text: As noted above, the Company relies on its Manager's information systems in connection with the Company's day-to-day operations. Consequently, the Company also relies on the processes for assessing, identifying, and managing material risks from cybersecurity threats undertaken by its Manager. Messrs. Cauley and Haas work collaboratively to implement a program designed to protect our Manager's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plan. These members of the Company's management team monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents and report such threats and incidents to the Board when appropriate.


text: Messrs. Cauley and Haas each hold undergraduate and graduate degrees in their respective fields, and each have approximately twenty years of experience managing risks at the Company and at similar companies, including risks arising from cybersecurity threats.

companyName: Orchid Island Capital, Inc.

ticker: ORC

secItem: Item 1C


text: IT Risk Management The Company maintains an information technology (IT) risk identification process that encompasses risks associated with enterprise solutions and products and services provided by third-party service providers. Cybersecurity risks are considered a subcategory of IT risks and are therefore part of this process. The Company maintains a risk register to document and track IT risks, including factors such as: Categories (including but not limited to cybersecurity, data privacy, governance, and application development)

companyName: HUNT J B TRANSPORT SERVICES INC

ticker: JBHT


text: Approvals/exceptions The Company's Governance, Risk, and Compliance (GRC) team maintains the IT risk register and reports updates to the IT Risk Council, which meets regularly. The IT Risk Council is made up of members representing the Company's cybersecurity, network, server, client, database, and software teams.


text: Operations and Incident Response Capabilities The Company maintains a Cybersecurity Operations Center (CSOC) comprised of in-house staff, contracted personnel, and other third-party security service providers. Our CSOC provides constant monitoring, assessment, and defense of all enterprise information systems (including web sites, applications, databases, servers, clients, and data centers) as well as service provider connections and provides incident reporting as needed.


text: The Company also maintains a Security Incident Response Team (SIRT) that responds to high-risk security incidents on a 24-hour basis. Members of this team include representatives of our CSOC and Networking Operations Center, as well as cloud/server engineering, network engineering, enterprise data, identity and access management, GRC, end-user computing, application development, and IT leadership teams.


text: Assessments and Audits The Company uses various methods to assess our cybersecurity maturity and IT risk management program, including periodic self-assessments and engagements of independent third-party assessors and consultants. We engaged third-party experts for the initial development of the IT risk management program, including preparation of the program charter, IT risk register, and responsibility assignment matrix. We use these external engagements to provide multiple assessments of our cybersecurity functions, including a compromise assessment, a security posture assessment, and a cyber-defense assessment.


text: Risks Associated with Third-Party Service Providers The Company's GRC oversees assessments of third-party service providers in collaboration with our IT contracts, data privacy, technical architecture, and legal teams. An initial review for any cybersecurity threat is completed when the provider is onboarded, with subsequent periodic reviews conducted thereafter. These subsequent reviews occur at different intervals, based on the nature of the business relationship, the type of data being exchanged (if any), and the overall potential impact to the Company, and include consideration of factors such as the third party's cybersecurity capabilities, data protections and privacy measures, and technical capabilities as related to required integrations with the Company's systems.


text: Material Findings from Cybersecurity Risks The Company faces many of the same risks and has experienced similar cybersecurity incidents as other transportation providers. None of these risks or incidents to date have materially affected our business strategy, operations, or financial condition.


text: The Board of Directors maintains oversight of risks from cybersecurity-related threats, primarily through the Audit Committee. The Audit Committee holds a separate annual in-person meeting with the Company's Chief Information Officer (CIO) and subsequently provides an update to the Board. The Company's CIO also attends a second annual meeting directly with the full Board of Directors. Beginning in 2025, in addition to these annual meetings, the CIO or the Sr. Vice President of Engineering & Technology is scheduled to meet with the Audit Committee such that the Board and the Committee receive updates on at least a quarterly basis. Other updates are provided throughout the year to the Audit Committee and the Board, as needed. In the event a cybersecurity incident is determined to be significant, a formal meeting of the full Board of Directors may be convened.


text: The Company's CIO, Senior Vice President of Engineering and Technology responsible for technical services, and Vice President of Engineering and Technology responsible for IT risk management oversee all material risks associated with cybersecurity threats. Our CIO has over 30 years of experience leading data and technology initiatives and has held executive and senior leadership roles across Fortune 500 companies. Our Senior Vice President of Engineering and Technology has more than 34 years of IT experience and has led initiatives in IT application development, IT operations, cloud computing, cybersecurity, business continuity, governance, compliance, and enterprise risk management across various industries. Our Vice President of Engineering and Technology, has more than 30 years of expertise with the Company in cybersecurity, engineering, governance, risk, and compliance, having successfully led numerous projects for the Company. Their backgrounds provide them with a comprehensive understanding of cybersecurity challenges and solutions.


text: In the event of a cybersecurity incident, these leaders engage the Incident Response Team (IRT), a team comprised of senior- and executive-level leaders from various business units, legal and finance departments, and the corporate communications team, to help manage and maintain business operations throughout the incident and any recovery period. The IRT is responsible for reporting details of the incident and its impact on the business to the Executive Leadership Team (ELT) and making key recommendations for managing operations. The ELT is responsible for advising the Board of any material cybersecurity incidents. Both the ELT and the IRT have participated in formal cybersecurity response training.


text: Cybersecurity risk management is an integral part of our overall enterprise risk management program. Our cybersecurity risk management program is designed to provide a framework for handling cybersecurity threats and incidents, including threats and incidents associated with the use of services provided by third-party service providers, and to facilitate coordination across different departments of our company. Our processes include steps for assessing the severity of a cybersecurity threat, identifying the source of a cybersecurity threat including whether the cybersecurity threat is associated with a third-party service provider, implementing cybersecurity countermeasures and mitigation strategies and informing management and our board of directors of material cybersecurity threats and incidents. Our cybersecurity team also engages third-party security experts for risk assessment and system enhancements. In addition, our cybersecurity team provides training to employees, based on their role.

companyName: OLYMPIC STEEL INC

ticker: ZEUS


text: Our board of directors has overall oversight responsibility for our risk management, and delegates cybersecurity risk management oversight to the audit committee of the board of directors. The audit committee is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks to which the company is exposed and implement processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents. The audit committee also reports material cybersecurity risks to our full board of directors. Management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes designed to ensure that such potential cybersecurity risk exposures are monitored, putting in place mitigation measures and maintaining cybersecurity programs. Our cybersecurity programs are under the direction of our Vice President of Information Services (VP-IS) who receives reports from our cybersecurity team and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our VP-IS and dedicated personnel are information system security professionals and information security managers with many years of experience. Management, including the VP-IS and our cybersecurity team, regularly update the audit committee on the company's cybersecurity programs, material cybersecurity risks and mitigation strategies and provide cybersecurity reports annually that cover, among other topics, third-party assessments of the company's cybersecurity programs, developments in cybersecurity and updates to the company's cybersecurity programs and mitigation strategies.


text: In 2024, we did not identify any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors - Risks Related to our Business" in this Annual Report on Form 10-k.


text: Cybersecurity is a material part of ConnectOne's business. As a financial institution offering products through multiple digital delivery channels, cybersecurity incidents could have a material effect on the Company, its results of operations and its reputation, although to date the Company has not experienced any cybersecurity incident which has had a material effect on the Company's business strategy, results of operations or financial condition. See "Item 1A- Risk Factors - We cannot predict how changes in technology will impact our business; increased use of technology may expose us to service interruptions or breaches in security."

companyName: ConnectOne Bancorp, Inc.

ticker: CNOB


text: Cybersecurity risk is initially overseen at ConnectOne by the management IT Committee (the "ITC"). The members of this committee include, as co-chairs, the Chief Compliance Officer and the Chief Technology Officer. Additional members are our Information Security Officer, Information Technology ("IT") Manager, Chief Risk Officer, Chairman & Chief Executive Officer, Chief Digital Officer and Chief Brand and Innovation Officer.


