text: Management Oversight — We have implemented a cross functional ISMS governance committee that drives awareness and alignment across broad governance and stakeholder groups for effective cybersecurity risk management. The CSO and acting Data Privacy Officer ("DPO") co-chair the ISMS Governance Committee. The ISMS Governance Committee acts in alignment with the Data Protection Governance Committee, another cross-functional governance committee, which provides strategic direction and oversight over the company's program related to data protection. These governance committees have responsibility for oversight, resource allocation, capabilities and planning. Members of the ISMS committee review newly identified cybersecurity risks, evaluate the appropriate treatments, monitor the on-going status of risk remediation. The CSO and acting DPO regularly report to the audit committee on these matters.


text: We maintain a comprehensive process for identifying, assessing, and managing material risks from cybersecurity threats as part of our broader risk management system and processes. This cybersecurity risk management process includes a wide variety of mechanisms, controls, technologies, methods, systems, and other processes that are designed to prevent, detect, or mitigate data loss, theft, misuse, unauthorized access and other security incidents and vulnerabilities.

companyName: Digital Turbine, Inc.

ticker: APPS

secItem: Item 1C


text: As part of our cybersecurity risk management process, we conduct regular application security assessments, vulnerability management, external penetration testing, security audits, and risk assessments. We leverage third-party security service providers to provide continuous and uninterrupted identification and mitigation of risk-prioritized security events. We maintain an incident response plan that is utilized when incidents are detected. Our incident response plan coordinates the activities that we and our third-party cybersecurity provider take to prepare to respond, recover from and mitigate cybersecurity incidents, which include processes to assess severity, investigate, escalate, contain, and remediate an incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational harm.


text: We require employees with access to information systems, including all corporate employees, to undertake data protection, cybersecurity, privacy and compliance programs at least annually. We maintain a team of dedicated security and compliance professionals who oversee cybersecurity risk management, mitigation, incident prevention, detection, and remediation, which is led by our Chief Information Security Officer. The team has deep cybersecurity experience with an average tenure of over 20 years with expertise in protecting critical assets for top firms in a myriad of different industries.


text: We leverage SOC 2 Type 2 attestation framework to determine the operating effectiveness of our internal security controls and use NIST Cybersecurity framework to better understand, manage and reduce cybersecurity risk and protect our business from ever-changing cyber threats.


text: We achieved SOC 2 Type 2 attestation this fiscal year, demonstrating the operating effectiveness of our internal security controls and our commitment to industry-leading information security standards. This attestation provides assurance to stakeholders that Digital Turbine's systems and processes are regularly audited by independent third parties to verify compliance with rigorous security and privacy requirements.


text: As part of our cybersecurity risk management process, we contractually require third-party service providers to implement and maintain key security measures in connection with their work with us when appropriate that is consistent with applicable laws. Additionally, our third-party service providers are to promptly report any breach of their security measures or systems that may affect our Company. Our security and compliance professionals track and log privacy and security incidents across our vendors and other third-party service providers to remediate and resolve any such incidents. Significant incidents associated with our vendors and service providers are reviewed regularly to determine whether further escalation is appropriate. Any incident assessed as potentially being or potentially becoming material is immediately escalated for further assessment, and then reported to designated members of our senior management.


text: Our executive leadership team, along with input from the above team, are responsible for our overall enterprise risk management system and processes and regularly consider cybersecurity risks in the context of other material risks to the Company. Senior management regularly discusses on at least a quarterly basis and otherwise as needed, cyber risks and trends and, should they arise, any material incidents with the Audit Committee.


text: The Audit Committee has oversight responsibility over our cybersecurity risk management process, including risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements, cooperation with law enforcement, and related effects on financial and other risks, and it reports any findings and recommendations, as appropriate, to the full Board for consideration.


text: Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, see Part I, Item 1A Risk Factors of this Annual Report on Form 10-K, including the risk factor titled "System security risks, data protection breaches, cyber-attacks, and systems integration issues could disrupt our internal operations or information technology services provided to customers, and any such disruption could reduce our expected revenue, increase our expenses, damage our reputation, and adversely affect our stock price."


text: The Company maintains comprehensive policies, procedures, and controls to protect the Company's information systems and related data from cybersecurity threats and incidents. The Company's cybersecurity program is led by its Chief Information Security Officer ("CISO") and supervised by its Chief Information Officer ("CIO"). The Company's cybersecurity program is a component of its overarching enterprise risk management program and interfaces with other functional areas within the Company, including, but not limited to, legal, accounting, risk management, human resources, internal audit, as well as external third-party partners, to identify, understand, and combat potential cybersecurity threats. Our cybersecurity program is aligned with three recognized control frameworks: ISO 27001; 2013, NIST SP 800 – 52; and the Center for Internet Security Top 20 Critical Security Controls. We conduct ongoing and robust testing of our systems, including penetration testing, internal and external audits, tabletop incident response exercises, and an annual Cyber Risk Assessment, the results of which are shared with the Audit Committee.

companyName: GMS Inc.


text: We provide regular awareness training to our employees and contractors, including periodic phishing tests, to help identify, avoid, and mitigate cybersecurity threats, as well as targeted security training for key departments dealing with sensitive data types.


text: The Company has engaged a third-party managed detection and response company to monitor the security of its information systems. The Company also maintains a cybersecurity insurance policy and has engaged a third-party incident response consultant and legal counsel.


text: Cybersecurity Incident Response Process We maintain and actively update our Cybersecurity Incident Response Plan to triage, contain, and mitigate any issues as quickly as possible. Our Cybersecurity Incident Response Plan includes steps to analyze, and as necessary, escalate cybersecurity incidents both internally and with third-party service providers based on the type and severity of the specific incident. Our Cybersecurity Incident Response Policy ensures that our CIO, and, as appropriate, our senior management team, members of our legal staff and outside legal counsel, our disclosure committee, and members of our Audit Committee or Board of Directors are timely informed of and consulted regarding cyber incidents.


text: The Company's Board of Directors provides ultimate oversight of the Company's cybersecurity risk management. As reflected in the Audit Committee's charter, the Board of Directors has specifically delegated responsibility for oversight of cybersecurity matters to the Audit Committee. The CIO presents quarterly updates to the Audit Committee on the Company's cyber risks and threats, status of projects to strengthen the Company's information security systems, and emerging threats. The Company also engages third parties to periodically evaluate and audit aspects of the Company's information security programs, including by conducting vulnerability assessments and penetration testing, and the results of those findings are reported to the Audit Committee and used to help identify potentially material risks and prioritize certain security initiatives.


text: The Company does not believe that any risks from cybersecurity threats, nor any previous cybersecurity incidents, have materially affected the Company. However, the sophistication of cyber threats continues to increase, and the preventative actions the Company has taken and continues to take to reduce the risk of cyber incidents and protect its systems and information may not successfully protect against all cyber incidents. For more information on how cybersecurity risk may materially affect the Company's business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors."


text: Risk Management and Mitigation Strategies As part of our commitment to safeguarding our assets and maintaining the integrity of our operations, C3 AI has established a comprehensive cybersecurity risk management program. This program is designed to identify, assess, and mitigate cybersecurity risks that could potentially impact our business operations, customers, and stakeholders. C3 AI employs a multi-layered approach to identify and assess cybersecurity threats. This includes: • Regular vulnerability scanning: We conduct internal and external vulnerability scans of our systems and applications to identify potential weaknesses that attackers could exploit. • Penetration testing: We engage independent security professionals to conduct simulated cyberattacks on our systems to assess the effectiveness of our security controls. • Threat intelligence monitoring: We subscribe to threat intelligence feeds that provide us with real-time information about the latest cyber threats and vulnerabilities. • Risk assessment framework: We utilize a risk assessment framework to categorize identified threats based on likelihood and potential impact on our business operations, financial stability, and reputation. This framework includes third-party vendor risk assessment to manage cybersecurity risks associated with our use of these providers. The third-party vendor risk assessment framework includes the following: Perform due diligence of the vendors' standards, including reviewing security policies, certifications, and third-party attestation and past security incidents. Request vendors to complete security questionnaires and provide any security and vulnerability scans.

companyName: C3.ai, Inc.

ticker: AI


text: Define security expectations within the vendor contract including data security obligations, access controls, incident reporting procedures, security assessment calls if necessary and review of incident response plan, business continuity and disaster recovery plan.


