text: The ISPEC provides comprehensive strategic guidance, coordination, and oversight of the Company's information security and privacy programs and governance, including the Cybersecurity Program, Data Privacy Program, Information Technology Policies, and data breach and cyber incident testing, plans, and operational response. The ISPEC meets quarterly and is co-chaired by the CIO and Assistant General Counsel, Legal, Chief Privacy Officer and Deputy Chief Compliance Officer. The ECC oversees key risk areas, which include IT and Cyber. The CIO is a key risk owner for the IT and cybersecurity domain and works with the ECC to effectively mitigate compliance risk within our functional regulatory area. This council meets quarterly and is chaired by the SVP General Counsel & Chief Compliance Officer and Assistant General Counsel, Legal, Chief Privacy Officer and Deputy Chief Compliance Officer. RADIUS RECYCLING, INC.


text: Cybersecurity represents an important component of our overall approach to risk management. Our information security risk management (ISRM) policies, standards and practices are integrated into our overall enterprise risk management (ERM) approach, and cybersecurity risks are one of the business risks that are subject to oversight by our Board of Directors. Our ISRM policies, standards and practices follow industry trends, which align with frameworks established by the National Institute of Standards and Technology. We approach cybersecurity threats through a cross-functional approach which endeavors to: (i) identify, prevent and mitigate cybersecurity threats to us; (ii) preserve the confidentiality, security and availability of the information that we collect and store to use in our business; (iii) protect our intellectual property; (iv) maintain the confidence of our customers, clients and business partners; and (v) provide appropriate public disclosure of cybersecurity risks and incidents when required.

companyName: GREENBRIER COMPANIES INC

ticker: GBX

secItem: Item 1C


text: Our cybersecurity program focuses on the following areas: • Vigilance – We maintain cybersecurity threat operations with the goal of proactively identifying, preventing and mitigating cybersecurity threats and responding to cybersecurity incidents in accordance with our established cybersecurity incident response procedure plan. We recognize that the sophistication of cyber-threats will continue to evolve as threat actors increase their use of artificial intelligence technologies. • Systems Safeguards – We implement layered systems safeguards to enable the protection of our information systems from cybersecurity threats. These safeguards include network security, vulnerability management, and threat detection. • Collaboration – We utilize collaboration mechanisms established with public and private entities, including intelligence and enforcement agencies, industry groups and third-party service providers, to identify, assess and respond to cybersecurity risks. • Third-Party Risk Management – We actively manage cybersecurity risks posed by third parties and their systems that could impact our operations. We monitor and assess the security posture of our third-party vendors. We require third-party service providers with access to sensitive information to maintain cybersecurity practices aligned with industry standards and applicable laws. In addition, we proactively monitor public information regarding our vendors for security incidents, investigate potential impacts, and take appropriate action to mitigate risk. • Training – We have implemented and maintain a comprehensive cybersecurity training program to educate personnel about evolving threats and reinforce security best practices. This program includes: i. Monthly phishing awareness campaigns with mandatory remedial training for those who fail. ii. Annual security and acceptable use awareness training.


text: iii. Targeted training for high-risk groups such as finance and accounting, including phishing email response checks, to proactively mitigate threats like business email compromise.


text: • Incident Response and Recovery Planning – We have established and maintain a cybersecurity incident response procedure plan that addresses our response to cybersecurity incidents and recovery from such incidents, and such plan is tested and evaluated periodically. • Communication, Coordination and Disclosure – We utilize a cross-functional approach to address the risk from cybersecurity threats, involving management personnel from our technology, operations, legal, risk management and other key business functions, as well as the members of the Audit Committee of the Board of Directors, in an ongoing dialogue regarding cybersecurity threats and incidents, while also implementing controls and procedures for the escalation of cybersecurity incidents pursuant to established thresholds so that decisions regarding the disclosure and reporting of such incidents can be made by management in a timely manner. We have established an Incident Response Committee to quickly organize and execute an effective, productive, timely and compliance-conscious response to cybersecurity threats and incidents, as well as coordinate among the cross-functional groups. • Governance – The Board of Directors' oversight of cybersecurity risk management is supported by the Audit Committee, which regularly interacts with our experienced Chief Information Security Officer (CISO), the Incident Response Committee, which is chaired by our SVP Administration, and other members of management.