text: Tarak Patel, Information Security Officer - Mr. Patel has facilitated the management of information security programs at financial institutions for over 17 years.


text: Sharif Alexandre, Chief Technology Officer - Mr. Alexandre has over 20 years industry experience including managing Information Technology and Software Development teams at organizations ranging from technology startups to Fortune 500 companies. He recently oversaw IT operations and currently leads the Software Development and Data Management teams at the Bank.


text: Laura Criscione, Chief Compliance Officer - Ms. Criscione oversees the company's Compliance and Information Security. Ms. Criscione has overseen Compliance and IT Operations throughout her more than 30-year career in financial institutions.


text: Dale Dwaileebe, IT Manager - Mr. Dwaileebe has over 20 years of IT experience, is a current member of Infragard, and holds multiple industry recognized certifications. Michael O'Malley, Chief Risk Officer – Mr. O'Malley oversees entity-wide risk management, including cybersecurity related risk.


text: Ali Mattera, Chief Digital Officer – Ms. Mattera is a technology subject matter expert with over 13 years of IT leadership and over 18 years of financial service experience. In her career she has been responsible for technology/digital strategy, enterprise program management, data analytics and IT service management at other financial institutions. In addition to the members above, Frank Sorrentino III, Chairman & Chief Executive Officer and Siya Vansia, Chief Brand & Innovation Officer are also members of the ITC due to their roles in overseeing entity-wide management.


text: In order to ensure that cybersecurity risk management is integrated into the Company's overall risk management plans, systems and processes, members of the ITC, along with other lines of business heads, report to the management Enterprise Risk Management Committee (the "ERMC"), which in turn reports to the Board Audit and Risk Committee quarterly. The ERMC consists of the Company's Chief Risk Officer, Chairman & CEO, President, Chief Financial Officer, Treasurer, Chief Compliance Officer, Chief Technology Officer and Chief Credit Officer. In addition, the Company's Chief Technology Officer attends Company Board of Directors meetings and provides an information technology ("IT") report at each meeting.


text: The Company's cybersecurity risk mitigation program involves a combination of internal resources and the use of third parties. The Company's internal IT team performs monthly vulnerability scanning and performs an annual risk assessment based on the National Institute of Standards and Technology Cybersecurity Framework. The results are reported to the ITC. The Company's IT and compliance staff also review potential cybersecurity threats associated with the Company's third-party vendors, including performing a review of and obtaining a System of Organization Controls report from all vendors rated as "high risk" by the Company's internal vendor management program. The Company also has an internal Incident Response Plan and Team, which is charged with overseeing the Company's response to any cybersecurity incident. The team performs a table-top exercise at least annually to prepare to respond in the event of any actual cybersecurity incident. In addition to these internal resources, the Company uses a third-party vendor to undertake annual penetration and vulnerability testing, with the results reported to the ITC. Finally, the Company's cybersecurity compliance program is audited by the Bank's outsourced internal auditor.


text: The Company also maintains insurance which may provide coverage for expenses and certain losses incurred in connection with a cybersecurity incident.


text: Cybersecurity represents a critical component of the Company's overall approach to risk management. The Company's cybersecurity policies, standards and practices are fully integrated into our approach to risk management, and cybersecurity risks are among the core enterprise risks that are subject to oversight by our Board of Directors (the "Board"). The Company uses recognized frameworks from the National Institute of Standards and Technology as guidelines to inform its cybersecurity policies, standards, and practices. We generally approach cybersecurity matters through a cross-functional, multilayered approach, with specific goals of: (i) identifying, preventing and mitigating cybersecurity threats to the Company; (ii) preserving the confidentiality, integrity and availability of the information that we collect and store to use in our business; (iii) protecting our intellectual property; (iv) maintaining the confidence of our customers, clients and business partners; and (v) providing appropriate public disclosure of cybersecurity risks and incidents when required.

companyName: BOYD GAMING CORP

ticker: BYD


text: Consistent with our Information Security Policies and Standards, our cybersecurity program focuses on the following areas:


text: We maintain an extensive presence with cybersecurity threat operations functioning continuously and uninterrupted with the specific goal of identifying, preventing, and mitigating cybersecurity threats and responding to cybersecurity incidents in accordance with our established incident response and recovery plans.


text: Systems Safeguards: We deploy systems safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through ongoing vulnerability assessments and cybersecurity threat intelligence.


text: We use collaboration mechanisms established with public and private entities, including intelligence and enforcement agencies, industry groups and third-party service providers, to identify, assess and respond to cybersecurity risks.


text: We employ a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as third-party systems that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.


text: We provide regular mandatory training for personnel regarding cybersecurity threats, which reinforces our information security policies, standards and practices, and such training is scaled to reflect the roles, responsibilities and information systems access of such personnel. We also publish an internal newsletter on a monthly and ad-hoc basis for enterprise-wide consumption to promote awareness of trends in cybersecurity threats and attack techniques.


text: We have established and maintain comprehensive incident response and recovery plans that fully address our response to and recovery from a cybersecurity incident, and such plans are tested and evaluated on a periodic basis.


text: Communication, Coordination and Disclosure: We take a cross-functional approach to address the risk from cybersecurity threats, involving management personnel from our technology, operations, legal, internal audit and other key business functions and engage with our Board in an ongoing dialogue regarding cybersecurity threats and incidents while also implementing controls and procedures for the assessment and escalation of cybersecurity incidents pursuant to established thresholds so that decisions regarding the disclosure and reporting of such incidents can be made by management in a timely manner.


text: Our Board regularly interacts with our Chief Information Security Officer and other members of management on cybersecurity risk management.


text: A key part of our strategy for managing risks from cybersecurity threats is the ongoing assessment and testing of our processes and practices through auditing, assessments, tabletop exercises, vulnerability testing, and other exercises focused on evaluating our cybersecurity measures effectiveness. We regularly engage third parties to perform assessments of our cybersecurity program, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Board, and we adjust our cybersecurity policies, standards, processes, and practices as necessary based on the information provided.


text: Our Board oversees the management of risks from cybersecurity threats, including the policies, standards, processes and practices that management implements to address risks from cybersecurity threats. Our Board receives regular presentations and reports on cybersecurity risks, which address a wide range of topics including, for example, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties. Our Board also receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding such incident until it has been addressed. At least quarterly, the Board discusses the Company's approach to cybersecurity risk management with our Chief Information Security Officer ("CISO").


text: Our CISO is the member of our management team that is principally responsible for overseeing our cybersecurity program, in partnership with other business leaders across the Company. Our CISO has served in various roles in information technology and information security for over 25 years and holds a degree in Business Administration with a major in Accounting and Finance and a graduate degree in International Management. Our CISO also holds advanced certifications as a Certified Information Systems Security Professional and as a Qualified Technology Executive granted by Digital Directors Network and works in coordination with the other members of management, including, but not limited to, the Company's President and Chief Executive Officer, Chief Financial Officer, Chief Technology Officer, and General Counsel. Our Chief Technology Officer holds an undergraduate degree in computer science and economics from Northwestern and has served in various roles in information technology for over 33 years with Boyd Gaming and numerous other public companies. The Company's President and Chief Executive Officer, Chief Financial Officer, and General Counsel each hold undergraduate and graduate degrees in their respective fields, and each has years of experience with managing risks at the Company and in environments similar to the Company's, including risks arising from cybersecurity threats.


text: Our CISO works collaboratively across the Company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents. To facilitate the success of this program, multidisciplinary teams are deployed to address cybersecurity threats and to respond to cybersecurity incidents in accordance with our incident response and recovery plans. Through the ongoing communications from these teams, the CISO monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents in real time, and reports such incidents to the Board when appropriate.