text: • Network security: Firewalls, intrusion detection/prevention systems (IDS/IPS), and data loss prevention (DLP) solutions are deployed to monitor and filter network traffic. • Endpoint security: Antivirus, anti-malware, and Mobile Device Management solutions are implemented on all company devices. • Access controls: User access controls are implemented to restrict access to sensitive data and systems based on the principle of least privilege. • Data security: Encryption solutions are used to protect sensitive data both at rest and in transit. • Security awareness and training: We provide regular security awareness training to all employees to educate them on cybersecurity best practices and phishing attempts.


text: For a description of the risks from cybersecurity threats that may materially affect us, see the section titled "Risk Factors" contained in Part I, Item 1A of this Annual Report on Form 10-K.


text: Cybersecurity risk management is integrated with our overall enterprise risk management framework. Identified cybersecurity risks are reported through established channels to relevant stakeholders, including senior management and the Board of Directors. Mitigation strategies are prioritized and incorporated into the overall risk management plan. We continuously identify and evaluate potential cybersecurity threats. While the nature of cyber threats makes it impossible to predict all future incidents, some currently identified material cybersecurity risks include: • Ransomware attacks that could disrupt business operations and lead to data breaches. • Phishing attacks that could compromise employee credentials and provide unauthorized access to sensitive data. • Supply chain attacks targeting third-party vendors with access to our systems or data.


text: Management is responsible for the overall implementation and effectiveness of the cybersecurity program. This includes allocating resources, establishing policies, and ensuring employee adherence to security practices. The VP of Information Security leads the cybersecurity team and reports directly to the VP of Cloud Infrastructure.


text: The Audit Committee of the Board of Directors has specific oversight responsibilities related to cybersecurity, including review of security controls and incident response plans. Management provides updates to the Audit Committee on cybersecurity risks and the effectiveness of our cybersecurity program.


text: Our commitment to security is evidenced by our certifications under ISO 27001, ISO 27017, SOC 2 Type II, HIPAA, NIST 800-171 and FedRamp Additionally, we subject our standards-based certifications to annual audits by third parties and have successfully undergone examinations such as the Health Insurance Portability and Accountability Act (HIPAA), validated by qualified third-party assessors. There were no material cybersecurity incidents experienced by C3 AI during the fiscal year ended April 30, 2025.


text: We have an established cybersecurity risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. Our cyber risk management program is designed to protect the confidentiality, integrity and availability of our systems and the data of our clients, candidates and company. This program and its processes are an integral component of our enterprise risk management ("ERM") program.

companyName: KORN FERRY

ticker: KFY


text: Our cybersecurity program utilizes the International Organization for Standardization Information Security Management Systems (" ISO 27001") framework, which incorporates the National Institute of Standards and Technology and Center for Internet Security frameworks, and various risk management frameworks to proactively evaluate its cybersecurity controls, risks, and overall program effectiveness. Our approach to protecting our systems uses the concept of defense in depth, providing multiple layers of defense, monitoring, and controls. It is a mutually supported environment of fit-for-purpose technology, established processes, trained security and operations personnel, and supporting external services.


text: As of the date of this report, we have not experienced a cybersecurity incident that has materially affected us, including our business strategy, results of operations or financial condition. While we have not experienced any material cybersecurity threats or incidents, there can be no guarantee that we will not be the subject of future successful attacks, threats or incidents. Risks from cybersecurity threats, including those resulting from any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations, or financial condition. However, we face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to have such an effect. Additional information on cybersecurity risks we face can be found in Item 1A "Risk Factors" under the heading "Risks Related to Technology, Cybersecurity and Intellectual Property," which should be read in conjunction with the foregoing information.


text: Our global security team is led by our Global Vice President Security who reports to the Chief Information Officer. Our Chief Information Officer has more than two decades of experience in information technology and process leadership, including leading teams with global cybersecurity responsibilities. The Global Vice President Security leads the strategy and execution of our cybersecurity program, has more than two decades of dedicated security experience, and holds multiple security qualifications including Certified Information Systems Security Professional. He leads an experienced security team, organized and geographically structured with the goal of maximizing responsiveness and coverage for our global enterprise. The team is additionally supported through external services and on demand incident response capabilities. These capabilities include pre-established relationships with industry leading providers for incident containment, forensic analysis, systems recovery, legal advice, and external communications assistance.


text: Korn Ferry has invested in a spectrum of security tools and capabilities designed to prevent compromise of our systems and data. These solutions are selected from well recognized industry leaders and encompass a wide range of security capabilities including, among other things, threat detection, prevention, system monitoring, logging, vulnerability assessment, incident and event management, system and cloud configuration and permission management. To validate the effectiveness of our security capabilities and our supporting environment we assess them across multiple dimensions. This includes the use of independent external third-party security firms to conduct external and internal penetration tests, vulnerability assessments, and audits.


text: We leverage a structured process framework based on ISO 27001 to minimize cyber risks and facilitate continuous improvement. We adhere to the principle of least-privilege when provisioning access to systems, seeking to limit potential abuse of system privileges by internal or external threats. We train our employees annually in cybersecurity awareness and responsibilities and we engage them throughout the year with phishing awareness exercises, additional focused training, and messaging about current and persistent threats. Employees with privileged access to systems are further trained in security-by-design principles, centered on best practices for securely developing and managing software systems.


text: Our software development processes are governed by a structured systems development lifecycle process that is designed to review new features and system changes for adherence to security requirements prior to deployment. Our systems are further protected via a regular cadence of patching and prioritized vulnerability remediation. Lastly, the use of third-party software in our environment is governed by our third-party risk management program, which is designed to assess and remediate cyber and business risks associated with vendor-provided software and services.


text: Integral to our cybersecurity processes is our Security Incident Response Plan ("SIRP"), designed to facilitate the timely and accurate reporting of any material cybersecurity incident. The incident management process is designed so that incidents are appropriately categorized and escalated to the Security Incident Response Team ("SIRT") for action and materiality determination. Our SIRT is comprised of senior executives including the Chief Financial Officer, Chief Information Officer, Global Vice President Security, Co-Chief Privacy Officers, General Counsel and other members as required depending on the nature of the incident. In addition to managing escalated incidents, the SIRT conducts tabletop exercises to simulate various threat scenarios, and outcomes are used to build experience and to refine the SIRP and response approaches. Korn Ferry has also maintained cyber insurance for more than a decade.


text: Korn Ferry has been certified by the British Standards Institute (BSI) to ISO 27001 and ISO/IEC 27018 for our key technology platforms and processes across global operations.


text: Our Board is responsible for the oversight of the Company's overall ERM program, which includes cybersecurity risks. The Board is briefed at least annually by the Chief Information Officer on the readiness and efficacy of the cybersecurity program. These briefs include a review of the Company's cybersecurity initiatives, key security metrics, business continuity and disaster recovery plans and updates on evolving cyber threats and mitigation plans. These briefs also review significant updates to procedures, policies, and controls used to identify, manage, and mitigate cybersecurity risks. The Board is supported in this oversight by the Audit Committee, which receives regular updates from members of the executive leadership team including the Chief Financial Officer, General Counsel, Chief Information Officer, and the Senior Vice President Internal Audit on emerging cybersecurity risks and issues.


text: Management Oversight Management regularly assesses and identifies potential cybersecurity risks as a key component of the Company's ERM program. The Company's cyber risks are reviewed and prioritized as part of the annual Enterprise Risk Assessment and ongoing quarterly reviews. Changes in these risks are communicated at least quarterly to the Audit Committee. Management further enables regular reviews of systemic, emerging, and ongoing security and data privacy risks through a standing body, the Privacy and Security Executive Committee ("PEC/SEC") which meets quarterly and whose reporting is used to inform the Audit Committee and annual reporting to the Board of Directors. The PEC/SEC is comprised of senior management including the Chief Financial Officer, Chief Information Officer, Global Vice President Security, Co-Chief Privacy Officers, Chief Human Resources Officer, General Counsel and other senior leaders as required.


text: We have established policies and processes for assessing, identifying and managing material risk from cybersecurity threats. These policies and processes are intended to protect the confidentiality, integrity and availability of our critical information systems and our critical data, including intellectual property and confidential information that is proprietary, strategic or competitive in nature.