text: We manage risks from cybersecurity threats through the assessment and testing of our processes and practices focused on evaluating the effectiveness of our cybersecurity measures. We engage third parties as appropriate to perform assessments of our cybersecurity measures. The results of such assessments and reviews are reported to the Audit Committee and the Board of Directors, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by the assessments, audits and reviews. We maintain cyber risk and related insurance policies as a measure of added protection.


text: The Board of Directors, in coordination with the Audit Committee, oversees the management of risks from cybersecurity threats, including the policies, standards, processes and practices that management implements to address risks from cybersecurity threats. The Audit Committee reviews cybersecurity on a quarterly basis. The Board of Directors and the Audit Committee each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including, for example, recent developments, evolving standards, vulnerability assessments, third-party reviews, the threat environment, technological trends and information security considerations arising with respect to our peers. The Board of Directors and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding such incident until it has been addressed. On a regular basis, the Board of Directors and the Audit Committee discuss our approach to cybersecurity risk management with the CISO and other cyber team members, as well as senior leadership.


text: The CISO is principally responsible for overseeing our cybersecurity risk management program, in partnership with other business leaders across the Company. The CISO works in coordination with senior leadership, which includes our Chief Executive Officer, Chief Financial Officer, Chief Information Officer and Chief Legal & Compliance Officer. The CISO has decades of experience in the cybersecurity and information security fields, including experience with both private and public companies and the military, as well as experience in the transportation and rail industry. In addition, the CISO has ISO 27001 Certification and completed W2CCA Cyber Combat Academy.


text: The CISO, in coordination with senior leadership, works collaboratively across the Company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents. To facilitate the success of this program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents in accordance with our cybersecurity incident response procedure plan. Through the ongoing communications from these teams, the CISO and senior leadership monitor the prevention, detection, mitigation and remediation of cybersecurity incidents in real time, and report such incidents to the Audit Committee when appropriate.


text: To date, we have not experienced any risks from cybersecurity threats or incidents that have materially affected us or are reasonably likely to materially affect us, our business strategy, results of operations, or financial condition.


text: The Company recognizes the critical importance of cybersecurity in safeguarding its operations, assets, and various stakeholders and acknowledges that such risks are becoming more complex and frequent. As part of its enterprise-level risk management assessment process, the Company has implemented a cybersecurity program to identify, mitigate, and respond to risks associated with cyber threats and to protect the confidentiality, integrity and availability of Company computer systems.

companyName: LINDSAY CORP

ticker: LNN


text: The aspects of the Company's risk management approach to cybersecurity include: • Annually reviewing and updating cybersecurity policies to ensure alignment with the latest industry standards and regulatory requirements. The specific aspects of the Company's program are informed by guidelines outlined in various accepted frameworks, including the Cybersecurity Framework ("CSF") issued by the National Institute of Standards and Technology Framework ("NIST"), an agency of the United States Department of Commerce. • Maintaining a dedicated cybersecurity team under the direction of the Company's Chief Information Officer ("CIO") that has expertise related to data and network security, data governance, and risk management. • Conducting vulnerability assessments to identify and mitigate potential security risks. These assessments include network scans, penetration testing, and security audits performed by internal resources or qualified third-party providers. • Requiring all employees to participate in cybersecurity training and awareness programs including annual cybersecurity training and monthly phishing campaigns. These programs educate employees on how to recognize and respond to cyber threats and develop best practices for maintaining a strong security culture. • Monitoring information channels from trusted security information sources to stay abreast of developing cybersecurity concerns that may affect the Company or its operations. • Reviewing the security protocols of new third-party service providers to ensure acceptable levels of security are documented and maintained. • Maintaining an incident response retainer with a respected cybersecurity firm to ensure timely response and forensic capabilities.


text: Despite the Company's efforts, cyber attacks, unauthorized access, security breaches, ransomware, social engineering attacks or other cyber incidents could materially affect the Company and disrupt its business. Potential consequences of a successful cyber attack or cybersecurity incident could include remediation costs, disruption of manufacturing capabilities, legal costs, increased cybersecurity protection costs, lost revenues, litigation and legal risks including governmental or regulatory enforcement actions, increased insurance premiums, reputational damage that adversely affects customer or investor confidence, and damage to the Company's competitiveness, stock price, and long-term shareholder value. While the Company is regularly exposed to such malicious threats, none of these threats, individually or in the aggregate of related occurrences, have materially affected the Company in the period covered by this report.


