business processes, identify and address potential security gaps and vulnerabilities, and identify areas requiring additional focus. These risk assessments extend to our supply chain, where cybersecurity health assessments are employed for our critical suppliers. The results are used to calculate a Cybersecurity Risk Score, a key component of our Supply Chain Scorecard used to proactively identify and manage potential risks. Additionally, we require certain third parties that could introduce significant cybersecurity risk to us to agree by contract to manage their cybersecurity risks in specified ways, as appropriate. Risk assessments are also performed on new products and software as part of our new product development process.


text: As part of our risk assessments, we engage third-party services for network penetration testing and security evaluations, conduct annual incident response table-top exercises, and perform regular testing of controls related to our financial information systems by our Internal Audit function.


text: In order to promote a culture of security awareness across our organization, all employees are required to complete an annual cybersecurity awareness training and are provided with periodic information updates on cybersecurity threats. We also maintain cyber insurance policies to help partially mitigate the financial impact of a significant cybersecurity incident.


text: Despite our best efforts, we cannot guarantee that our security measures will prevent all potential cybersecurity incidents or breaches. Our systems are continually subject to sophisticated and evolving cyber threats, such as phishing, ransomware, social engineering, and advanced persistent threats. However, to date, we have not been subject to any incidents or successful cyber-attacks that have materially impacted our operations or financial condition. The Company has invested in developing and acquiring cybersecurity capabilities allowing us to monitor threats and manage incident response. We have also developed internal policies to mitigate cybersecurity incidents, including providing clear guidelines for incident classification, escalation, and response. We recognize the importance of continued monitoring and improvement of our cybersecurity program, and will continue to evolve our security controls, incident response capabilities, and third-party vendor management protocols.


text: For additional information on the cybersecurity risks that we face, also see Item 1A. "Risk Factors" of this Annual Report on Form 10-K.


text: We rely on information technology systems across our operations, including for management, supply chain and financial information and various other processes and transactions. Our ability to effectively manage our business depends on the security, reliability and capacity of these systems. We have established a range of security measures that are designed to protect against the unauthorized access to and misappropriation of our information, corruption of data, intentional or unintentional disclosure of confidential information, or disruption of operations. We have implemented additional controls, security processes and monitoring of our manufacturing systems. We have also implemented additional cloud security tools and governance processes for assessing, identifying and managing material risks from cybersecurity threats. In addition, we maintain an information security training program that encompasses the following areas: phishing and email security, password security, data handling security, cloud security, operational technology security processes, and cyber-incident response and reporting processes.

companyName: SHYFT GROUP, INC.


text: The oversight of our cybersecurity risk management process is integrated into our overall risk management process. Through our enterprise risk management process, which involves a broad cross-functional group across many areas of expertise and is structurally independent of our business lines, we identify and assess risk and risk-mitigation actions, including with respect to cybersecurity risks. Our Chief Information Officer ("CIO") provides oversight of our cybersecurity risk, which is addressed by a group of stakeholders that includes our information technology ("IT") and cybersecurity leadership and IT leaders within our various facilities, with cybersecurity risk input provided from this team to our senior leadership team on a regular basis. Our CIO provides key updates on risk and mitigation strategies to the Audit Committee.


text: We rely on third-party service providers to execute certain business processes, maintain certain information systems and infrastructure, evaluate defenses, and implement recommendations. We periodically have external information security assessments performed by third parties to analyze our internal assessment results and to stay informed of information security risks. Additionally, we maintain a supplier validation process, which involves approval by our cybersecurity group for significant suppliers that will have access to any of our databases or technology. We also maintain processes to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers.


text: While we have experienced cybersecurity incidents in the past, as of the date of this filing, we do not believe that any risks from cybersecurity threats, including as a result of past cybersecurity incidents have had, or are reasonably likely to have, a material effect on the Company, including our business strategy, results of operations or financial position. We continue to invest in the cybersecurity and resiliency of our networks and to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain. For more information regarding the risks we face from cybersecurity threats, please see "Risk Factors-- More General Risks Applicable to Our Industry."