companyName: Credo Technology Group Holding Ltd

ticker: CRDO


text: We conduct periodic risk assessments to identify cybersecurity threats. These risk assessments include identifying reasonably foreseeable potential internal and external risks, the likelihood of occurrence and any potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, controls and other safeguards in place to manage such risks. We also use third-party service providers from time to time in connection with our risk assessment processes.


text: As part of our overall risk management program, we provide training to employees at all levels on cybersecurity awareness and the protection of confidential information. In addition, we have established a cybersecurity incident response process that includes procedures for detecting and responding to cybersecurity incidents. The Company also participates in a cybersecurity risk insurance policy.


text: As of the date of this Annual Report on Form 10-K, we are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. See Item 1A, "Risk Factors," in this annual report on Form 10-K, including the risk factors entitled "Cybersecurity breaches, cyberattacks and other disruptions to information technology systems could disrupt our operations, compromise the confidentiality of our data or our intellectual property, and adversely affect our business, reputation, operations and financial results" and "Our business may be impacted by information technology system failures or network disruptions and lack of redundancy" in this Annual Report on Form 10-K for additional information about our cybersecurity-related risks.


text: Our Board considers cybersecurity risk as part of its overall risk oversight function and has delegated to the Nominating and Corporate Governance Committee of the Board (the NCG Committee) overall oversight of cybersecurity matters and other policies and internal controls regarding cybersecurity risks. The Audit Committee of the Board (the Audit Committee) is responsible for oversight of disclosure controls with respect to potential cybersecurity incidents as well as the Company's compliance with SEC rules applicable to cybersecurity risk management.


text: In fiscal 2025 the Audit Committee and the NCG Committee received reports on our cybersecurity risk management initiatives. In addition, our management team updates the Board with respect to the Company's overall cybersecurity risk posture and initiatives in order to improve our cybersecurity risk controls. As necessary, the Audit Committee will oversee management's responses to any significant cybersecurity incidents including any disclosures required by law. The full Board also receives a briefing from management on our cyber risk management program at least annually.


text: Our management team, which includes our IT management team, is responsible for day-to-day implementation, management and evaluation of our cybersecurity risk assessment and management processes. The IT management team has primary responsibility for our overall cybersecurity risk management program, including monitoring the prevention, detection, mitigation and remediation of cybersecurity incidents, and works in partnership with our other business leaders, including our Chief Legal Officer, Chief of Staff and internal audit function, as needed. Our IT management team supervises both our internal cybersecurity personnel and any retained external cybersecurity consultants. Our Director of IT has served in various roles in information technology and information security for over 15 years.


text: Our cybersecurity incident response process is designed to escalate significant cybersecurity incidents to a team of business leaders, including, but not limited to, our Chief of Staff, Chief Legal Officer and Chief Financial Officer. In the case of a cybersecurity incident, this team of business leaders will work with our incident response team to help determine the severity of the impact of a cybersecurity incident, as well as to help mitigate and remediate cybersecurity incidents of which they are notified. The incident response team will also work under the oversight of legal counsel and the Audit Committee to determine whether an incident is material for disclosure purposes under applicable law.


text: The Company maintains cybersecurity processes, technologies and controls to help it assess, identify and manage material risks from cybersecurity threats. These processes, technologies and controls are part of the Company's overall enterprise risk management process.

companyName: BUTLER NATIONAL CORP

ticker: BUKS


text: Our cybersecurity program is based on the National Institute of Standards and Technology Cybersecurity Framework and is designed to ensure that our information systems are effective and are prepared for cybersecurity threats, including through regular oversight and mitigation of internal and external threats. As a U.S. defense subcontractor, we are additionally obligated to comply with Department of Defense regulations such as Defense Federal Acquisition Regulation Supplement.


text: The Company utilizes existing employees and contracts with third party firms to evaluate our information security program, for continuous system monitoring and threat detection, to gather insights for identifying and assessing material cybersecurity threats, and for potential mitigation assistance. We conduct cybersecurity assessments using third-party service providers, and we require them to promptly notify the Company of any cybersecurity risks, threats or incidents that might impact us.


text: The Company has an established cybersecurity and information security awareness training program that includes mandatory annual training and regular communications for our employees regarding cybersecurity threats and methods of mitigation.


text: There can be no guarantee that our policies and procedures will be effective. Although our risk factors include further detail about the material cybersecurity risks we face, we believe that risks from cybersecurity threats have not materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations or financial condition. For more information about the cybersecurity risks we face, see the risk factor entitled "Cyber security attacks, internal system or service failures, and misappropriation of data or other breaches of information security may adversely impact our business and operations" in Item 1A. Risk Factors.


text: Management is responsible for the day-to-day assessment and management of cybersecurity risks. Cybersecurity measures that pertain specifically to Company's Boot Hill subsidiary have been delegated to Boot Hill's Board of Managers, a committee comprised of directors and officers of the Company and officers of Boot Hill. This committee is responsible for ensuring compliance with Kansas Racing and Gaming Commission regulations.


text: The Board of Directors has oversight responsibility for the Company's strategic and operational risks. The Board has delegated oversight responsibility for certain risks to its committees, including delegation to the Board's Nominating and Governance Committee oversight of the Company's major non-financial reporting enterprise risk assessment and management processes not retained by the Board. However, given the broad and important role of cybersecurity oversight, the Board has determined that oversight for cybersecurity should remain with the full Board. The Board routinely receives reports from the Company's Chief Executive Officer, with the assistance of the Company's IT department, concerning the Company's cybersecurity risk management and strategies and related processes, technologies and controls.


text: We believe we maintain an information technology and security program appropriate for a company of our size, taking into account our operations and risks. We recognize the critical importance of maintaining the trust and confidence of our investors, employees, customers and vendors. We have implemented cybersecurity processes designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein. These processes include mechanisms, controls, and certain technologies designed to prevent or mitigate system intrusion or data loss, theft, misuse, or other security incidents or vulnerabilities and maintain a stable and secure information technology environment. For example, we conduct ongoing monitoring of critical systems for any compromised or potentially compromised accounts. We conduct regular trainings on cyber and information security, along with phishing simulations, among other topics. In addition, we consult with an outside information technology consultant on a regular basis to assist with assessing, identifying, and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on the Company's risk environment.

companyName: CHAMPIONS ONCOLOGY, INC.

ticker: CSBR


text: Our Board of Directors oversees our risk management process. The Audit Committee, by way of Board delegation, retains oversight of the Company's cybersecurity risks. The senior leadership team, including our Chief Financial Officer and Chief Executive Officer, provides periodic reports to our Board, as applicable. Our Vice President of Technology and/or Manager of Information Technology are responsible for leading the assessment and management of cybersecurity threats and periodically updating the Audit Committee as needed.


text: To date, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition.


text: Our information security program is designed to meet the needs of our clients who entrust us with their sensitive information. We maintain International Organization for Standardization 27001 certification for our enterprise-wide information security management system and program. Where applicable, we align to other industry standards or frameworks, including the Cloud Security Alliance's Cloud Controls Matrix, the Payment Card Industry Data Security Standard, the Health Insurance Portability and Accountability Act, and the CSF HiTRUST Common Security Framework.

companyName: BROADRIDGE FINANCIAL SOLUTIONS, INC.

ticker: BR


text: We recognize the importance of identifying, assessing, and managing material risks associated with cybersecurity threats. Our cybersecurity risk management program is integrated into our overall enterprise risk management ("ERM") process which provides an ongoing procedure, effected at all levels of the Company and across business units and corporate functions, to identify and assess risk, monitor risk, and take appropriate mitigating action. Central to our risk management process is the Risk Committee, a management committee that oversees the identification and assessment of the key risks affecting our operations and reviews the controls established with respect to these risks. The Risk Committee is comprised of key members of management, including the President, Chief Financial Officer, Chief Legal Officer, Chief Information Security Officer, Chief Technology Officer, Chief Compliance Officer, and other senior executives of the Company. Our Risk Committee collaborates with subject matter experts, as needed, to gather insights for identifying and assessing material cybersecurity risks, their severity, and potential mitigations.