text: Incident Response Procedures The Company's cybersecurity incident response plan is a critical component of the overall cybersecurity strategy. This plan outlines the procedures and actions to be taken in the event of a cybersecurity incident to minimize impact and ensure a swift recovery. Key elements of the Company's incident response plan include: • Incident discovery and confirmation: the Company has established clear protocols for identifying and reporting suspected cybersecurity incidents. Employees are trained to recognize potential incidents and report them immediately to the Company's IT security team. • Incident assessment and classification: upon receiving a report of a potential incident, the Company's IT security team conducts a thorough assessment to determine the nature and severity of the incident. Incidents are classified based on their impact and risk level. • Containment and continuity: once an incident is confirmed, the Company takes immediate steps to contain and mitigate its impact. which may involve isolating affected systems, applying security patches, or implementing other remedial actions. • Eradication and recovery: after containment, the Company works to eradicate the root cause of the incident and restore affected systems to normal operation, which includes evicting threat actors, removing malware, repairing vulnerabilities, and validating system integrity. • Communication and reporting: the Company maintains clear communication channels to keep all relevant stakeholders informed throughout the incident response process, which includes internal communication with employees and external communication with customers, regulators, and other parties as necessary. • Post-incident review and improvement: following the resolution of an incident, the Company conducts a post-incident review to identify lessons learned and areas for improvement, which helps enhance incident response capabilities and prevent future incidents.


text: As part of its oversight responsibilities as it relates to the Company's overall risk management, the Company's Board of Directors has designated cybersecurity oversight as a full board responsibility. The Board of Directors is mindful to have members with cybersecurity expertise represented on the Board of Directors. The CIO provides monthly reports to the Board of Directors regarding cybersecurity related matters and presents cybersecurity updates to the full Board of Directors at each Board meeting. The Board of Directors also participates in regular training and educational efforts to stay current on relevant cybersecurity related topics.


text: The Company's CIO reports directly to the Company's CEO and is responsible for managing, designing, and implementing all aspects of the Company's day-to-day cybersecurity programs and initiatives. The CIO and the dedicated cybersecurity team have appropriate levels of expertise, certifications, and previous work experience to effectively develop and oversee the Company's cybersecurity efforts.


text: We have established security practices and safeguards designed to help identify and protect against intentional and unintentional misappropriation or corruption of our information technology systems, data, and operational continuity. We conduct risk assessments to identify potential cybersecurity threats, which include evaluating the likelihood and potential impact of these threats, identifying system and network vulnerabilities, and assessing the effectiveness of our existing controls. Upon identification and assessment of risks, we develop and implement what management believes to be appropriate measures in order to manage these risks, which may involve enhancing security controls, implementing new technologies, training employees, or changing business processes. We maintain change management processes, monitoring practices, and data protection measures designed to mitigate cybersecurity risks and regularly review our systems for potential threats. Such processes and practices to assess, identify, and manage cybersecurity incidents are integrated into our overall risk management processes.

companyName: S&W Seed Co

ticker: SANW


text: Our Chief Financial Officer, also acting as our Compliance Officer, is primarily responsible for assessing and managing our strategic risk exposures, including material risks from cybersecurity threats, with assistance from our IT staff, who oversee our cybersecurity processes on a day-to-day basis. Our Board is responsible for the oversight of management's efforts to address cybersecurity risks. Management updates the Board on an ongoing basis concerning any significant cybersecurity incidents or risk exposures that have come to management's attention during the conduct of their assessments, the steps management has taken to mitigate such exposures, and any changes to the processes of identifying, assessing, and monitoring cybersecurity threats.


text: For the fiscal year ended June 30, 2024, we did not identify any cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition.


text: Our cybersecurity program is designed to monitor and control cybersecurity risk exposure, response, mitigation and protect the confidentiality and integrity of our critical systems and information. Our cybersecurity policies and processes are fully integrated into the Company's Enterprise Risk Management program. Our cybersecurity program is based on industry recognized best practices, including the ISO 27001 Information Security, Cybersecurity and Privacy protection international best practice standard.

companyName: KURA SUSHI USA, INC.