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company, including our business strategy, results of operations, or financial condition. We believe with the cybersecurity and governance program we have in place that we have and continue to implement effective processes and controls to prevent cybersecurity incidents from being reasonably likely to materially affect the Company. Refer to "Item 1A. Risk Factors" in this annual report on Form 10-K, including "Failure to maintain the integrity of our information technology systems, protect our internal information, or comply with applicable privacy and data security regulations could adversely affect us", for additional discussion about cybersecurity-related risks.


text: We take an enterprise-wide approach to cybersecurity, using established processes for assessing, identifying, and managing risks from cybersecurity threats. We have implemented various measures across our organization to manage our cybersecurity risks, including implementing systems to identify, prevent, detect, investigate, resolve and recover from cyber security attacks. All employees participate in our security awareness training program, and additional training is required for various roles within the organization. Employees are trained and encouraged to identify and report security concerns, and cybersecurity is engrained in our culture.

companyName: RUSH ENTERPRISES INC \TX\

ticker: RUSHA


text: Our cybersecurity risk management program leverages the Center for Internet Security Critical Security Framework to provide a structured methodology to help ensure the confidentiality, integrity and availability of our systems and data. We regularly assess cybersecurity risks and monitor our systems for vulnerabilities. We conduct regular reviews and tests of our systems and our cybersecurity program, both internally and using consultants and external auditors. These tests include, but are not limited to, vulnerability testing, penetration testing, tabletop exercises, systems recovery tests, assessments and other activities to assess the readiness and effectiveness of our cybersecurity controls and protections.


text: Our Information Security program is led by our Chief Information Officer ("CIO"), who reports to our Chief Operating Officer ("COO"). Our CIO works with our Chief Privacy Officer ("CPO") to address cybersecurity and data privacy risks and concerns. The Information Security Governance Committee ("ISGC"), composed of executives from various corporate functions oversees our cybersecurity policy and strategy. Members of the ISGC, including the CIO and CPO, meet with the COO on a regular basis to review and monitor our cybersecurity risks and mitigation efforts. Our Board of Directors (the "Board") oversees our enterprise risk management activities in general, including cybersecurity risks. The Audit Committee of the Board has been designated with specific oversight responsibility with respect to cybersecurity and data privacy risk management. The Board receives a comprehensive update on the status of risks related to cybersecurity annually and periodic updates on particular matters. We engage external assessors, consultants, and auditors to assist us in evaluating and enhancing our cybersecurity risk management processes. We also have processes to oversee and identify such risks from cybersecurity threats associated with our use of third-party service providers.


text: While we have not experienced a material breach, our systems are frequently the target of cyber security attacks intending to steal, misuse, or destroy data, to impact our ability to do business, or otherwise negatively impact us. If we did experience a significant disruption in service, theft of data, or other significant attack, it could result in legal claims or proceedings, liability under federal and state laws that protect the privacy of personal information, regulatory penalties, remediation costs, increased cybersecurity costs, loss of revenue or customers, damage to our reputation or competitive position, or other harm to our business. For more information regarding the risks we face from cybersecurity threats, please see "Risk Factors."


text: Information technology is important to our business operations and we are committed to protecting the privacy, security, and integrity of our data, as well as our employee, customer, and vendor data. Accordingly, we have established processes, procedures, and controls to identify, manage, assess, and mitigate material risks from cybersecurity threats, as well as identify, contain, and respond to cybersecurity incidents. These processes include, but are not limited to, monitoring and updating of our information technology and infrastructure to prevent, detect, address, and mitigate risks associated with unauthorized access, misuse, computer viruses, and other events that could have a security impact. Additionally, to protect and secure sensitive data, we employ multi-factor authentication, a suite of security tools, systems monitoring and alerting, audit logs, and controls across our major systems, devices, and business processes. We engage with external experts to evaluate and test our cybersecurity risk preparedness. Regular exams and threat and security assessments with these third parties ensure that our cybersecurity strategies align with industry best practices. To manage cybersecurity risks associated with third-party service providers, we impose security requirements upon our suppliers, including maintaining an effective security management program and notifying us in the event of any known or suspected cyber incident. We also conduct company-wide security awareness training periodically to provide employees the opportunity to gain an understanding of the various forms of cybersecurity incidents and enable our employees to handle and report the majority of suspicious activities or threats. We currently maintain a cyber insurance policy that provides coverage for security breaches; however, such insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyber-attacks, or other related breaches.

companyName: AEye, Inc.

ticker: LIDR


text: As of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, see the risk factor within Item 1A "Risk Factors" in this Annual Report on Form 10-K, entitled "We, as well as our suppliers and partners, are subject to cybersecurity risks to operational systems, infrastructure, integrated software in our lidar solutions, and the data processed by those solutions, and any material failure, weakness, interruption, cyber event, incident, or breach of security could adversely affect our business by causing a disruption of our operations, a compromise or corruption of our confidential or other business-critical information, and/or damage our business relationships, all of which could negatively impact our business financial condition, and operating results."


text: Cybersecurity risks are among the enterprise risks that our Board of Directors oversees, primarily through delegation to the Audit Committee of the Board. The Audit Committee assists the Board in overseeing our privacy and information policies and reviewing our cybersecurity program. The Audit Committee engages with our management team, including our Director of IT and our Chief Financial Officer, and receives periodic reports on cybersecurity. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential. The Board receives regular updates on the activities of the Audit Committee, including with regard to cybersecurity oversight. These cybersecurity reviews by the Audit Committee or Board of Directors generally occur at least once annually, or more frequently as determined to be necessary.


text: The day to day operations of our cybersecurity risk management program are overseen by our Director of IT, who reports to our Chief Financial Officer. Our Director of IT has served in this position for 6 years. He has over 39 years of IT experience, including over 10 years of experience in security compliance. Our Director of IT supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal personnel, threat intelligence, alerts, or reports produced by security tools deployed in the IT environment.


text: The Company's Board of Directors (the "Board") recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Board is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM"). The Company's cybersecurity policies, standards, processes, and practices are fully integrated into the Company's ERM program and are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. Management's philosophy on cybersecurity is to be vigilant in protecting the Company and its constituents through robust investments and employee awareness to aid in the prevention, detection and mitigation of cyber threats, while recognizing that not all threats are preventable.

companyName: DOUGLAS DYNAMICS, INC

ticker: PLOW


text: As one of the critical elements of the Company's overall ERM approach, the Company's cybersecurity program is focused on the following key areas: Governance: As discussed in more detail under the heading "Governance," the Board's oversight of cybersecurity risk management is supported by the Audit Committee of the Board (the "Audit Committee"), which regularly interacts with executive leadership, the Company's ERM function, and the Company's Vice President of Information Technology. Collaborative Approach: The Company has implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. Technical Safeguards: The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. Incident Response and Recovery Planning: The Company has established and maintains incident response and recovery plans that address the Company's response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis. Third-Party Risk Management: The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. Education and Awareness: The Company provides regular, mandatory training for personnel regarding cybersecurity threats as a means to equip the Company's personnel with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices. The Company engages in the periodic assessment and testing of the Company's policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. The Company regularly engages third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to executive management, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: The Board, in coordination with the Audit Committee, oversees the Company's ERM process, including the management of risks arising from cybersecurity threats. The Board and the Audit Committee each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. The Board and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, the Board and the Audit Committee discuss the Company's approach to cybersecurity risk management with the members of senior leadership, which includes the Company's Vice President of Information Technology.


text: The Vice President of Information Technology, in coordination with executive leadership including our Interim Chief Executive Officer ("CEO") and Chief Financial Officer ("CFO"), works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the Vice President of Information Technology monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and reports such threats and incidents to the Audit Committee when appropriate.


text: The Vice President of Information Technology has been with the Company for over 25 years in various roles in information technology and information security. The Company's Interim CEO and CFO each hold undergraduate and graduate degrees in their respective fields, and each have over 25 years of experience managing risks at the Company and at similar companies, including risks arising from cybersecurity threats.