text: We take the following actions, among others, to demonstrate our commitment to maintaining the highest levels of information security, provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and to identify, protect against, detect, respond to, and recover from cybersecurity incidents: • leverage encryption, data masking technology, data loss prevention technology, authentication technology, entitlement management, access control, network and application segmentation, anti-malware software, and transmission of data over private networks, among other systems and procedures, designed to protect against unauthorized access to information; • conduct annual reviews with many of our clients on our cybersecurity and data security policies, practices and controls, and engage with regulators across the world, to remain apprised of cybersecurity and data security standards and best practices; • utilize the National Institute of Standards and Technology Framework for Improving Critical Infrastructure Cybersecurity (the "NIST Framework") issued by the U.S. government as a guideline to manage our cybersecurity-related risk. The NIST Framework outlines security controls and outcomes over five functions: identify, protect, detect, respond, and recover; • conduct network and endpoint monitoring, vulnerability assessments, and network penetration testing; • conduct quarterly information security management and incident training, and regular phishing email simulations for all associates to enhance awareness and responsiveness to possible threats; • run tabletop exercises to simulate a response to a cybersecurity incident and use the findings to improve our policies and procedures; • conduct information security reviews and due diligence on key service providers to identify, assess, mitigate, and monitor risks associated with our use of third-party software and services; and • maintain global information security policies and procedures, including an incident response and crisis management plan that include processes to triage, assess, investigate, escalate, contain, and remediate cybersecurity incidents.


text: We further describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Security breaches or cybersecurity incidents could adversely affect our financial results and our ability to operate, could result in personal, confidential or proprietary information being misappropriated, and may cause us to be held liable or suffer harm to our reputation," included as part of our risk factor disclosures at Item 1A. of this Annual Report on Form 10-K, which disclosures are incorporated by reference herein.


text: Our information security program and team are currently managed by our Chief Information Security Officer ("CISO") who reports to our Chief Technology Officer. Our CISO has more than 25 years of experience in managing and leading cybersecurity functions including cybersecurity operations, strategy and governance, and information technology and security risk, compliance, and audit responsibilities across the U.S., Latin America, United Kingdom, Eastern Europe, Singapore, and China. Our CISO is responsible for developing, implementing, and overseeing our overall information security program, including cybersecurity risk management, governance and compliance, security policies and training, and the overall protection and defense of our networks, systems, and confidential data. With respect to risk management, our CISO works closely with our Managing Director, Risk Management, and other members of our Risk Committee, who are responsible for reviewing and challenging, as necessary, the activities of our information security team.


text: The responsibilities of the Company's Board include oversight of our risk management processes. The Board has two primary methods of oversight. The first method is the ERM process through which the Board receives regular reports from management regarding the most significant risks facing the Company. The second is through the functioning of the Board's committees. The Audit Committee assists the Board in its oversight of the Company's information security program, including cybersecurity and data privacy risks and controls. Our CISO provides reports on the Company's cybersec urity program to the Audit Committee, which includes all members of the Board, on a quarterly basis. In addition, our Internal Audit function regularly audits our technology and cybersecurity programs and reports to the Audit Committee on its findings.


text: The Company maintains a cybersecurity program that is designed to identify, detect, assess and manage cybersecurity risks. The Company's senior management and its Board are actively involved in the oversight of the Company's risk management program, of which cybersecurity is an important part. The Company's cybersecurity program, which aligns to the National Institute of Standards and Technology Cybersecurity Framework (the "NIST Framework") includes, among other things: • regular internal and external penetration testing of our technology environments at the application, infrastructure and network level, covering the systems, products and practices collecting or storing confidential business and personal information— including user data—in accordance with the Company's security policies. This testing is conducted multiple times a year by third-party firms; • third-party provider security assessments to evaluate associated risks and appropriate internal and third-party provider security controls; • processes to manage security risks and vulnerabilities; • mandatory company-wide cybersecurity compliance and information handling training; • a documented cybersecurity incident response plan that establishes procedures, roles, responsibilities and communication protocols for internal staff and external resources in the event of a cybersecurity incident; • cybersecurity tools that assist with the automation and orchestration of security alert response based on the relative risk; and • threat intelligence sharing relationships with industry partners, peers, and government agencies, as needed and appropriate.

companyName: Fox Corp

ticker: FOXA


text: FOX's cybersecurity program is based on recognized best practices and standards applicable to our industry. The Company engages a third-party firm to assess the overall maturity of its program against the NIST Framework on a bi-annual basis. This evaluation includes an assessment of how the program evaluates and mitigates risk, as well as how it compares against industry benchmarks. The results of this evaluation are provided to the Audit Committee of the Board.


text: The Company's Chief Information Security Officer ("CISO") leads the Company's dedicated information security department, which monitors FOX's prevention, detection, mitigation and remediation efforts related to cyber threats. The CISO regularly consults with the Company's Co-Chief Privacy Officers, and the Company's Chief Technology Officer ("CTO") provides additional oversight of the cybersecurity program, and previously served as the Company's CISO. The CISO has over 15 years of experience in cybersecurity, information security and technology, including a background in broadcast media and networking and systems engineering, and has held numerous industry certifications.


text: The CISO is in regular communication with senior management regarding cybersecurity matters and provides frequent routine (generally weekly) updates to the Company's Executive Chair and Chief Executive Officer, Chief Operating Officer ("COO"), Chief Financial Officer ("CFO"), CTO and Chief Legal and Policy Officer. As part of the Company's incident response plan process, cybersecurity risk events of a certain criteria are communicated in a timely manner to the Company's incident response governing body, which is comprised of members of senior management, including the COO, CTO, and CFO. The Company tests the effectiveness of the incidence response plan and assesses its response capabilities by conducting executive tabletop exercises involving detailed topical cybersecurity scenarios with these executives, as well as technical tabletop exercises including technical and operational personnel. The Company also has processes in place that are designed to ensure that decisions regarding public disclosure and reporting of cybersecurity incidents can be made in a timely manner.


text: The Company's Board has an active role, as a whole and at the committee level, in overseeing the management of the Company's risks. The Audit Committee of the Board is responsible for (i) overseeing the Company's policies and practices with respect to risk assessment and risk management, including with respect to cybersecurity and the use of AI, (ii) overseeing the Company's financial and other major risk exposures and the steps taken to monitor and control them, and (iii) providing guidance to the Board on such matters.


text: The Audit Committee regularly reviews and discusses FOX's cybersecurity risks and receives updates from the CISO on how the Company identifies, assesses and mitigates these risks. The CISO provides the Audit Committee with quarterly reports regarding cybersecurity issues and risks, including information regarding progress on efforts to strengthen and enhance the Company's cybersecurity program. The Audit Committee also periodically devotes additional meeting time, as needed, to in-depth discussions on a particularly relevant cybersecurity topic, including industry trends and relative risks. In addition to the quarterly reports, cybersecurity incidents meeting certain criteria are reported to the Audit Committee outside of regularly scheduled quarterly updates as necessary.


text: From time to time, the Company experiences cybersecurity threats and attacks. Although no cybersecurity incident has materially affected the Company's businesses to date, FOX expects to continue to be subject to cybersecurity threats and attacks and there can be no assurance that the Company will not experience a material incident. For more information, see Item 1A., "Risk Factors—Risks Relating to Cybersecurity, Piracy, Privacy and Data Protection."


text: Risk Management and Strategy CACI is committed to maintaining a robust cybersecurity management and oversight program to mitigate cybersecurity risks to our systems and to protect both our and our customers' confidential and sensitive information. We employ technologies and have implemented programs and processes to continually assess, identify, and manage cybersecurity risks as we aim to incorporate industry best practices throughout our cybersecurity program.

companyName: CACI INTERNATIONAL INC /DE/

ticker: CACI


text: CACI's cybersecurity program is integrated into our overall risk management program and is primarily managed by our Chief Information Security Officer (CISO) who is responsible for coordinating cross-functional internal and external resources to establish processes and procedures to monitor potential cybersecurity risks, identify cybersecurity incidents, implement appropriate mitigation measures, report cybersecurity breaches, and maintain our cybersecurity program. Our CISO has extensive experience assessing and managing cybersecurity programs and cybersecurity risk and monitors prevention, detection, mitigation, and remediation efforts through regular communication and reporting from experienced cybersecurity professionals in the information security team, supplemented by technological tools and software. We continuously monitor cybersecurity threats and assess the robustness of our mitigation and prevention measures through routine internal and independent audits, threat simulations, vulnerability and penetration testing, and employee cybersecurity training. Our cybersecurity program is designed to be aligned with applicable industry standards, and we continue to invest in capabilities to protect all information assets in our possession.