ticker: KRUS


text: Our cybersecurity risk management program includes: • Ongoing risk assessments to help identify material cybersecurity risks to our critical systems and information by performing regular scans of our environment, assessing incident trends and engaging third parties to assess the effectiveness of our cybersecurity practices; • The use of external service providers, where appropriate, to monitor, identify, assess, test and remediate, or otherwise assist with aspects of our security controls; • Mandatory cybersecurity awareness training for employees and simulated phishing attacks; • A disaster recovery and business-continuity plan and controls designed to protect against business interruption, including the backing up of our critical systems; • A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents, internal reporting to management and the board of directors; • Cybersecurity insurance which is assessed annually; and • Risk management process for service providers, suppliers, and vendors.


text: Cybersecurity risks are monitored on an ongoing basis, and the security program and practices are adjusted as necessary. We are not currently aware of risks from known cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Our board of directors considers cybersecurity risk as part of its risk oversight function and oversees management's implementation of our cybersecurity risk management program, including the steps taken to monitor, minimize or control such risks or exposures.


text: The board of directors receives quarterly reports from management regarding the status of the cybersecurity program, current activities and planned projects. In addition, management will update the board of directors, as necessary, regarding any significant cybersecurity incidents that we may experience.


text: Our management team is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our external cybersecurity consultants. Our management team's cybersecurity risk management is led by our Vice President of IT, who has over 20 years of experience in both restaurant and technology sectors and has held technology leadership roles at major national restaurant companies.


text: Additional information on cybersecurity risks is discussed in Part I, Item 1A, "Risk Factors," under the heading "We rely significantly on information technology and cybersecurity, and any material failure, weakness, interruption or breach of security could prevent us from effectively operating our business."


text: We recognize the critical importance of effective cyber risk management and response strategies in today's digital landscape. As part of our comprehensive risk management framework, we have developed a cyber crisis and data breach response plan for identifying, assessing, and managing material risks arising from cybersecurity incidents, including those arising from third-party service providers. These engagements include routine audits, threat assessments, and consultations aimed at enhancing our security measures. We have incorporated cybersecurity risk management within our comprehensive risk management framework to cultivate responsiveness and a corporate culture that prioritizes cybersecurity risk management. Our cyber risk management team works closely with stakeholders across corporate functions to consistently assess and mitigate cybersecurity risks, aligning with our business goals and operational requirements.

companyName: BrightView Holdings, Inc.

ticker: BV


text: We utilize a range of external experts, including cybersecurity consultants to assist in evaluating and testing our risk management systems, particularly where advanced or specialized expertise may be required.


text: We acknowledge that there are risks associated with third-party service providers that have access to our systems and data, we have implemented processes to oversee and manage these risks. We oversee and identify material risks from cybersecurity threats associated with the use of third-party service providers by reviewing service organization controls reports for key outsourced systems. We also conduct security assessments of certain third-party providers before engagement and monitor such providers to confirm compliance with industry accepted cybersecurity standards and practices. This approach is designed to reduce risks related to data breaches, operational disruptions, or other security incidents originating from third-parties.


text: We are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. However, because of the inherent nature of cybersecurity threats and the evolution of such threats over time, the Company's processes, oversight and risk management cannot provide absolute assurance that a cybersecurity threat will not have a material effect on the Company in the future.


text: Cybersecurity governance is a priority for both our Board of Directors and management. The Board has delegated primary oversight of cybersecurity risks to the Audit Committee. The Audit Committee monitors the cybersecurity risk management and cyber control functions, including external security audits. The Audit committee receives periodic updates from experienced senior management of the Company's cyber risk management team knowledgeable about assessing and managing cyber risks, including, as appropriate, updates on the prevention, detection, mitigation, and remediation of cyber incidents.


text: The Company's Chief Information Officer has been serving in this role for the Company since 2013 and has over 30 years of experience in various information security and related technology roles. The Chief Information Officer oversees the information technology and information security functions of the Company which includes our cyber risk management team.


text: The Chief Legal Officer acts as the Company's Data Breach Coordinator and leads our Cyber Crisis and Data Breach Response Committee (the "Committee") which consists of the Company's Chief Information Officer, Chief Financial Officer and Chief Accounting Officer. Cybersecurity incidents that may significantly impact the confidentiality, integrity, or availability of the Company's data or the reliability of the Company's systems or networks are reported to the Committee. The Committee assesses the materiality of each incident, which is made using both quantitative and qualitative analyses to determine an incident's immediate and reasonably likely future impacts. Such cybersecurity incidents are also reported to the Audit Committee. The Company's Data Governance Committee has oversight of that how the Company's data is handled and shared with third parties and is comprised of the Company's Chief Information Officer, Chief Legal Officer, Chief Human Resources, Chief Accounting Officer, Senior Vice President of Business Shared Services and Chief Audit Executive.