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected or are reasonably likely to affect the Company, including its business strategy, results of operations or financial condition.


text: In the ordinary course of our business, we collect, use, store, and transmit digitally large amounts of confidential, sensitive, proprietary, and personal information. The secure maintenance of this information and our information technology systems is important to our operations and business strategy. To this end, we have implemented processes designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein.

companyName: EXPRO GROUP HOLDINGS N.V.

ticker: XPRO


text: These processes are managed and monitored by a dedicated Cybersecurity and Infrastructure team, which is led by our Chief Information Officer, and include mechanisms, controls, technologies, systems, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data and maintain a stable information technology environment. For example, we conduct penetration and vulnerability testing, data recovery testing, security audits, and annual and ongoing risk assessments. We engage third parties to perform monitoring and regular penetration testing. We have adopted an Incident Response Policy that applies in the event of a cybersecurity threat or incident that follows the National Institute of Standards and Technology framework. We also conduct regular employee trainings on cyber and information security, among other topics. In addition, we consult with outside advisors and experts, when appropriate, to assist with assessing, identifying, and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on the Company's risk environment.


text: Our Chief Information Officer, who reports to the Chief Financial Officer, and has over 30 years of experience managing information technology and cybersecurity matters, together with our executive management team, is responsible for assessing and managing cybersecurity risks. We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. In the last fiscal year, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, but we face certain ongoing cybersecurity risks threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the heading "Risks Related to Legal and Regulatory Requirements."


text: The Board of Directors, as a whole and at the committee level, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate those risks. The Nominating and Governance Committee has been designated by our Board to oversee cybersecurity risks. The Nominating and Governance Committee receives periodic updates on cybersecurity and information technology matters and related risk exposures from our Chief Information Officer. The Board also receives updates from management and the ESG Committee on cybersecurity risks on at least an annual basis.


text: Our information technologies, system networks, information technology infrastructure, enterprise applications and financial reporting platforms are critical components of our operations. Our business operations rely on the secure processing, transmitting, collecting and storage of sensitive and confidential data. We recognize the importance of assessing, identifying and managing material risks associated with cybersecurity threats, as defined in Item 106 (a) of Regulation S-K.

companyName: Stabilis Solutions, Inc.

ticker: SLNG


text: Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. We partner with a third-party information technology company to address and manage each of the critical aspects of cybersecurity risk mitigation. The user aspect is addressed by deploying endpoint detection and response software on all endpoints, as well as extensive phishing testing and training for every user. This is further reinforced with additional monitoring to identify any aberrant activity within our network or software as a service ("SaaS") tools. A 3-2-1 backup strategy is used, resulting in a copy of all backup data offsite in the unlikely event that the disaster recovery plan is required. Our backup system is regularly confirmed through routine data recoveries, test recoveries and monitoring that alert to any unexpected errors or failures with the system.


text: In our business operation, we utilize various third -party service providers, including credit card companies, banks and financial platform providers, to process financial transactions and implement various software and information system processes. To that effect, we seek to engage reliable, reputable service providers that maintain cybersecurity programs.


text: We are not aware of any risks from cybersecurity threats, nor have we experienced any cybersecurity incidents, which have materially affected or are reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition. See Item 1A. "Risk Factors" in this Form 10 -K for discussion of risk factors.


text: Cybersecurity is an important part of our risk management processes. Our Board of Directors holds oversight responsibility for the Company's strategy and risk management, including material risks related to cybersecurity threats. The Audit Committee of the Board of Directors oversees the management of systemic risks, including cybersecurity threats, in accordance with its charter.


text: Our management, represented by senior management, leads the cybersecurity risk assessment and mitigation processes, along with information technology management staff and our third-party business technology partner. Our third-party business technology partner has over 21 years of experience in cybersecurity and information technology. Continuous monitoring and routine meetings are conducted in order for the Company's information technology team and third-party business technology firm to update senior management regarding prevention, detection, mitigation and remediation of any cybersecurity threats or incidents.


text: The Company's Board of Directors takes seriously both the responsibility to guard against cybersecurity threats and its compliance with the SEC Cybersecurity regulations adopted on July 26, 2023. Our Board of Directors has standing agenda to review and discuss on cybersecurity matters with management during each meeting. Management is updated on cybersecurity matters by the IT Senior Systems Administrator ("ITSSA").

companyName: UNIVERSAL BIOSENSORS INC


text: Our cybersecurity risk management program leverages a combination of processes, technologies and personnel with expertise in cybersecurity to comply with applicable regulations and detect and respond to cyber-attacks, data breaches, security incidents, and compromises of personal information, as well as to regularly and promptly inform management and our Board of Directors of any significant cybersecurity risks and developments.


text: Our ITSSA, who has significant experience in managing cybersecurity risks is directly responsible for establishing cybersecurity strategies and structures and managing ongoing cybersecurity risk management activities, reports relevant information regarding cybersecurity threats and risks to management. Management can then further elevate matters to the full Board of Directors, as necessary or required.


text: The Company and the Board of Directors are committed to remaining updated on evolving cybersecurity regulations and best practices, as well as the development and amendment of processes to meet these changing demands. The Company did not experience any cybersecurity incident during 2024.


text: Our Audit Committee, composed of two independent Board of Director members, has oversight responsibility for the Company's cyber-security risk. The internal members of management that oversee cybersecurity is the Chief Financial Officer, ("CFO") and the Director of Franchise Operations/Staff Attorney, ("DFO"). The CFO reports to the Audit Committee prior to each quarterly and annual 10-Q and 10-K filing, respectively, on any current cyber changes, procedures and any identified risks. The CFO provides the Audit Committee any cyber insurance information and will obtain approval for any changes in cyber insurance coverage. The CFO will also provide the Audit Committee any information on any possible third-party information technology, ("IT") service and consultant changes. The Audit Committee will review and approve any change in IT service providers. The Audit Committee will be immediately notified of any cyber security threats or incidents.

companyName: BAB, INC.

ticker: BABB


text: At BAB, Inc. we recognize the importance of safeguarding our systems, data and assets, even in an environment where the risk of cyber incidents is minimal due to the nature of our business. The CFO has over 30 years of experience in risk management and working with computer systems across various industries, providing strong oversight of the cybersecurity efforts. The DFO has several years of experience in IT operations within the company. The internal management team of the CFO and DFO are both familiar and knowledgeable of the company's computer systems and operations and they are familiar with the company's policies, procedures and accountability for safeguarding critical data and assets. Cybersecurity tools as listed below aid in mitigating cybersecurity risk.


text: Our cybersecurity infrastructure includes a combination of technical, administrative and physical safeguards designed to mitigate cybersecurity risks. As part of our risk management process, the CFO also regularly engages with the outside IT consultants to review and minimize the Company's cyber risk.


text: The Company has a firewall that protects the whole network, including intrusion protection, virus protection and other subscription-based protection that updates regularly. For those with remote access there is end-to-end encryption with a secure VPN to access the server. All computers, including those in office and any remote user's computers have an antivirus software from a company that specializes in cybersecurity that has been installed and maintained by an outside IT consultant. The software is updating and reviewing any cyber threats on a continual basis. Additional services provide email filters to minimize phishing and spam emails. Employees are trained to not open suspicious emails and to never open attachments unless they are expecting an attachment from that Company or individual.


text: Sensitive files are password protected and accessible by only select individuals. These files are maintained on a separate drive. Computer files are backed up and redundancy protocols are in place so that minimal downtime would occur in the event of a cyber breach. The Company also maintains cyber insurance coverage to ensure that the Company is adequately prepared in the event of an unforeseen cyber incident.