text: The Board of Directors is responsible for overseeing risk for the Company and has delegated to the Audit Committee responsibility for overseeing the cybersecurity risk management strategy for the Company. The Audit Committee reviews how we are executing against our comprehensive cybersecurity framework, including reviewing our cybersecurity reporting protocol. The Audit Committee receives regular updates on cybersecurity risks from our CIO. The Audit Committee also regularly receives updates on efforts regarding data loss prevention, regulatory compliance, data privacy, threat and vulnerability management, cyber-crisis management, and other topics as applicable. Additionally, management provides the Audit Committee with a cybersecurity dashboard, which the full Board of Directors can access as well.


text: The Company's cybersecurity program is overseen by our CIO, who is responsible for assessing and managing material risks from cybersecurity threats, including monitoring the prevention, detection, mitigation and remediation of cybersecurity incidents. Our CIO has over 20 years of global automotive technology and cybersecurity experience and reports to our President and Chief Executive Officer.


text: The Company's Security Manager reports to our CIO and is the head of our cybersecurity team. The Security Manager is responsible for assessing and managing our cyber risk management program, informs senior management, together with the CIO, regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervises such efforts. Our Security Manager has over 15 years of experience in technology and cybersecurity, a master's degree in information security and industry certifications, including CISSP, CDPSE, ITIL, and COBIT.


text: Dana maintains a risk management program overseen by our Executive Leadership Team. Our Senior Vice President and Chief Financial Officer and Senior Vice President, General Counsel and Secretary / Chief Compliance and Sustainability Officer (General Counsel) have responsibility for our risk management program. In addition, our Business Unit Presidents and functional leads oversee strategic and operational risks, including cybersecurity risks. Cybersecurity is a top priority, and our cybersecurity program is driven by our commitment to maintaining a strong security architecture, active governance, and robust controls. Our cybersecurity program is led by our Director of Cybersecurity and GRC (DOC) and overseen by Dana's Enterprise Cybersecurity Steering Committee (ECSC). The ECSC is sponsored by senior leaders from disciplines such as Information Technology, Legal, Human Resources, Engineering, Product Development, and Operations, and includes the Senior Vice President and Chief Information Officer (CIO); General Counsel; Senior Vice President and Chief Human Resources Officer; Senior Vice President and Chief Technology Officer; and Senior Vice President Global Operations. The ECSC is responsible for developing and overseeing strategies related to Dana's cybersecurity program. As set forth in its charter, our Technology & Sustainability Committee, comprised of independent directors, has oversight responsibilities for cybersecurity risk and includes members with significant cybersecurity experience. The DOC and CIO regularly provide updates on Dana's cybersecurity program to the Board and the Technology & Sustainability Committee.

companyName: DANA Inc

ticker: DAN


text: Dana's global cybersecurity team is charged with executing enterprise, product, and manufacturing cybersecurity programs and policies with a focus on security architecture, penetration testing, cyber risk management, incident response, vulnerability management, intelligence, awareness and training, and governance. Dana's cybersecurity programs utilize the National Institute of Standards and Technology (NIST) Cybersecurity Framework and leverage the International Organization for Standardization (ISO) 27001 standard for information security. Dana periodically contracts with external auditing firms to assess the maturity of Dana's cybersecurity program against the NIST Cybersecurity Framework. The results of these audits are shared with the Technology & Sustainability Committee. Dana leverages independent security ratings services assessments to aid in measuring our progress along the cybersecurity continuum as well as for measurement against peer companies. Dana's supplier risk management process incorporates cybersecurity review and assessment procedures over third-party vendors and service providers.


text: Dana has an established cybersecurity awareness training program. Formal training on topics relating to cybersecurity is mandatory at least annually for all employees with access to the Company's network. Training is administered and tracked through online learning modules. Training topics include how to escalate suspicious activities including phishing, viruses, spams, insider threats, suspect human behaviors or safety issues. Training is supplemented by phishing awareness campaigns.