text: The Company has a cybersecurity training program that requires all employees with access to the Company's networks to participate in regular and mandatory training on how to be aware of, and help defend against, cybersecurity risks. Also, the Company regularly tests the efficacy of its training efforts as well as its systems to assess vulnerabilities to cybersecurity risks, including tabletop incident response exercises.


text: Annually we conduct an Enterprise Risk Assessment during which we identify and quantify risks, including cybersecurity risks, which could enhance or impede the Company's ability to achieve current or future strategic objectives. The conclusions of the annual Enterprise Risk Assessment are shared with the Audit Committee.


text: We are a special purpose acquisition company with no business operations. Since the IPO Closing Date, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not believe that we currently face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if any. We have not encountered any cybersecurity incidents since the IPO Closing Date.

companyName: Gores Holdings IX, Inc.


text: Management of material risks from cybersecurity threats is integrated into the Company's overall risk management processes and is monitored as an enterprise risk. The Company's Board of Directors (the "Board"), with the input of management, oversees the Company's internal controls and processes, including internal controls designed to assess, identify, and manage material risks from cybersecurity threats.

companyName: MARINEMAX INC

ticker: HZO


text: Our comprehensive cybersecurity program includes, but is not limited to, standards and procedures for vulnerability management, user training, security assessments and testing, business continuity planning, encryption of sensitive data, physical security, user access controls, vendor risk management, teleworking, user device management and proactive systems, data and activity monitoring, and incident response. A limited scope of third-party service providers are involved in supporting our business and, where appropriate, we have established standards and procedures to ensure commercial best practices, audit, risk management, and strict contractual controls are in place and followed. Comprehensive contingency, recovery, and continuity plans are in place to ensure the ongoing provision of services to customers in the event of a cybersecurity incident.


text: Our Executive Vice President and Chief Digital Officer, (the "CDO"), Shawn C. Berg, is responsible for managing the Company's cybersecurity risk and cybersecurity program. Shawn Berg has served as Chief Digital Officer since April 2019 overseeing the Company's Technology, Marketing, and Digital Business operations. Mr. Berg was appointed as an executive officer of MarineMax by our Board in October 2022. Previously he served as Vice President of Technology after joining MarineMax in 2017. Mr. Berg has over 30 years of experience, including multiple officer-level positions, of invaluable experience in information technology and security.


text: Our Technology Group monitors material risks over time and updates the Company's mitigation measures as appropriate. The Technology Group also regularly reports to the CDO and other key executives, as identified in the incident response plan, on the status of material risks, mitigation measures, and incidents related to such risks.


text: The CDO provides the Board with ongoing security updates, which include notable changes to program plans, changes to the risk environment, information regarding material incidents that may have occurred, reports on recent assessments of our security controls, and details regarding forward-looking plans and strategies to mitigate cyber risk.


text: The Company has been subject to cybersecurity threats in the past, including the Incident. We believe the impacts of the Incident were not material to MarineMax's financial condition or results of operations. In addition, as of the date of this report, the Company is not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.


text: Notwithstanding our vigilant cybersecurity measures, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. For further discussion of the risks associated with cybersecurity incidents, see the cybersecurity risk factor in Item 1A. Risk Factor in this report, titled "Increased cybersecurity requirements, threats and more sophisticated and targeted computer crime could pose a risk to our systems, networks, data and our third-party service providers. Our business operations could be negatively impacted by an outage or breach of our informational technology systems or a cybersecurity event".


text: Our cybersecurity risk management strategy is designed to detect, evaluate, and manage risks from cybersecurity threats and incidents. Our program is intended to identify cybersecurity risks facing our organization and inform our risk-based approach to cybersecurity preparedness and incident response procedures.

companyName: UNIFIRST CORP

ticker: UNF


text: Our cybersecurity risk management program is supported by our third-party vendors and service providers, and includes, but is not limited to, periodic penetration testing and endpoint detection, and automated tools to monitor our network and systems to detect vulnerabilities or unusual activity that could lead to unauthorized access to our systems or data. We conduct assessments, as appropriate, of critical third-party service providers, which generally include a cybersecurity questionnaire and a review of security assessments and certifications. We also provide cybersecurity awareness training to employees with access to our network.