text: No system is entirely immune to cyber threats and although our risk is low, the impact of a cybersecurity incident could impact our business, cause reputational harm, subject us to increased operating costs and/or expose us to litigation. To date, we have had no cybersecurity incidents that have materially impacted, or are reasonably likely to materially impact our operations or financial condition. Should an incident occur, the CFO and/or DFO will immediately report the incident to the Audit Committee with all details. The communication will identify what steps are currently being taken to resolve the incident, and what actions are being taken to prevent any further security incidents from occurring.


text: Risk Management, Strategy, and Governance Our enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes are led by a dedicated, outsourced Chief Information Officer, in collaboration with outside cybersecurity partners, is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. Qualified third-party service providers are tasked with developing, implementing, and executing that strategy. These third parties play a key role in our cybersecurity risk assessment and management processes, as we rely on their cybersecurity experience and expertise to assess, identify, and manage emerging trends and risks from cybersecurity threats on an ongoing basis.

companyName: Laird Superfood, Inc.

ticker: LSF


text: Our Chief Executive Officer and other members of our senior management, as appropriate, provide oversight and monitoring of these third parties, who provide regular reports to management. Management provides periodic reports to our Board as a whole, who are ultimately responsible for the oversight of risks from cybersecurity threats, which include updates on the Company's cyber risks, the status of projects to strengthen our information security systems, assessments of the information security program, the emerging threat landscape, and any recommendations for additional internal controls, systems, or insurance coverage for board approval.


text: Our cybersecurity policies are focused on ensuring the security and protection of our systems, networks, and proprietary data, which includes trade secrets, intellectual property, corporate strategic plans, marketing plans, material non-public financial information, and personally identifiable information, such as employee and customer information. We also actively engage with key vendors as part of our continuing efforts to actively monitor system access, identify and quarantine potential cybersecurity threats, to assess and implement cybersecurity systems and tools, and to enhance the effectiveness of our information security policies and procedures.


text: Cybersecurity risk management processes are one component of our overall risk assessment process whereby, on an ongoing basis, we analyze our internal control environment and consider how threats to the business might circumvent those controls. These processes include control over and segregation of user access to key systems, monitoring of any user access anomalies, active monitoring of emerging trends in the broader market, timely identification and quarantine of any potential cybersecurity incidents, evaluation of our operations and business needs and how executing on those needs translates to potential threats, and training of end users to mitigate the likelihood of user error.


text: We assess materiality of cybersecurity incidents based on the type of breach, whether any information was accessed, the nature of the information accessed, and the potential for business interruption. As of the date of this report, we are not aware of any material incidents from cybersecurity threats, that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition.


text: With the guidance of a qualified third -party that reports to and regularly meets with the Chief Executive Officer, we continue to make improvements in our cybersecurity program throughout our operating companies. We have established processes, consistent with nationally recognized frameworks, for deterring, detecting, evaluating, and responding to potential cybersecurity incidents. Our prevention efforts are multi-faceted, and are intended to address threats to our employees, networks, applications and data.

companyName: CRAWFORD UNITED Corp


text: Our third -party advisor has performed cybersecurity risk assessments of our information technology security processes and implemented technologies to lessen risk and respond to new risks as they arise. Using third party services, we monitor, scan, assess, audit, and remediate identified vulnerabilities across our networks, as appropriate. Furthermore, recognizing that our employees are an essential line of defense in cybersecurity, we require employees to participate in ongoing training and testing programs through which we provide education on the risk of potential cybersecurity incidents, methods for identification of such incidents and appropriate responses. Our policies and processes are informed by industry standard practices regarding application security, access management, device protection, network management, and data loss prevention and recovery.


text: Our cybersecurity incident response plan includes retention of external experts for prompt assistance following discovery of any material incident. This cybersecurity incident response plan is part of our ongoing cybersecurity vulnerability management, and we endeavor to maintain appropriate controls to identify, monitor, analyze and address potential cybersecurity incidents, including potential unauthorized access to our networks and applications, along with detection of potential unusual activity within our networks or applications. Any potential cybersecurity incident discovered is promptly reported to the Chief Executive Officer and Chief Financial Officer, and the Audit Committee or the full Board, as appropriate.


text: Our Board of Directors provides oversight of risks from cybersecurity threats, in coordination with our management team and the Audit Committee of the Board. Our Board relies on management to bring significant matters impacting the Company to its attention, including with respect to material risks from cybersecurity threats. Our Audit Committee provides an additional layer of cybersecurity oversight and is responsible for discussing cybersecurity concerns with management (including data privacy risk management) and the steps management has taken to monitor and control such exposures.


text: There have been no cybersecurity incidents which have materially affected us to date, including our business strategy, results of operations or financial condition. However, any future potential risks from cybersecurity threats, including but not limited to exploitation of vulnerabilities, ransomware, denial of service, supply chain attacks, or other similar threats may materially affect us, including our execution of business strategy, reputation, results of operations and/or financial condition. See Item 1A. Risk Factors — "A significant disruption in, or breach in security of, our information technology systems or data could adversely affect our business, reputation and results of operations."


text: We strive to implement leading data protection standards to ensure a strong commitment to cybersecurity. Our Data Security Policy and Cybersecurity Incident Response Plan ("CIRP"), which is part of our enterprise wide risk management processes, guides our cybersecurity program. The CIRP, developed in consultation with an independent cybersecurity expert, includes processes for identifying, managing, and remediating cybersecurity incidents. We utilized the National Institute of Standards and Technology ("NIST") and the Center for Internet Security ("CIS") guidelines to develop and implement the CIRP, which is approved by our Chief Technology Officer ("CTO"). However, this should not be interpreted to mean that we meet any particular technical standards, specifications, or requirements, only that we used the NIST and CIS as a guide to help create develop and implement the CIRP. The CIRP is reviewed and updated annually. The Company's cybersecurity risk management processes include ongoing monitoring and testing of its information systems and data to identify and respond to potential cybersecurity threats. Internally, the Company utilizes an enterprise Attack Surface Management tool to routinely scan for vulnerabilities to internal assets. Externally, we use third-party vendors to routinely conduct scans for vulnerabilities to external assets. In addition, our internal auditors along with management also conduct periodic monitoring of our internal controls over our data security and customer privacy systems and processes.

companyName: GRAY MEDIA, INC

ticker: GTN


text: For many vendors for the Company, we request copies of standard security reports or assessments, such as System and Organization Controls ("SOC") reports, to support our assessment of our vendors' security practices. In collaboration with the National Association of Broadcasters, North American Broadcasters Association, and risk management vendors, we are also working to assemble broadcaster-specific guidelines for information technology vendor selection.


text: The Company provides security awareness training for all employees on a regular basis. The training is designed to educate and prepare employees to recognize unsafe practices and to properly respond to phishing attacks from email, social media, and other sources. Follow-up testing using simulated attack tools is used to validate the effectiveness of training and compliance.


text: Although we have systems and processes in place to protect against risks associated with cybersecurity incidents in the future, depending on the nature of an incident, these protections may not be fully sufficient. To date, no risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or have been determined to be reasonably likely to materially affect the Company or our business strategy, results of operations, or financial condition. For additional information regarding the risks from cybersecurity threats and incidents we face, see the section captioned "Operating Risks – Disruptions or security breaches of our information technology infrastructure could interfere with our operations, compromise client information and expose us to liability, possibly causing our business and reputation to suffer" within Part I, Item 1A. "Risk Factors".


text: Management is responsible for the Company's day-to-day risk management and the Board serves in an oversight role. The Board has empowered the Audit Committee with formal oversight of enterprise risk matters, including with respect to cybersecurity. The Audit Committee and management periodically review the Company's policies with respect to risk identification, assessment, and management, including cybersecurity risk exposures and the internal controls and procedures in place to manage such risks, as well as the steps that management takes to monitor and control such exposures. In addition, the Audit Committee and the Board consider risk-related matters on an ongoing basis in connection with deliberations regarding specific transactions and issues.