text: As a government contractor, we have designed our cybersecurity risk management program to align with the National Institute of Standards and Technology (NIST) standards and comply with extensive regulations, including but not limited to U.S. government cybersecurity regulations. Additionally, our cybersecurity program is routinely assessed by the government, and our network is penetration tested biannually by a third-party independent assessor. We work closely with our subcontractors and suppliers to identify and manage cybersecurity risks. We require them to comply with applicable laws and regulations, including implementing certain security controls and complying with certain reporting obligations. Although we perform due diligence on all service providers to identify potential cybersecurity risks and establish controls through onboarding procedures and contractual requirements, our ability to monitor the cybersecurity practices of our service providers and ensure that we can prevent or mitigate the risk of any compromise or failure in the information system, software, networks, and other assets owned or controlled by our vendors is limited.


text: In the event of a cybersecurity incident, the Company has established an incident response plan to address the matter promptly and effectively. Our CISO leads our Cybersecurity Incident Response Team (CIRT) that is responsible for leading and coordinating CACI's response to cybersecurity incidents in accordance with CACI's established cybersecurity incident response plan and response processes. In accordance with these policies, cybersecurity events and data incidents are evaluated, ranked by severity, and prioritized for escalation to CACI's Executive Incident Assessment Committee. The plan includes procedures for investigating and containing incidents, notifying affected parties, and implementing corrective actions to prevent future occurrences.


text: The Audit and Risk Committee ( Audit Committee) has oversight responsibility for risks and incidents relating to cybersecurity, including compliance with regulatory requirements, cooperation with law enforcement, and related effects on financial and other risks. The Audit Committee receives regular briefings on our cybersecurity posture, cybersecurity trends, and cybersecurity risks from management and, if they occur, is briefed regarding any material cybersecurity incidents. The Audit Committee reports any findings or recommendations to the Board of Directors, as appropriate.


text: To date, we have not identified any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business operations or financial condition. While the Company has taken significant steps to manage cybersecurity risks, there can be no assurance that these measures will prevent all potential incidents. For more information on our cybersecurity related risks, see Item 1A, Risk Factors of this Annual Report on Form 10-K.


text: Material Effects of Cybersecurity Incidents Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations, or financial condition. Further information regarding cybersecurity risks can be found in Item 1A. Risk Factors, of this Annual Report on Form 10-K.

companyName: AMERICAS CARMART INC

ticker: CRMT


text: We consider the protection of our customers' and corporate data to be a priority within our business. We continually monitor and assess the cybersecurity landscape and invest in enhancing our cybersecurity capabilities and strengthening our partnerships with appropriate business partners, service partners, and government and law enforcement agencies to understand the range of cybersecurity risks in the operating environment, enhance defenses, and improve resiliency against cybersecurity threats. Through these partnerships, we incorporate threat intelligence, security operations, continuous training, and penetration testing. We strive to reduce the threat landscape for both the Company and our customers, through vigilantly monitoring systems and general technology controls.


text: Our efforts focus on protecting and enhancing the security of our information systems, software, networks, and other assets, whether commercial products or custom solutions. Our cybersecurity program focuses on protecting and enhancing the security of our information systems, software, networks, and other assets, whether commercial products or custom solutions. These efforts are under continuous review for improvement within the changing threat landscape and are designed to protect against, and mitigate the effects of, cybersecurity incidents that could result in unauthorized access to confidential, sensitive, or personal information of associates or customers or proprietary company information and potentially disrupt or impede our operations or otherwise cause harm to the Company, our customers, suppliers, dealers, or other key stakeholders.


text: Our cybersecurity program leverages both internal and external techniques and expertise across the cybersecurity spectrum. We maintain and utilize industry best practice capabilities, processes, and other security-related measures, based upon National Institute of Standards and Technology (NIST) and Control Objectives for Information Technologies (CoBIT) frameworks. Our capabilities, processes, and other security measures include, among others: • Threat detection through the use of security information and event management software; • Incident management processes for any security-related activity, requiring senior management signoff; • Corporate endpoint detection and response software, which monitors for malicious activities on external-facing endpoints; • Cloud monitoring tools, running on primary public and private cloud environments; • Data encryption at rest and during transit and immutable data backups; and • Business continuity, disaster recovery and incident response plans.


text: We also expect our suppliers and third party service providers to follow the same industry-standard security practices that we follow. Despite having thorough due diligence, onboarding, and cybersecurity assessment processes in place for our suppliers, the responsibility ultimately rests with our suppliers to establish and uphold their respective cybersecurity programs. The ability and availability of information to monitor the cybersecurity practices and controls of our suppliers and third party service providers is limited, and there can be no assurance that we can prevent or mitigate the risk of any compromise or failure in information systems, software, networks, and other assets owned or controlled by our suppliers and third party service providers. Although the Company attempts to manage its exposure to such events through the purchase of cyber liability insurance, such events are inherently unpredictable, and insurance may not be sufficient to protect the Company against all losses. There is no assurance that the Company's security systems or processes will prevent or mitigate future break-ins, tampering, security breaches or other cyber-related attacks.


text: Our Board of Directors oversees the management of risks inherent in the operation of our business, with a focus on the most significant risks that we face, including those related to cybersecurity. Our Board of Directors has delegated oversight of cybersecurity, including privacy and information security, as well as enterprise risk management to the Audit and Compliance Committee (the "Audit Committee"). In connection with that oversight responsibility, our Chief Technology Officer and Chief Legal Officer meet with the Audit Committee on a quarterly basis to provide information and updates on a range of cybersecurity topics which may include our cybersecurity program and governance processes; cyber risk monitoring and management; the status of projects to strengthen our cybersecurity and privacy capabilities; recent significant incidents or threats impacting our operations, industry, or third-party suppliers; and the emerging threat landscape.


text: Our information security team works closely with key stakeholders, including regulators, government agencies, peer institutions, industry groups, and develops and invests in talent and innovative technology to manage cybersecurity risk.


text: In the event that a cybersecurity threat or incident is identified, the Chief Technology Officer and the security team would work closely with cross functional committees, leveraging subject matter expertise across the organization, as part of our incident response plans and promptly provide information to senior management, with the goal of timely assessing such incidents, determining applicable disclosure requirements and communicating with the Chair of the Audit Committee regarding any significant cybersecurity incidents, including those experienced by third party service providers, which may pose significant risk to our business, customers, clients, associates and stakeholders, and continues to provide regular reports until such incidents are concluded. The above framework is designed to track and allow team members to monitor each incident throughout its lifecycle to ensure the Company is informed about and following cybersecurity incidents as they are mitigated and remediated. Post-incident reviews would also be performed to determine if there are any additional controls that may feasibly be implemented to prevent recurrence.


text: We have policies, procedures, and processes for assessing, identifying, and managing cybersecurity risks, which are defined and managed by Cimpress' central security and privacy team and are designed to help protect our information assets and operations from internal and external cyber threats and secure our networks and systems. Our cybersecurity processes include procedural and technical safeguards, response plans, regular vulnerability and penetration tests on our systems, incident simulations, and routine reviews of our policies and procedures to identify risks and improve our practices. Our cybersecurity incident response plan is designed to help coordinate our response to, and recovery from, cybersecurity incidents, and includes processes to assess the severity of, escalate, contain, investigate, and remediate incidents as well as to comply with applicable legal obligations. We have security policies that apply to all employees worldwide, and we conduct annual employee trainings on data protection, cybersecurity, and incident prevention, which covers timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, asset use, and mobile security. In addition to our internal penetration testing and vulnerability management program, we engage an external party to simulate attacks on our systems to test our defenses and response. We also use a third-party vendor risk assessment platform to score vendors' cybersecurity vulnerabilities and provide suggested mitigations.

companyName: CIMPRESS plc

ticker: CMPR


text: The Audit Committee of our Board of Directors oversees cybersecurity risk and receives regular updates from our Vice President and Chief Security and Privacy Officer on these risks, risk management activities, incident response plans, best practices, the effectiveness of our security measures, and other related matters. Our Vice President and Chief Security and Privacy Officer, who reports to our Chief Technology Officer, leads our central security and privacy team, which works in partnership with each of our businesses and the corporate center to measure security maturity and risk and provides managed security services in a way that allows each business to address their unique challenges and become more efficient in using their resources. We have processes and policies for the escalation of cybersecurity incidents to the central security team, evaluation of the materiality of the incidents, and coordination of our response as needed across businesses and operations. Our Chief Security and Privacy Officer has more than 20 years of privacy and data security experience, including a series of roles in Cimpress over the last 15 years, the last three and a half years of which have been spent leading the central security and privacy team.