text: In the event a high-risk cybersecurity incident is identified, our Incident Response Team will coordinate the response in accordance with our Information Security Incident Response Plan and make necessary communications to the ECSC and executive leadership. The DOC and CIO will make any required communications to the Chief Executive Officer (CEO), with the CEO making any required communications to the Board and Technology & Sustainability Committee. Our CEO, Chief Financial Officer, General Counsel and CIO are responsible for assessing such incidents for materiality, ensuring that any required notification or communication occurs and determining, among other things, whether any prohibition on the trading of our common stock by insiders should be imposed prior to the disclosure of information about a material cybersecurity event.


text: In the last three years we have not experienced any cybersecurity incident that has been material to the results of our operations or that has caused us to incur any material expenses.


text: We and our operators increasingly rely on information technology systems to operate our respective businesses, and the oil and natural gas industry depends on digital technologies in exploration, development, production, and processing activities. We depend on digital technology in many areas of our business and operations, including, but not limited to, estimating quantities of oil and natural gas reserves, processing and recording financial and operating data, oversight and analysis of drilling, completion and production operations and communications with the employees of the Operating Partnership and third party customers and services providers. We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational risks, gathering, misuse, loss or destruction of proprietary and other information, fraud, extortion, harm to employees or customers, violation of data privacy or security laws and disruption of other business activities.

companyName: DORCHESTER MINERALS, L.P.

ticker: DMLP


text: We maintain a comprehensive process for identifying, assessing, and managing material risks from cybersecurity threats as part of our broader risk management process. Our executive officers, along with input from our outsourced IT managed services provider, other external experts, and department managers, are responsible for our overall enterprise risk assessment and management process and regularly consider cybersecurity risks in the context of other material risks to the Partnership. We obtain input on the security industry and threat trends for our cybersecurity risk management processes from external experts, as appropriate. Our outsourced IT managed services provider has expertise in areas including, but not limited to, information technology and infrastructure, network and communications architecture, information systems and database management, back up management, and cybersecurity.


text: Our risk management process also assesses third party risks. We perform assessments to identify and mitigate risks from third parties such as vendors and other business partners associated with our use of third party service providers. Cybersecurity risks are evaluated when determining the selection and oversight of applicable third party service providers and potential fourth party risks when handling and/or processing employee, business, or customer data.


text: To protect our information systems from cybersecurity threats, we, among other things: (i) conduct regular reviews of information systems security programs and policies, (ii) perform penetration testing using external third party tools and techniques to test security controls, (iii) provide employee training, (iv) monitor emerging trends, laws, and regulations related to data protection and information security, and (v) use various security tools that help monitor, prevent, identify, escalate, investigate, resolve, and recover from identified vulnerabilities and security incidents in a timely manner, including, but not limited to, monitoring and detection tools managed by external experts and internal reporting.


text: We, in coordination with external experts, have implemented a cyber and data security incident response plan that has four overarching and interconnected stages: 1) preparation for a cybersecurity incident, 2) identification, analysis, and notification of a security incident by external experts, as applicable, 3) containment, eradication, and recovery, and 4) post-incident analysis and learnings for future preparedness. Such incident responses are managed by our outsourced IT managed services provider, Chief Financial Officer ("CFO"), and department managers, who, together, comprise our primary incident response team. As part of our cybersecurity risk management process, our incident response team logs and tracks privacy and security incidents across the Partnership, vendors, third party service providers, and other business partners. Cyber and data security incidents are evaluated to determine materiality, as well as operational, business, and privacy impact, ranked by severity, and prioritized for response and remediation. Significant incidents are evaluated by the primary incident response team to determine whether further escalation is appropriate, and any incident assessed as potentially being or potentially becoming material is immediately escalated for further assessment and reported to the Chief Executive Officer ("CEO"). We consult with outside counsel and other subject matter experts regarding materiality analysis, disclosure, and other compliance matters, as appropriate, and our executive officers, with input from the Board of Managers, as appropriate, make the final materiality determinations and disclosure and other compliance decisions. Our management apprises the Partnership's independent public accounting firm of matters and any relevant developments.