text: The Cybersecurity Incident Response Team ("CIRT"), which is led by the CTO, is responsible for the prevention, detection, mitigation, and remediation of cybersecurity incidents and conducts primary incident response efforts. Our CTO, who is responsible for assessing and managing the Company's cybersecurity risks, has over 30 years of industry experience, including serving in similar roles leading and overseeing cybersecurity programs at Raycom Media prior to the Raycom Merger. Other team members of the CIRT also have relevant educational and industry experience, including holding similar positions at large companies. Incidents can be escalated up to our executive leadership team, depending on the severity of the incidents. Our President and/or CTO regularly report to our Board, and our CISO and General Counsel regularly report to our Audit Committee about our cybersecurity health and initiatives. In addition, the Board receives quarterly reports on risk management activities across Gray operations, including with respect to cybersecurity.


text: We believe that cybersecurity is a critical part of our overall risk management profile, which is supported by both our management and our Board of Directors. We believe that we face the same external threats common to other participants in the infrastructure sectors, which include ransomware and malware attacks in addition to the risks brought on through the vendor supply chain. Through the leadership of our Vice President of Information Technology, who reports to our Chief Financial Officer, we continuously assess these threats and evaluate our landscape for new vulnerabilities, considering both for their probability of occurrence as well as their perceived potential impact. We supplement our risk assessment processes with robust third-party identification tools which we review routinely through the use of intrusion prevention and detection systems. We supplement our internal procedures with third parties, who routinely assess our network infrastructure for vulnerabilities both internal and external to our firewall. We also conduct periodic training and awareness programs for all of our employees with systems access in order to drive adoption and awareness of their critical roles in cybersecurity processes and controls.

companyName: NWPX Infrastructure, Inc.

ticker: NWPX


text: The pace of change in approaches undertaken by cyber criminals requires that we strive for continuous improvement and constant monitoring of the broader landscape. In 2024 we adopted the cybersecurity framework of the National Institute of Standards and Technology ("NIST"), and worked to assess our adoption of the NIST cybersecurity framework against a group of peers. We believe that continued evaluation by external experts is the best means to ensure both the design and operational effectiveness of our cybersecurity policies, internal controls, and standards. Furthermore, these periodic reviews are critical to evaluate that we have the right people, technology, and processes to identify, prevent, and detect the activities of bad actors who desire to challenge the system continuity and functionality of the information technology we depend on to operate our business. In addition to our prevention efforts, we also prepare for criminal infiltration through the evaluation of our incident response plan including table top exercises, which helps us assess our ability to react timely and effectively to various degrees of cybersecurity incidents. We believe our plan is well-designed and capable to manage an unforeseen breach including the eradication of the infiltrator from our networks. We carry cyber insurance to transfer the residual risk of an incident. We also work with our cyber insurance carrier to regularly refine our response procedures, which include the definition of internal and external communications channels to key stakeholders, as well as the identification of material breaches and the associated incident reporting up to senior management and our Board of Directors.


text: Our Board of Directors has charged the Audit Committee with the governance and oversight of this risk. Our committee charter requires quarterly reporting to our Audit Committee by our Vice President of Information Technology covering key cybersecurity accomplishments, planned enhancement activities, and monitoring observations of the threat environment. Board experience in risk assessment has been enhanced with certification achievements specific to cybersecurity risk, providing us with the appropriate oversight for this evolving threat.


text: As of the date of this report, we are not aware of any material breaches to our networks or computer systems that have materially affected or are reasonably likely to materially affect our execution of our business strategy, results of operations, or financial condition. We describe potential risks from cybersecurity threats under the heading "Our information technology systems can be negatively affected by cybersecurity threats," in Part I — Item 1. "Risk Factors" of this 2024 Form 10 K, which disclosures are incorporated herein by reference.


text: Cybersecurity Risk Management & Strategy Our business requires the use of information technology (IT) and operational technology (OT) resources, including those to carry out our day-to-day operational activities both onshore and offshore, to maintain our business records and to proactively monitor internal and external cybersecurity threats. To respond to cybersecurity risks and threats, we have developed a cybersecurity risk management program designed to identify, assess, manage and respond to cybersecurity incidents while also preserving the confidentiality, integrity and continued availability of our information and assets. The underlying controls of our cyber risk management program are based on recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) and the International Organization for Standardization (ISO) 27001 Information Security Management System Requirements.

companyName: TIDEWATER INC

ticker: TDW


text: We have a Security Operations Center operating in multiple regions that provides daily monitoring of our global cybersecurity environment and coordinates real-time investigation and remediation of alerts. Identifying and assessing cybersecurity risks related to our business, operations, privacy and compliance issues are identified and addressed through a multi-faceted approach including third party assessments, internal IT audits, IT/OT security, governance, risk and compliance reviews. To deter, detect and respond to cybersecurity incidents, we conduct proactive privacy and cybersecurity reviews of systems and applications, audit applicable data policies, perform penetration testing using external third -party tools and consultants, and conduct tabletop exercises to simulate responses to cybersecurity incidents. We also conduct and require our workforce to complete ongoing cybersecurity awareness education and training. Our team of cybersecurity professionals then collaborate with technical and business stakeholders across our business units to further analyze the risk to the company, and form detection, mitigation and remediation strategies.


text: We have implemented incident response and breach management processes, including (i) preparation for a cybersecurity incident, (ii) detection and analysis of a security incident; (iii) containment, remediation and recovery from an incident; and (iv) post-incident analysis. Such cybersecurity incident responses are overseen by leaders from our IT, compliance and legal teams as further described under "Cybersecurity Governance" below, and elevated to other senior leaders, third party providers and the Audit Committee of the Board as appropriate and in accordance with our response plan and procedures.


text: We engage third party security experts for assessments, penetration tests and program enhancements, including vulnerability assessments, security framework maturity assessments and identification of areas for continued focus and improvement. We use the findings of these exercises to improve our practices, procedures, and technologies. We engage third party security experts to support our cybersecurity threat and incident response management and maintain cybersecurity risk insurance coverage.


text: Our risk management program also assesses third party risks, and we perform third -party risk management to identify and mitigate risks from third parties such as vendors, suppliers, and other business partners associated with our use of third -party service providers. Cybersecurity risks are evaluated when determining the selection and oversight of applicable third -party service providers and potential fourth -party risks when handling and/or processing our employee, business or customer data.


text: We have not experienced a material cybersecurity incident and although we are subject to ongoing and evolving cybersecurity threats, we are not aware of any material risks from cybersecurity threats that have materially affected the Company. For more information on our cybersecurity risks, see "Risk Factors – Risks Relating to Information Technology and Cybersecurity – Cybersecurity attacks on any of our facilities, or those of third parties, may result in potential liability or reputational damage or otherwise adversely affect our business."


text: The Audit Committee of our Board oversees our cybersecurity risk management program and meets on a quarterly basis with our Chief Information Officer (CIO) to review our cybersecurity programs and risks, including (as applicable) assessments and program maturity; evolving cyber risks; status on addressing and/or mitigating cyber risks; any recent cybersecurity or data privacy incidents at the Company and across the industry; and status on any key cybersecurity initiatives. These cybersecurity risks and programs are further reviewed and considered by the Board in connection with the company's overarching enterprise risk program.


text: Our cybersecurity team is led by our Director of IT Infrastructure, who has over 20 years of experience and obtained various professional security certifications and advanced training in the field of cybersecurity and technology and reports to our CIO. Our CISO is responsible for managing and supervising our cyber risk management program and informing the CIO and senior management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents.


text: The CISO and CIO are informed about and monitor these cybersecurity programs and incidents through their oversight of, and participation in, the cybersecurity risk management and strategy processes described above, including management of and notices from our Security Operations Centers and the supervision of our incident response plan and processes.