text: Although risks from cybersecurity threats have to date not materially affected us, our business strategy, results of operations or financial condition, we have, from time to time, experienced threats to and breaches of our and our third-party vendors' data and systems. See Part I, Item 1A, Risk Factors, in this Annual Report for a discussion of cybersecurity risks.


text: Cybersecurity risk management is an important part of and is integrated into our overall enterprise risk management framework, with cybersecurity risks being among the core enterprise risks identified for oversight by our Board of Directors (the "Board") through our annual enterprise risk assessment. We maintain an enterprise-wide cybersecurity risk assessment program and framework that is designed to identify, assess, and manage cybersecurity risk, vulnerabilities, and threats. The foundation of our cybersecurity program is based on the International Organization for Standardization ("ISO") and the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. In alignment with the concepts and principles articulated in these standards, we have implemented controls related to cybersecurity threats and incidents including monitoring, log collection and analysis, threat hunting and intelligence surveillance, and regular vulnerability scans/penetration tests. Additionally, in furtherance of assessing, identifying, and managing material cybersecurity risks, we: • Leverage technology solutions designed to provide protection for our assets and detect threats in our environment; • Regular vulnerability assessments and penetration testing in efforts to identify, assess, and remediate weaknesses; • Maintain an enterprise-wide disaster recovery governance program, which includes cybersecurity-related disaster recovery policies and procedures related thereto; • Regularly perform cybersecurity-related disaster recovery testing designed to ensure that the Company's mission-critical systems are recoverable, in support of our business continuity needs; and • Work with each of our business and corporate groups with our internal cybersecurity program to integrate cybersecurity requirements into operating environments as appropriate, which drives business strategies, budgeting, and similar processes. In addition, executive management, as well as our Board, regularly review our financial planning processes for these areas, inclusive of our cybersecurity programs.

companyName: Lumentum Holdings Inc.

ticker: LITE


text: Changes or additions to our cybersecurity risk assessment program and related practices and procedures described above in response to cybersecurity needs are reviewed by our Cybersecurity Steering Committee ("CSC"), an executive management-level cross-functional group.


text: We regularly engage independent third parties to assess our cybersecurity program and practices and to assist with risk mitigation. The effectiveness of our cybersecurity environment is regularly tested by internal personnel and these third parties. These assessments are performed in conformance with ISO standards and requirements. Enhancements to our cybersecurity program and practices are identified from assessment findings, and if deemed appropriate, implemented.


text: In addition, we evaluate critical systems and applications hosted by third parties for cybersecurity risks and we also assess the security posture and features of those services. This includes review and monitoring of the third party, and inclusion of cybersecurity requirements in contractual agreements to help ensure third party services meet our standards for such providers and that the cybersecurity risks associated with the use of these services are appropriate.


text: For additional information regarding whether any risks from cybersecurity threats are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors - Any failure, disruption or security breach or incident of or impacting our information technology infrastructure or information management systems could have an adverse impact on our business and operations." We believe that risks from prior cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected our business to date. However, we can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations, or financial condition.


text: Our Board oversees our enterprise risk management program and practices, and the Audit Committee assists the Board in its oversight of cybersecurity matters. Quarterly updates are presented to our Audit Committee by our Chief Information Security Officer ("CISO") on cybersecurity risks and threats. In addition, our Audit Committee provides Board-level oversight for management's actions with respect to practices, procedures and controls used to identify, assess, and manage our key cybersecurity programs and risks, and, as necessary, responses to any significant cybersecurity incidents.


text: Our cybersecurity program is led by our CISO, who manages a team of cybersecurity professionals. Our CISO has over 20 years of experience in cybersecurity and technology, including as a CISO at another public company. Members of our cybersecurity team, combined, have over 80 years of cybersecurity experience and members of the team hold various professional certifications, including Certified Information Systems Security Professional ("CISSP").


text: As noted above, we also maintain a CSC, which consists of our Group Vice President, IT and CISO, Executive Vice President, Chief Financial Officer, Senior Vice President, Chief Human Resources Officer, Senior Vice President, General Counsel, Executive Vice President, Global Operations, Senior Vice President, Chief Accounting Officer, and Vice President, Internal Audit. The CSC has the primary day to day responsibility to monitor and manage cybersecurity risks. The CSC provides oversight of cybersecurity initiatives within Lumentum and is responsible for integrating cybersecurity risk management practices with critical business processes to help ensure that cybersecurity is appropriately addressed throughout Lumentum.


text: We recognize the importance of managing cybersecurity threats and risks related to our business, and we have adopted a multi-faceted and proactive strategy to identify, evaluate, address, respond and neutralize cybersecurity threats and attacks. We employ a combination of technical solutions, security policies and procedures, employee training programs, and regular security audits to enhance and fortify our defenses. We utilize advanced monitoring tools and anomaly detection systems to swiftly identify any suspicious activities or deviations from normal operation. Our security infrastructure includes firewalls, intrusion detection systems, encryption protocols, and access controls to protect our systems and data from unauthorized access or malicious attacks. In the event a cybersecurity incident is detected, we have established incident response procedures to contain the threat, minimize the impact, and restore normal operations as quickly as possible. We also conduct periodic risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect our information systems that are vulnerable to such cybersecurity threats. We believe that our cybersecurity risk management process has been and continues to be an integral part of our overall risk management process of the Company as our cybersecurity team collaborates closely with our information technology team, senior management, Audit Committee and Cybersecurity Subcommittee, and internal audit team to address any such threats and incidents.

companyName: ALPHA & OMEGA SEMICONDUCTOR Ltd

ticker: AOSL


text: Our cybersecurity team plays a critical role in managing our cybersecurity risk. They oversee security controls and orchestrate our response to incidents on a day-to-day basis, including threats arising internally or from our vendors, suppliers or other third parties that we conduct business with. In addition, we have developed and implemented information security policies, standards, procedures and security guidelines that are based on industry standards, particularly the National Institute of Standards and Technology (NIST) Cybersecurity Framework. Furthermore, we have implemented and maintained employee policies design to reduce risk of cyber-attacks and educate employees on protocol in the event of a potential cybersecurity incident.


text: We use third-party service providers in various functions throughout our business. We have implemented stringent processes to oversee and manage cybersecurity risk with these third parties, which includes risk assessment activities, enforcement of policies to ensure compliance with current cybersecurity standards and monitoring activities, and periodic review of potential cyber breaches announcements made by the third-party service providers.


text: We are not aware of any risks from cybersecurity threats that have materially affected our business strategy, results of operations or financial condition or are reasonably likely to have a material effect. However, cyber-attacks are increasing in frequency, sophistication and intensity, and despite our ongoing efforts we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents. Please refer to "Risk Factors" in Part I, Item 1A of this Form 10-K for more information on the risks posed to us by cybersecurity threats.


text: Our senior management team, including our cybersecurity team, are responsible for day-to-day implementation, assessment, and management of our cybersecurity risk management processes. Our cybersecurity team includes Vice President of Information Technology and Information Security Officer with a team of eight full-time information technology professionals and several outside security vendors to manage our information security program. When a cybersecurity incident is identified, our computer incident response team will notify the Information Security Officer immediately, and upon assessment of the nature and severity of the incident, internal and external parties may be further notified to determine the appropriate response strategy, and written preliminary and final reports will be submitted to management. Our Vice President of Information Technology and Information Security Officer have served in various roles in information technology and information security, and together they have over 55 years of experience in this field. Our Information Security Officer is a certified information systems security professional (CISSP). The cybersecurity team has primary responsibility for our overall cybersecurity risk management program, including monitoring the prevention, detection, mitigation, and remediation of cybersecurity incidents, and works in partnership with senior management team, including our Chief Executive Officer and Chief Financial Officer, as well as our Board of Directors.