text: The Advisory Committee of the Board of Managers of the general partner of our General Partner has oversight responsibility for risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements, cooperation with law enforcement, and related effects on financial and other risks, and it reports any findings and recommendations, as appropriate, to the full Board of Managers for consideration. Reports are periodically provided to the Advisory Committee during our board meetings by the individuals who oversee risk management in cybersecurity. This includes existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any), and status on key information security initiatives. Members of the Board of Managers also engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.


text: As of the date of this filing, our business strategy, results of operations, and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, see "Item 1A – Risk Factors".


text: Our Vice President of Strategic Initiatives and Chief Financial Officer oversee our cybersecurity risk management program described in "Risk Management and Strategy" below. While the Board of Directors has overall responsibility for risk oversight, it is supported in this regard by the Audit Committee, including with respect to cybersecurity matters. The Audit Committee assists the Board of Directors in monitoring cybersecurity risk by receiving as needed updates from and engaging in discussions with the Vice President of Strategic Initiatives and the Chief Financial Officer, that cover, among other things, our cybersecurity risk management program, response readiness and training efforts. The Audit Committee updates the full Board of Directors on cybersecurity matters as appropriate.

companyName: NATURAL HEALTH TRENDS CORP

ticker: NHTC


text: Our business is dependent upon our computer systems, devices and networks to collect, process and store the data necessary to conduct almost all aspects of our business. We maintain a cybersecurity risk management program, which includes internal and external human resources, processes, controls and technology designed to identify, protect, detect, respond to and manage reasonably foreseeable cybersecurity risks and threats.


text: To safeguard our information systems from cybersecurity threats, we use various security tools that help prevent, identify, escalate, investigate, resolve and recover from identified vulnerabilities and security incidents in a timely manner at a network and user end point level. These include, but are not limited to, internal reporting, monitoring and detection tools. We engage various third-party vendors to provide these security services, including providing timely cybersecurity threat alerts in addition to monitoring cybersecurity threats and our defenses against cyberattacks. This monitoring includes the proactive identification of vulnerabilities in our systems with threat intelligence. In addition, we engage a third-party vendor to perform penetration testing at least annually and our IT team also performs simulations and response readiness tests on an annual basis. Our incident response plan sets forth our response protocol to coordinate the activities that we take to respond and recover from cybersecurity incidents, which include processes to triage, assess severity, investigate, escalate, contain, and remediate an incident, as well as to comply with potentially applicable legal and reporting obligations and mitigate brand and reputational damage.


text: We also maintain a third-party risk management process to mitigate vulnerabilities associated with external service providers and vendors. This includes reviewing service-level agreements and third-party security certifications, such as PCI DSS and SOC reports, on an annual basis or as-needed to ensure vendors adhere to our security and compliance standards.


text: We have adopted an IT Policies and Procedures Policy that requires all employees to acknowledge on an annual basis their responsibilities in abiding with company policies regarding safeguard our network environment. In addition, all employees receive cybersecurity training upon hire with at least annual training on best practices, social engineering threats and cybersecurity risks.


text: We continuously monitor our computer systems, devices and networks, and work to improve our safeguards against regular and continually evolving cyber and other security threats. To date, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. However, notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident in the future that could have a material adverse effect on us. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. For further information about the cybersecurity risks we face, see "Item 1A. Risk Factors – System disruptions or failures, cybersecurity risks, and compromises of data, or the failure to comply with related laws and regulations, could harm our business."


text: The Company has no employees and is externally managed by our Manager, which is a wholly owned subsidiary of Bimini. Pursuant to the terms of the Management Agreement, our Manager manages, operates and administers our day-to-day operations, business and affairs, subject to the direction and supervision of the Board. The Board plays an active role in overseeing management of our risks, and cybersecurity represents an important component of the Company's overall approach to risk management and oversight.

companyName: Orchid Island Capital, Inc.