text: To effectively manage the cyber risk posed to our organization and to remain within our risk appetite, we maintain a cybersecurity strategy and risk management program to identify, assess and manage material risks from cybersecurity threats with the aim of protecting the confidentiality, integrity and availability of our critical systems and information.

companyName: JANUS HENDERSON GROUP PLC

ticker: JHG


text: Our cybersecurity program takes a cyberthreat and risk-based approach and was developed to align with ISO 27001, an international standard for information security, and we also assess ourselves against the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. In addition, our cybersecurity risk management program aligns with ISO 31000, the international standard for risk management. The foregoing does not imply that we meet all technical standards, specifications or requirements, or that we have been certified on these requirements in any respect, only that we have used these industry standards as guides when designing our cybersecurity and risk management programs.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program and shares common methodologies, reporting channels and governance processes that apply across our enterprise risk management program to other legal, compliance, strategic, operational and financial risk areas. For example, cybersecurity threats are subject to our firm-wide Risk Events Policy, which sets forth procedures for the identification, escalation, recording, investigation and approval of handling of such risk events.


text: Our cybersecurity risk management program includes a cybersecurity incident response plan. Major incidents emanating from cybersecurity threats are communicated to our Operational Risk team through our enterprise risk management system and escalated in accordance with our incident response plan. In addition, cybersecurity has been designated as a principal risk by the Risk Committee of our Board of Directors (the "Risk Committee"), which requires regular monitoring and reporting.


text: We identify material risks from cybersecurity threats through various sources, including, but not limited to, controls testing, compliance testing of our security standards, independent penetration testing, open-source threat intelligence feeds, and lessons learned and assessments against control frameworks. These threats are assessed by applying our Risk and Control Self-Assessment ("RCSA"), information technology risk and cybersecurity risk management processes, each of which we review regularly. Based on the RCSA, risks from cybersecurity threats that exceed established risk tolerance thresholds are recorded and incorporated into our reporting to the Risk Committee and senior management as described in more detail below. We also engage third -party assessors, consultants and auditors to assist in the administration, assessment and improvement of our cybersecurity risk management program.


text: To help bring risks from cybersecurity threats within an acceptable risk appetite and tolerance level, we created a cybersecurity strategy and associated program of necessary activities. The program mitigates the risks through the effective design and implementation of compensating controls or remediation actions, commensurate with the assessed risk level from such threats.


text: With respect to third -party service providers with access to our information systems, assets or data, our security policies, standards and procedures are designed so that periodic due diligence is conducted as appropriate on the cybersecurity controls maintained by such third parties. The aim is to ensure the third -party service provider has adequate and appropriate cybersecurity measures in place commensurate to the risk their access to our information systems, assets or data presents.


text: We have not identified any risks from cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect the business strategy, results of operations or financial condition of the Company. Please refer to the risk factor captioned "We could be subject to losses and reputational harm if we, or our agents, fail to properly safeguard sensitive and confidential information against cyberattacks or other security breaches or if our business processes are not sufficiently resilient." in Part I, Item 1A. Risk Factors, for additional description of cybersecurity risks and potential related impacts on the Company.


text: Our Board of Directors has established a Risk Committee to assist the Board in its oversight of risk. As part of its responsibilities, the Risk Committee oversees management's implementation of our cybersecurity and risk management program.


text: The Risk Committee receives regular reports from our Information Security leadership on our cybersecurity risks, including key status updates, security issues, current and future priorities, independent assurance, threat landscape and audit findings. The Risk Committee regularly reports to the full Board regarding its activities, including those related to cybersecurity oversight.


text: Our Information Security team, including our Information Security leadership, has primary responsibility for identifying, assessing and managing material risks to the Company from cybersecurity threats, including our overall cybersecurity risk management program and supervision of our internal cybersecurity personnel and our external cybersecurity consultants. Our Chief Information Security Officer ("CISO") has over 20 years of information security/cybersecurity experience, working in a variety of roles within PricewaterhouseCoopers LLP, as the Director of Cyber Operations for Nationwide Building Society, the CISO at The Crown Estate and the CISO at Insight Investment.


text: Our Information Security team supervises efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, including receiving regular briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: Our Information Security leadership regularly briefs our Global Chief Operating Officer and Chief Technology Officer on cybersecurity issues, the scope of which is similar to the information presented by the Information Security leadership to the Risk Committee as described above. Major risks from cybersecurity threats determined following application of an RCSA are escalated by our Information Security leadership to the Risk Committee, Global Chief Operating Officer, Chief Technology Officer and other senior management.


text: We have integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration is intended to make cybersecurity considerations an integral part of our decision-making processes. Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.

companyName: PUMA BIOTECHNOLOGY, INC.

ticker: PBYI


text: Our cybersecurity risk management program includes: risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment;


text: a management team responsible for managing ( 1) our cybersecurity risk assessment processes, ( 2) our security controls, and ( 3) our response to cybersecurity incidents;


text: the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; cybersecurity awareness training of our employees, incident response personnel, and senior management;


text: a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and a third -party risk management process for service providers, suppliers, and vendors.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") oversight of cybersecurity risks, including oversight of management's implementation of our cybersecurity risk management program.


text: The Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the Committee, where it deems appropriate, regarding any cybersecurity incidents it considers to be potentially significant.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from internal security staff or external experts as part of the Board's continuing education on topics that impact public companies. Our Senior Director of Information Technology and Senior Vice President, Quality Assurance, who report to the Chief Financial Officer and Chief Executive Officer, respectively, are primarily responsible for assessing and managing our material risks from cybersecurity threats. The Senior Director of Information Technology and Senior Vice President, Quality Assurance have primary responsibility for our overall cybersecurity risk management program and supervises both our internal technology and quality assurance compliance personnel and our retained external cybersecurity consultants. Our Senior Director of Information Technology has more than 20 years of experience in IT Management, including cybersecurity, and our Senior Vice President, Quality Assurance has more than 20 years of experience in computerized system and IT infrastructure controls, compliance, and risk management.


text: Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our information technology environment.


text: Cybersecurity represents an important component of our overall approach to enterprise risk management ("ERM") and is one of the key risks identified for oversight by the Board through our annual ERM assessment. Our ERM approach generally, and our cybersecurity practices in particular, are based upon industry standards and implemented using managed security applications. We generally approach cybersecurity threats through a cross-functional approach which endeavors to: (i) prevent and mitigate cybersecurity threats to the Company; (ii) maintain the confidence of our customers, clients and business partners; (iii) preserve the confidentiality of our employee's information; and (iv) protect our IP. Vigilance: We maintain 24/7 cybersecurity threat operations designed to rapidly detect, contain and respond to cybersecurity threats and incidents.

companyName: CEVA INC

ticker: CEVA


text: Systems Safeguards: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats. These safeguards include firewalls, intrusion prevention and detection systems, anti-malware functionality, access controls and ongoing vulnerability assessments.


text: Third-Party Management: We screen vendors, service providers and other third parties that may gain access to our systems based on their expertise, reliability, reputation and industry credentials, and have implemented measures to further enable us to identify and oversee cybersecurity risks presented users of our systems.


text: All of our employees are trained at least annually on cybersecurity threats and our information security procedures, which reinforces our information security policies, standards and practices.


text: Incident Response Planning: We have established and continue to maintain an incident response plan that addresses our response to a cybersecurity incident.


text: We utilize a cross-functional approach to address the risk from cybersecurity threats, involving management personnel from the technology, operations, legal, risk management, internal audit and other key business functions, as well as including our board of directors in an ongoing dialogue regarding cybersecurity threats and incidents.


text: Our board of directors' oversight of cybersecurity risk management is supported by our Chief Financial Officer and Compliance Officer, who interacts directly with, and is provided relevant information by, our cybersecurity team. While our board of directors has the ultimate oversight responsibility over the management of cybersecurity risk, our audit committee reviews the risk management process relating to cybersecurity on a regular basis.