text: Our Board of Directors (the "Board") plays an active role in overseeing and managing the Company's cybersecurity risks. The Audit Committee of the Board has established a Cybersecurity Subcommittee for the purpose of assessing, analyzing and managing the Company's key cybersecurity and information technology risks, and to ensure that our systems are adequate to protect against security breach and effectively safeguard the Company's IT infrastructure, assets, intellectual property, and data. The roles and responsibilities of the Cybersecurity Subcommittee are determined, from time to time, by the Audit Committee. The Cybersecurity Subcommittee meets quarterly with our management team to discuss various matters relating to IT and cybersecurity risks, and our senior management team communicates and coordinates directly with the Cybersecurity Subcommittee in the event of any cybersecurity incident. The Cybersecurity Subcommittee is given the following responsibilities: • Oversight of policies, procedures, plans, and execution intended to provide security, confidentiality, availability, and integrity of the information. • Oversight of the quality and effectiveness of the Company's policies and procedures with respect to its IT systems; • Review and oversight on policies and procedures of the Company in preparation for responding to cybersecurity incidents. • Oversight of risks related to IT systems and processes, including privacy, network security and data security, and any internal audits of such systems and processes. • Review and oversight of preparation of the Company's public disclosures, including SEC filings, relating to the Company's IT systems, including privacy, network security, and data security, and • Report to the Audit Committee and the Board of significant and material cybersecurity incidents.


text: Our cybersecurity program is designed to safeguard the confidentiality, integrity and availability of information assets by monitoring the cyber threat landscape, internal threats and technological changes and through the development of controls to mitigate risk to the organization and our customers. While cybersecurity is a dynamic and constantly evolving field, we strive to minimize the occurrence and impact of unauthorized access, disruption to our information systems and are committed to staying informed about emerging threats, adopting industry best practices, and integrating feedback from our assessment and incidents. We deploy and manage both preventive and detective controls and processes to mitigate cybersecurity threats, including monitoring our network for known vulnerabilities and signs of unauthorized attempts to access our data and systems. We also deploy and manage preventive and detective controls and processes related to the mitigation of risks from our use of third-party service providers.

companyName: CANTALOUPE, INC.

ticker: CTLP


text: Our organization undergoes annual reviews by third-party consultants to help assess the implementation and operational effectiveness of the security controls implemented in our service environment which is in scope for Payment Card Industry Data Security Standard ("PCI DSS") and American Institute of Certified Public Accountants ("AICPA") System and Organization Controls ("SOC").


text: Our program is designed to guide our practices which are based on relevant industry frameworks and laws. This program consists of policies and procedures designed to manage material risks from cybersecurity threats, including training requirements, threat monitoring and detection and threat containment and risk assessments. Additionally, we leverage third-party firms to conduct routine external and internal penetration testing to emulate the common tactics and techniques of cyber threat actors and have processes to address identified vulnerabilities, although it may take time to mitigate or manage such vulnerabilities. The results of this testing are included in the Company's SOC report. Further, we also carry cyber security insurance, which is renewed annually and covers cyber events and business interruption. We closely monitor costs of breaches within the industry in an effort to ensure that our coverage is sufficient to address all reasonably foreseeable threats and levels of risk.


text: We have an Incident Management Policy ("IMP") and Incident Response Plan ("IRP") which helps enable us to quickly detect, respond to, and recover from third-party malicious attacks and potential security incidents. This plan includes formal steps to review incidents and implement improvements, including steps to involve the CISO and CTO as appropriate.


text: Our Information Security Program is overseen by our Chief Information Security Officer ("CISO"), who reports to our Chief Technology Officer ("CTO"). Our CISO oversees the third-party consultants who help assess our security controls and penetration testing previously described. The CTO provides oversight, leadership and direction for data risks, technology risks and information security risks. Our CISO leads the Cybersecurity organization and has the overall responsibility of implementing its strategy and objectives to build a strong cyber engineering function.


text: Our CISO has over 20 years of information technology experience with specialization in information security and risk management. Our CISO has industry recognized certifications including Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), Payment Card Industry Professional (PCI ISA & PCIP). Our CISO has worked in various information security roles at other large publicly traded companies.


text: The CISO and CTO report to the Board of Directors who have ultimate responsibility in overseeing enterprise risks, including cybersecurity threats.


text: With the guidance of the Audit & Risk Management Committee (the "Committee"), our board of directors is responsible for our risk management framework, including our strategy, policies, procedures and systems with respect to cybersecurity and information technology risks associated with us and our supply chain, suppliers and service providers. Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Committee oversight of cybersecurity risks, including oversight of management's implementation of our cybersecurity risk management program.

companyName: Tamboran Resources Corp

ticker: TBN


text: Our management team, including our Vice President of Information Technology, is responsible for assessing and managing our material risks from cybersecurity threats, and takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in our IT environment. Our management team has developed and implemented a risk management program that includes cybersecurity risks as a risk category and is intended to protect the confidentiality, integrity, and availability of our critical systems and information. Management has primary responsibility for our overall cybersecurity risk management program and supervising internal staff and external consultants assisting with cybersecurity matters, including those that assist management in staying informed about cybersecurity risks and incidents. Management updates the Committee periodically on our cyber risk management program, and the Committee reports to the full board of directors regarding its activities, including those related to cybersecurity.


text: Our cybersecurity risk management program is integrated into our overall risk management program, and shares common methodologies, reporting channels and governance processes that apply across the risk management program to other legal, compliance, strategic, operational, and financial risk areas. Key elements of our risk management program relating to cybersecurity include: implementing risk assessments designed to help identify material risks, including risks arising from cybersecurity threats to our critical systems and information; engaging external cybersecurity consultants to assess and assist with aspects of our security processes; maintaining insurance coverage related to cybersecurity matters; and review of risks related to any new third-party IT providers based on our assessment of their criticality to our operations and respective risk profile.


text: Our Vice President of Information Technology has over 20 years of experience at public companies, including within the energy sector, enterprise technology vendors, and consulting firms. His expertise includes enterprise technology strategy, transformation, governance, vendor management, and operations and initiatives to strengthen cybersecurity, enhance information security posture, and mitigate technology risk. We continue to focus on cybersecurity measures as the company grows.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, which have materially affected us, including our operations, business strategy, results of operations, or financial condition. However, there can be no assurance that our cybersecurity risk management program and processes, including controls, systems and processes that we have or will in the future implement, will be fully implemented, complied with or effective in protecting our systems and information. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See our risk factor titled "Our business could be negatively affected by security threats and disruptions, including electronic, cybersecurity or physical security threats, incidents and other disruptions."


text: At Stitch Fix, we recognize the importance of robust cybersecurity measures to protect our systems, data, and the interests of our stakeholders. We have implemented a comprehensive cybersecurity risk management strategy and governance framework to identify, assess, manage, mitigate, and respond to cybersecurity risks and threats. Our risk management strategy and governance framework is designed to identify, assess and manage material risks from cybersecurity threats to our systems, networks, and data infrastructure, including intellectual property, customer data, and data that is proprietary, strategic or competitive in nature ("Information Systems and Data").

companyName: Stitch Fix, Inc.

ticker: SFIX


text: We use third-party service providers to assist us from time to time to identify, assess, and manage risks from cybersecurity threats, which may include professional services firms (such as legal counsel), threat intelligence service providers, cybersecurity consultants, cybersecurity software providers, penetration testing firms, dark web monitoring services, and forensic investigators.


text: Stitch Fix views its cybersecurity strategy through a multi-pronged lens encompassing prevention, detection, and response to ensure holistic coverage of our Information Systems and Data, along with the environments in which they operate.


text: Our cybersecurity program starts with prevention, which includes risk assessment and identification. We utilize that information to design a layer of controls as a baseline. We conduct assessments to identify and evaluate potential cybersecurity risks. This process involves analyzing our Information Systems and Data to identify vulnerabilities and potential threats. Our cybersecurity program also includes third-party risk management, in which we oversee the identification and mitigation of risk associated with outsourcing to third-party vendors and service providers, particularly focused on vendors who process sensitive information. In addition to our risk assessment processes, we prioritize cybersecurity awareness and training programs for our employees. These initiatives are designed to educate our workforce about potential threats, best practices for data protection, and the importance of maintaining security measures. We train our employees through annual security training, phishing simulations, and communications about cybersecurity topics and threats.


text: Our cybersecurity program includes tools and processes designed to detect unusual network activity, anomalous cybersecurity events, and breaches. We utilize a variety of preventative measures and detective tools.


text: We have developed an incident response plan to ensure a swift and effective response in the event of a cybersecurity incident. This plan includes predefined roles and responsibilities, communication protocols, and steps to contain and remediate any vulnerabilities that may lead to a breach.