text: We also have a policy for responding to and mitigating cybersecurity incidents. Our incident response procedures were overseen until recently by our Chief Information Officer ("CIO"). In connection with the upcoming retirement of our CIO, we recently hired a new Chief Information & Technology Officer ("CITO") who oversees our incident response procedures. Our incident response procedures are reviewed and updated periodically.


text: We have not identified cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, like other companies in our industry, we and our third-party vendors have from time to time experienced threats that could affect our information or systems. For more information, please see the Risk Factor titled "If our information technology systems suffer interruptions or failures, including as a result of cyber-attacks, our business operations could be disrupted or other material adverse impacts on our business could result."


text: Our CITO, who reports to our Chief Financial Officer, is responsible for leading our information security team and overseeing the Company's cybersecurity risk management efforts. Our CITO has significant experience as a chief technology officer.


text: Our cybersecurity risk management program is overseen by our Board of Directors. As was the case with our CIO, members of the Board of Directors and the Audit Committee will periodically meet with our CITO to discuss material cybersecurity risks facing our organization and significant changes or updates to our cybersecurity processes. The full Board of Directors receives a cybersecurity risk management update from management generally on a quarterly basis.


text: Risk Management Strategies Our Company is committed to protecting the privacy and security of customer information and the integrity of our information technology systems. We have developed and implemented a cybersecurity risk management program ("Cybersecurity Program") that is tailored to address specific risks in the retail industry, using a flexible approach informed by our deep understanding of attacker methodologies, targeted assets, and industry best practices. The Cybersecurity Program is intended to protect the confidentiality, availability, and integrity of our information and critical systems by continually monitoring, assessing, identifying, and mitigating cybersecurity risks. The Cybersecurity Program is part of our integrated risk management process and includes, but is not limited to, the following features: • Regularly simulated phishing attacks and comprehensive cybersecurity training for all employees, with special focus on high-risk individuals using a new security awareness platform. • Cybersecurity insurance coverage to mitigate financial impacts from potential cyber incidents. • Endpoint detection and response technologies (EDR) to monitor systems continuously for malicious activity. • Behavior analytics tools that help track normal behavior patterns and quickly detect any anomalies. • Cloud security measures, offering comprehensive protection and vulnerability management for our cloud environments. • Digital risk protection that includes brand protection, social media monitoring, dark web surveillance, and proactive response to phishing, fraud, and account takeovers. • Zero-day vulnerability management, with third-party monitoring to prioritize critical vulnerabilities based on real-time risk assessments and active exploitation. • Comprehensive vendor risk management program, including penetration tests, Service Organization Control ("SOC") reports, and security architecture reviews, especially for third parties managing sensitive data or accessing internal systems.

companyName: Sally Beauty Holdings, Inc.

ticker: SBH


text: In addition, we have a written cybersecurity incident response plan ("Response Plan") that is reviewed and updated, if necessary, at least annually. The Response Plan includes a cross-functional incident response team comprised of various key executive representatives from different departments in our organization, such as our Chief Information Security Officer ("CISO") and General Counsel, that are tasked with assessing the scope, nature, and potential impact of incidents. Findings are reported to the Chief Executive Officer ("CEO"), Chief Financial Officer ("CFO"), our Board and the Disclosure Committee, the latter of which is comprised of senior representatives from our finance, accounting, internal audit and legal departments under the supervision of the CEO and CFO.


text: We also regularly engage third parties to perform assessments on the Cybersecurity Program, including an annual self-assessed risk review facilitated by an independent third party, where we evaluate various cybersecurity domains and control areas and benchmark our program against industry peers. Additionally, we conduct annual third-party penetration tests focused on our highest-risk areas globally, providing insights into potential vulnerabilities. These assessments are supplemented by red team exercises and real-world incident response simulations to continually improve our security posture.


text: From time to time, we experience cybersecurity threats and incidents. As of the date of this Annual Report, we have not identified any instances that have occurred in the current year, or in prior years, that would have a material impact on our Company or on our results of operation, or financial position. For more information related to our cybersecurity risks, see Item 1A. "Risk Factors–Regulatory, Legal and Cybersecurity Risks" within this annual report.