text: We evaluate the effectiveness of our cybersecurity threat risk management through the assessment and testing of our processes and practices. We periodically engage consultants, auditors and other third parties to perform assessments on our cybersecurity measures. The assessments include information security maturity evaluations, independent environmental security control reviews, operating effectiveness and penetration testing. We make adjustments to our cybersecurity processes and practices as necessary based on the information provided by the third-party assessments and reviews.


text: Our board of directors as a whole is responsible for overseeing the management of risks pertaining to cybersecurity threats. Our board periodically receives presentations and reports from the management team on information regarding the policies, processes and practices that we implement to address risks from cybersecurity threats including, for example, discussion of recent developments, evolving standards, third-party and independent reviews, the threat environment and technological trends. Additionally, to the extent we identify any cybersecurity incident that could pose a significant risk to the Company, the board will receive prompt and timely information regarding the incident and ongoing updates until such incidents have been addressed.


text: Our cybersecurity team is composed of the global head of Information Technology & Management Information Systems, the Chief Information Security Officer ("CISO") and deputy CISO. This cybersecurity team, along with internal security stakeholders, are the team members principally responsible for overseeing and implementing our cybersecurity risk management program. Our cybersecurity team members each possess 15-35 years of cybersecurity experience, with strong educational qualifications including post-secondary education, industry certifications and other relevant developmental training.


text: The cybersecurity team works collaboratively across the Company to implement customized programs designed to protect and respond to cybersecurity threats and to promptly respond to any cybersecurity incidents. To facilitate the success of this program, multi-disciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents in accordance with our incident response plan. Chief concerns are reported to our broader management team when appropriate.


text: We have not previously experienced any material cybersecurity incidents. In addition, cybersecurity threats have not materially affected, and we do not believe they are reasonably likely to affect, the Company, including our business strategy, results of operations, or financial condition.


text: At AvePoint, cybersecurity risk management is an important part of our overall risk management efforts. We have a policy of transparency regarding our data collection, use, retention and sharing practices, and it is our commitment to implement appropriate technical security measures to protect all AvePoint stakeholders and manage third party risk.

companyName: AvePoint, Inc.

ticker: AVPT


text: Our operations may, in some cases, involve the storage, transmission and other processing of customer data or information. Cyberattacks and other malicious internet-based activity continue to increase, and cloud-based platform providers of services are expected to continue to be targeted. Threats include traditional computer "hackers," malicious code (such as viruses and worms), phishing attacks, employee theft or misuse and denial-of-service attacks, and use of AI. We have experienced cyberattacks in the past, and although immaterial, there can be no guarantee that in the future such cyberattacks will not be material. We believe we are a particularly attractive target because of our prominence and scale, the types and volume of personal data and content on our systems, and the evolving nature of our products and services. We maintain an information security program that is comprised of policies and controls designed to mitigate cybersecurity risk. However, at any given time, we face known and unknown cybersecurity risks and threats that are not fully mitigated, and we continuously work to enhance our information security program and risk management efforts. We use a risk management framework based on applicable laws and regulations and informed by industry standards and industry-recognized practices, for managing cybersecurity risks within our products and services, infrastructure, and corporate resources. To identify and assess risks from cybersecurity threats, we evaluate a variety of developments including threat intelligence, first- and third-party vulnerabilities, evolving regulatory requirements, and observed cybersecurity incidents, among others. We regularly conduct risk assessments to evaluate the maturity and effectiveness of our systems and processes in addressing cybersecurity threats and to identify any areas for remediation and opportunities for enhancements. We also engage third-party security experts and consultants to assist with assessment and enhancement of our cybersecurity risk management processes, as well as benchmarking against industry practices. In addition, we maintain a privacy risk management program to assess privacy risks related to how we are collecting, using, sharing, and storing user data, which is subject to assessment by an independent, third-party privacy assessor. We have certified against, and demonstrated conformance to, the latest International Organization for Standardization's ("ISO") information security management system audit using the 27001:2022, 27701:2019, and 27017:2015 frameworks. Successfully achieving these three certifications demonstrates our prioritization of security and privacy for both us and our customers, and we believe shows that we have proper company-wide processes for managing operations, and maintaining people and information assets, information systems, and the associated processes that enable corporate operations. Our three ISO certifications add to the company's overall resiliency strategy and commitment to security for all customers, which includes other accreditations including SOC 2 Type II, compliance with HITRUST CSF v11.0.1., CSA STAR, IRAP and FedRAMP.


text: 33 Table of Contents Our privacy and security program dictates a governance structure whereby we: Regularly engage senior management on data privacy and security issues; Align policies, procedures, and technical controls to demonstrate our process and our commitment to our customers and users; Train each of our employees on all privacy and security expectations; Conduct regular phishing email simulations for employees and contractors with access to corporate email systems to enhance awareness and responsiveness to such possible threats; Maintain a robust cybersecurity incident response plan, which provides a framework for handling cybersecurity incidents based on, among other factors, the potential severity of the incident and facilitates cross-functional coordination across AvePoint; Periodically run tabletop exercises to simulate a response to a cybersecurity incident and use the findings to improve our processes and technologies; Maintain cybersecurity insurance and regularly review our policy and levels of coverage based on current risks; Monitor emerging data protection and cybersecurity laws, and implement changes to our processes, systems and offerings designed to comply, and through policy, practice and contract (as applicable) require employees, as well as third parties who provide services on our behalf, to treat customer information and data with care; Complete several cyber-specific audits per year; and Engage consultants and other third parties in connection with our cybersecurity practices.


text: Our internal audit function provides independent assessment and assurance on the overall operations of our cybersecurity and privacy programs and the supporting control frameworks. These processes support informed risk-based decision-making and prioritization of cybersecurity countermeasures and risk mitigation strategies. Our risk mitigation strategies include a broad variety of technical and operational measures, as well as annual cybersecurity and privacy training for all of our employees.


text: In addition, we maintain specific policies and practices governing our third -party security risks, including our third -party risk assessment (" TPRA ") process. Under our TPRA process, we gather information from certain third parties who contract with AvePoint and share or receive data, or have access to or integrate with our systems, in order to help us assess potential risks associated with their security controls. We also generally require third parties to maintain security controls to protect our confidential information and data, and to notify us of material data breaches that may impact our data.


text: Our Chief Risk, Privacy and Information Security Officer (" CISO ") leads the company's privacy, data protection and security program. An expert in cyber and data security trends, our CISO has over twenty years of experience in the data protection field, was a founding member of the Women Leading Privacy Advisory Board and former member of the Education Advisory Board for the International Association of Privacy Professionals (IAPP) and has been a finalist for the Women in IT Awards in the Security Leader of the Year category, included in the SIA Women in Security Power Forum 100, featured in Forbes, and named a Top Global CISO by Cyber Defense Magazine. including being featured in the "CSO Hall of Fame".


text: In addition, our CISO oversees teams across the company supporting our security and privacy functions of identify, prevent, detect, respond, and recover. These teams are comprised of personnel with a broad range of experience across the private and public sectors, the technology industry, and different geographic regions. Our cybersecurity teams monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents through a variety of technical and operational measures, and regularly report to our CISO. Our CISO reports directly to our Chief Executive Officer and is a member of the company's senior management team, and is responsible for identifying, assessing, and managing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures, and maintaining cybersecurity policies and procedures. Additionally, our CISO and Chief Compliance Officer regularly update our senior leadership team, our Nominating and Corporate Governance Committee, and the full Board, on the company's privacy and cybersecurity program, including privacy and cybersecurity risks, incidents, and mitigation strategies.


text: Disclosure of the Board ' s Roles and Responsibilities Our Board oversees risks from cybersecurity threats using a multi-faceted approach that involves the Nominating and Corporate Governance Committee and various executive roles. Additionally, our CISO and Chief Compliance Officer regularly report on cybersecurity matters to the Board, as discussed above.