text: Our Chief Information Security Officer ("CISO") oversees the Company's cybersecurity program. Our CISO, who reports to our Chief Product and Technology Officer ("CPTO"), has over 20 years of experience in information technology, risk, and cybersecurity leadership, and has previously held both CISO and Chief Technology Officer roles. Our CISO chairs the Company's Cybersecurity Governance Committee, comprised of executive leaders across Legal, Finance, and Corporate Communications, that has oversight responsibilities regarding the Company's information security functions, including infrastructure, governance, privacy, and compliance.


text: Our CISO is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. The Information Security Team conducts exercises to prepare for cybersecurity incidents, approves cybersecurity processes, and reviews security assessments and other security-related reports.


text: Our cybersecurity incident response processes include the escalation of information about certain cybersecurity incidents, depending on the circumstances, to our CISO, members of management, and the Audit Committee of the Board of Directors.


text: The Audit Committee provides oversight for our cybersecurity program and our enterprise risk management process. The Audit Committee also evaluates enterprise level risks and strategies, including our cybersecurity risk. The Audit Committee receives updates from management on the effectiveness of our cybersecurity program. The Audit Committee also reviews plans on how management will enhance the program, receives updates on special topics that help the Committee provide effective oversight of the program, and is notified in the event of certain cybersecurity incidents.


text: Although we have not experienced a material cybersecurity breach, we cannot guarantee that we will not experience a material cyber threat or incident in the future. For more information regarding the cybersecurity risks we face, see Item 1A. Risk Factors in this Annual Report.


text: We work proactively to identify, evaluate, and manage cybersecurity threats to our business. These threats include disruption and denial of critical systems and infrastructure, intellectual property theft, fraud, extortion, harm to customers and employees, legal and litigation risks, reputational risks, and the breach of confidential business data, which could include personally identifiable information. We employ both holistic and focused processes for identifying, assessing, managing, and disclosing material cybersecurity risks to our business. Our holistic review is part of our general risk management process, and involves our executive leadership team, team members from our finance, legal, tech, and operations teams, and external legal, financial, and risk advisors who are subject matter experts in identifying, assessing, mitigating and reporting material risks. Our focused review involves internal assessment by our cybersecurity team, as well as external review by a cybersecurity consulting services firm, to evaluate our cybersecurity program and our capacity to defend against and respond to potential cybersecurity threats.

companyName: COPART INC

ticker: CPRT


text: Through strategic investments over several years, we have established and enhanced a comprehensive cybersecurity program consisting of security toolsets, people, policies, and contracted third-party service providers that provide technical, organizational, and administrative safeguards to protect against and timely respond to cybersecurity threats and incidents. Our cybersecurity strategy is based foremost on defense in depth, and secondarily on resilience. Defense in depth is a strategy of layered security, in which we employ a variety of overlapping controls, tools, and processes to defend against threat actors. Resilience is a strategy focused on business continuity and disaster recovery, with the goal of rapidly restoring, rebuilding, and recovering from any adverse cyber impacts to our business. These controls, tools and processes include technologies designed to detect and defend against unauthorized access to our systems and infrastructure, relevant corporate policies, periodic cybersecurity and privacy training programs, and incident response protocols for preventing, detecting, responding to and recovering from cybersecurity incidents. We use the National Institute for Standards in Technology security framework to evaluate our cybersecurity controls, which we work to continuously enhance.


text: We face a number of cybersecurity risks in connection with our business. Although such risks have not materially affected us, including our business strategy, results of operations or financial condition, we have experienced threats to our data and systems in the past, including malware and viruses. For a description of the risks we face from cybersecurity threats that may affect us and how, see our risk factors under Part 1. Item 1A in this Annual Report on Form 10-K, including under the heading "Disruptions to our information technology systems, including failure to prevent outages, maintain security, and prevent unauthorized access to our information technology systems and other confidential information, could disrupt our business and materially and adversely affect our reputation, consolidated results of operations, and financial condition."


text: Our Board of Directors has delegated oversight of our cybersecurity program to our Audit Committee, and this oversight responsibility is reflected in our Audit Committee charter. Our Audit Committee receives quarterly updates from our chief information security officer on the status of these programs. Our Audit Committee also receives a detailed presentation from our chief information security officer on our cybersecurity program annually, which includes the results of an external third-party assessment. Our Audit Committee is comprised solely of independent directors, with one member who is a subject matter expert in technology and cybersecurity.


text: Our management team is responsible for assessing and managing our material risks from cybersecurity threats, and has appointed a chief information security officer to lead our global cybersecurity organization for this purpose. Our executive management team and key members of our broader finance, legal, tech and operations organizations receive detailed monthly briefings from our chief information security officer on the status of our cybersecurity program and our readiness to prevent, detect, mitigate and recover from cybersecurity incidents.


text: Our chief information security officers leads our incident response team for addressing and recovering from identified cybersecurity incidents. Our incident response team includes key members of our tech, legal and executive management teams to manage our response efforts, which includes timely compliance with applicable contractual and regulatory notification obligations.


text: The Company recognizes the importance of cybersecurity and has implemented a comprehensive program to protect its information assets. Key components of our cybersecurity program include appointment of an Information Security Officer, who is also the Chief Operating officer with extensive knowledge of cybersecurity issues, information security policies and procedures, engagement of third-party security experts, regular penetration testing, managed backup and data protection, managed threat response, hardware and software protections, physical security measures, employee training, internal cybersecurity audits, and ongoing product cybersecurity assessments. The Company maintains cybersecurity insurance covering its internal operations and customer-facing products.

companyName: ESCALON MEDICAL CORP

ticker: ESMC


text: Despite these measures, the Company cannot guarantee that it will be immune from cybersecurity threats. A successful attack could result in unauthorized access to our systems, data breaches, disruptions to our operations, and financial losses. We are committed to continually evaluating and enhancing our cybersecurity program to mitigate these risks.


text: The Company's Board of Directors receives regular reports from the Information Security Officer regarding the Company's cybersecurity program. The Board ensures that the Company has the necessary resources and authority to implement and maintain a sufficient cybersecurity program. The Information Security Officer reports directly to the Chief Executive Officer and is responsible for working with internal and third-party resources to develop and implement the Company's cybersecurity strategy, manage cybersecurity risks, and oversee the Company's cybersecurity operations.


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws. We have implemented cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage such material risks.

companyName: Oil-Dri Corp of America

ticker: ODC


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other risk areas. We have also implemented a specific cybersecurity program which adopts a risk management approach to information security, requiring the identification, assessment, and appropriate mitigation of vulnerabilities and threats that can adversely impact our information assets. Our cybersecurity program is aligned with recognized industry standards and frameworks such as NIST SP 800-53, NIST SP 800-82, and the NIST Cybersecurity Framework 2.0. Our cybersecurity program includes: • An Information Security Charter and supporting policies outline governance, define responsibilities, and help enforce our cybersecurity program; • A risk assessment process designed to help identify material cybersecurity risks to our critical systems, information, services, and our broader enterprise IT environment; • An information security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • The use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • Cybersecurity awareness training of our employees, incident response personnel, and senior management; • A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • A third-party risk management process for customers, service providers, suppliers, and vendors.


text: In evaluating the risks identified as a part of the annual assessment process, the Company's information security team considers the likelihood and severity of the respective risk and the potential impact of the risk on the Company, its customers, and its employees. These risks are then prioritized and monitored by the information security team.


text: The Company conducts periodic testing of software, hardware, defensive capabilities, and other information security systems to assess its cybersecurity readiness and maturity of the cybersecurity program. Tests are conducted by the information security team and reputable third-party consultants and auditors. In developing and evaluating the testing procedures, the Company considers both its individual risks and industry standards.


text: The cybersecurity program includes an incident response plan with a cross-functional team comprised of designated members of the information technology department, senior management, and other appropriate individuals. The team is responsible for assessing and managing the cybersecurity incident response process, as outlined within the incident response plan, and taking necessary corrective actions to mitigate and eliminate the issue.


text: As of the date of this report, the Company is not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition that are required to be reported in this Form 10-K. For further discussion of the risks associated with cybersecurity incidents and potential impact to the Company, see the cybersecurity risk factors within "Item 1A. Risk Factors" in this Form 10-K.


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management. Our Audit Committee is responsible for the oversight of risks from cybersecurity threats. Members of the Audit Committee receive updates on a quarterly basis from management, including leaders from our information security and legal teams regarding matters of cybersecurity. This includes existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any) and status on key information security initiatives. Our Board members also engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.