text: Our Board understands the critical importance of managing evolving risks associated with cybersecurity threats. The Board has responsibility for overseeing risks related to the cybersecurity threat landscape, including data protection and security breach readiness. Our CISO reports directly to the Chief Information Officer and is responsible for the operation of our Cybersecurity Program. Our CISO brings over 26 years of experience in information security, including the last 12 years as a Chief Information Security Officer in the retail industry. With a diverse background in both industry and consulting, our CISO has led major security programs, implementing practical strategies to protect critical data and systems.


text: On at least a quarterly basis, the CISO delivers a detailed report to the full Board — including Board member Erin Nealy Cox — on data protection and cybersecurity matters. Topics covered by these reports include, but are not limited to, risk identification and management strategies, cybersecurity strategy and governance structure, consumer data protection, the Company's ongoing risk mitigation activities, learnings from data security incidents of peer companies, results of third-party assessments and testing, updates on annual associate training and other specific training initiatives. Ms. Nealy Cox is an independent member of our Board, a cybersecurity expert and a former federal prosecutor with deep expertise in information security issues and board governance. She is a partner at Kirkland & Ellis LLP in its Government, Regulatory and Internal Investigations Group, and was executive managing director at Stroz Friedberg, a cybersecurity and investigation consulting firm, where she ultimately led the firm's incident response business, from 2003-2016. In 2017, she served briefly as senior advisor to McKinsey & Company in the firm's cybersecurity and risk practice.


text: We are subject to various cybersecurity risks in connection with our business. For more information on our cybersecurity related risks, see the section entitled "Risks Related to Our Business Operations and Industry" in Item 1A of this Annual Report.

companyName: PTC INC.

ticker: PTC


text: PTC takes a holistic, multi-layered approach to cybersecurity and privacy that combines traditional Defense-in-Depth methods with next-generation Zero Trust principles. In today's globally interconnected world, we consider every entry point on the attack surface critical, and we aim to secure the points under our control. In developing our cybersecurity risk management program, we are informed by industry benchmarks and standards, including the cybersecurity framework created by the National Institute of Standards and Technology ("NIST"). We also have various security-related certifications and authorizations, including ISO 27001, SOC 2 Type II and FedRAMP, for certain of our products and services.


text: People. PTC recognizes that technology alone cannot mitigate all security threats, so we focus on developing our most critical resource: our people. Security is the responsibility of everyone employed by PTC and is independent of departmental affiliation. PTC's corporate cybersecurity awareness activities are combined with enterprise-wide and department-specific tools and mandatory employee training, providing everyone employed by PTC with the knowledge and resources to support our efforts to mitigate security threats.


text: An educated workforce needs a governance framework to guide and monitor its activities. PTC has processes and policies in place to try to anticipate security risks and facilitate compliance with applicable contractual obligations, regulations and standards, as well as address any incidents or violations. PTC focuses on continuous improvement and is constantly maturing its processes to keep pace with the rapidly evolving cybersecurity threat landscape.


text: Technology. PTC seeks to automate these processes and remove the potential for human error to the extent feasible by implementing technology solutions. From fundamental IT security to development of our software products and keeping our customers' data safe in the cloud, PTC aims to maintain a secure infrastructure that is continuously monitored for possible threats.


text: These three key elements of people, process, and technology are tightly interwoven to support our aim to secure our environments and data.


text: Cybersecurity is a risk area with oversight at the highest levels of the organization, including the Executive and Board Level. The overall operational program is led by the Cybersecurity Strategy Council, a cross-functional team of executives and subject matter experts, including our Chief Product Security Officer, Chief Information Security Officer and Chief Compliance Officer. The Cybersecurity Strategy Council oversees a "Three Lines Model" of Operations, Risk Monitoring and Oversight, and Audit, to effectively address cybersecurity, risk management and control. All Cybersecurity, Risk and Internal Audit functions report to the PTC Executive Leadership Team.


text: PTC's Cybersecurity Program is supported by robust processes and procedures at all levels. Our matrixed cybersecurity organization is governed by industry-standard frameworks, and to ensure that they are executed, we involve the Executive Leadership Team, the Cybersecurity Strategy Council, and business unit security leads and cybersecurity analysts across the enterprise. We provide regular updates on our cybersecurity strategic plans, programs, and initiatives, and vulnerabilities and any applicable remediation efforts to the Cybersecurity Committee of the Board of Directors at its four regularly scheduled meetings per year. Our Incident Response Plans provide for notice, and continued updates, to the Cybersecurity Committee of applicable incidents on a timely basis. Ongoing program assessments are performed to monitor progress and identify opportunities for growth.