ticker: ORC


text: As an externally managed company, the Company relies on our Manager's information systems in connection with the Company's day-to-day operations. Consequently, the Company also relies on our Manager's processes for assessing, identifying, and managing material risks from cybersecurity threats undertaken by our Manager. All of the Company's executive officers are executive officers, directors and employees of Bimini.


text: Our Manager's cybersecurity processes and practices are integrated into the Company's risk management and oversight program. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. The Company has adopted a cybersecurity incident response plan to enable rapid response, curtail further security breaches, mitigate and manage costs, and facilitate timely disclosure of material cyber incidents as required by the SEC.


text: The Company, our Manager and our Board place a high priority on maintaining security over our financial information that can be accessed via the Internet and mitigating information security risks. The Company engages a third-party security firm to provide threat detection and reports, conduct annual testing of our Manager's systems, train the Manager's employees and generally advise on cybersecurity processes. At least annually, our Manager has its information technology team and its third-party security firm make a formal presentation to our Audit Committee and the Board to keep them apprised of the level of cybersecurity that exists to protect our financial information, training of the Company's officers and the Manager's employees, and the latest threats that have emerged.


text: As discussed in more detail under "Item 1C. Cybersecurity—Governance," the Audit Committee and the Board oversee cybersecurity risk management by regularly interacting with the Company's management team, our Manager's information technology team and a third-party security firm.


text: Collaborative Approach: The Company has implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.


text: Technical Safeguards: The Company deploys technical safeguards that are designed to protect information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, redundant data storage and retention methods, anti-malware functionality and access controls, which are evaluated and improved through vulnerability and exposure assessments and cybersecurity threat intelligence. With the help of the third-party security firm, the Company has implemented several layers of physical security, digital security and data backup.


text: The Company has established a comprehensive incident response and recovery plan that addresses the response to a cybersecurity incident and plans to test and evaluate that plan on a regular basis.


text: The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including counterparties, service providers or other external users of our Manager's systems, as well as the systems of third parties that could adversely impact the Company's business in the event of a cybersecurity incident affecting those third-party systems.


text: A third-party security firm provides training to our Manager's employees, helping our Manager's information technology team to maintain a state-of-the-art cybersecurity system and stay up to date on the latest threats and counter measures available. The third-party security firm places a high priority on employee threat education through automated internal phishing tests. Our Manager's information technology team attends continuing education seminars and receives timely alerts to any new viruses or cyber threats as they occur as a means to equip personnel with effective tools to address cybersecurity threats, and to communicate evolving information security policies, standards, processes and practices.


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to affect the Company, including its business strategy, results of operations or financial condition. The Company is not aware of any material security breach to date. Accordingly, the Company has not incurred any expenses over the last three years on information security breaches. However, the Company faces certain ongoing risks from cybersecurity that, if realized, could materially affect the Company. See "Item 1A. Risk Factors - The occurrence of cyber-incidents, or a deficiency in our cybersecurity or in those of any of our third party service providers could negatively impact our business by causing a disruption to our operations, a compromise or corruption of our confidential information or damage to our business relationships or reputation, all of which could negatively impact our business and results of operations." There can be no assurance that the Company's cybersecurity risk management program and processes, including its policies, controls or procedures, will be fully implemented, complied with or effective in protecting its systems and information.


text: The Company believes oversight of cybersecurity risk is the responsibility of the Audit Committee and the full Board. Accordingly, the Audit Committee and the Board oversee the Company's cybersecurity risk management process. The Board considers the Company's cybersecurity posture and risk exposure with management taking into consideration the Company's operations and the types of data retained on its systems as part of its and the Audit Committee's periodic review of the Company's risk management. The Company's primary business involves investments in Agency RMBS, which are securities backed primarily by single-family residential mortgage loans. The Company does not receive personal information on individual mortgage borrowers. The Board reviews the Company's cybersecurity program and risk exposure with management on at least an annual basis and receives reports from management, the Manager's information technology team, and the Company's third-party security firm on these matters from time to time. The Board may also conduct additional cybersecurity reviews or receive additional updates or reports as it deems necessary.