text: PTC conducts an annual cybersecurity maturity assessment. Periodically, we engage a third-party security consulting firm to conduct an Enterprise Security Maturity Assessment. This independent assessment provides a mechanism to benchmark our current risk profile and enables us to measure progress as we make program improvements. Identified cybersecurity risks are reviewed by the Cybersecurity Strategy Council, which ensures that risk tolerances are established and used to appropriately manage risks.


text: Third-Party Vendor Risk Management Our Vendor Risk Management (VRM) program supports PTC in meeting its cybersecurity, privacy, regulatory and compliance obligations and managing risk associated with third-party vendors who have access to PTC IT systems and data. Prior to outsourcing or allowing third-party access to PTC or customer systems, IP, or data; risks associated with such activity are clearly identified and documented. The process of selecting a third-party vendor includes due diligence of the vendor service or product in question. Third-party companies using PTC facilities or accessing PTC's IT Systems are subject to PTC's VRM review and are required to demonstrate that proper security measures are in place before they have access to any PTC IT systems or data. All such vendors are to be approved by PTC's VRM process and contractually bound to maintain appropriate cybersecurity technical and organization measures and to protect PTC's data to which they may have access.


text: Incident Response PTC maintains a formal Cybersecurity Incident Response Policy to address cybersecurity incidents. The Policy is tested on a regular basis, including a continuous improvement program involving periodic tabletop exercises. Cybersecurity incident handling is managed by individual organizations with cybersecurity responsibility and monitored/guided by applicable corporate functions. All Cybersecurity Incident Response Plans under the Policy are based on industry standards, such as the NIST Computer Security Incident Handling Guide – Special Publication 800-61.


text: Our Risks from Cybersecurity Threats Our Cybersecurity Program is overseen by executives on our Executive Leadership Team and managed by our Cybersecurity Strategy Council, including our Senior Vice President, Chief Information Security Officer (CISO), who reports to our Executive Vice President, Chief Digital Officer (CDO). Our CISO is responsible for day-to-day risk management activities, including staying informed about and monitoring prevention, detection, mitigation, and remediation efforts through regular communication and reporting from professionals in the information security team, and the use of technological tools and software. Our CDO is responsible for our broader IT program, which includes PTC's ability to remediate and recover from a cybersecurity incident while reducing impacts to the business and operations. Our CDO and CISO regularly report directly to the Cybersecurity Committee of the Board of Directors on our Cybersecurity Program and efforts to prevent, detect, mitigate, and remediate issues. In addition, we have an escalation process in place to inform senior management and the Cybersecurity Committee and the Board of Directors of material issues.


text: Management Experience Our CDO and CISO have extensive experience assessing and managing cybersecurity programs and cybersecurity risk. Our CDO joined PTC as Chief Digital Officer in January 2022 and is responsible for PTC's global information technology (IT) team, overseeing PTC's digital infrastructure and working with business leaders to guide PTC's digital process optimization strategy. He has more than two decades of IT and operations leadership. Before joining PTC, he served as Global Vice President and Chief Information Officer for Avaya, where he led a globally-dispersed team of 1,200 IT professionals to support the entire global Avaya enterprise. Prior to Avaya, he held technology leadership roles at Arise Virtual Solutions Inc., Oracle, and Colorado College.


text: Our CISO joined PTC as Cyber Information Security Officer in April 2022 and, before joining PTC, was the Vice President, Information Technology, North America and Europe for Alorica, where he led Alorica's transformation to a secure endpoint architecture for 90,000 global remote and hybrid employees.


text: Ashland recognizes the importance of cybersecurity in safeguarding sensitive information and maintaining operational integrity. To that end, Ashland maintains an information security program as part of its overall Enterprise Risk Management ("ERM") program. The Company's information security program includes an incident response plan, which has been reviewed by third-party consultants and aligns with the National Institute of Standards and Technology ("NIST") Cybersecurity Framework 2.0. The information security program, led by the Company's Vice President of Cyber Security, is designed to provide a framework for assessing, identifying, managing, mitigating and responding to cybersecurity threats and incidents and to facilitate cross-functional coordination within Ashland.

companyName: ASHLAND INC.

ticker: ASH


text: Ashland's information security program also includes policies and processes that are designed to provide visibility and information about the identification, assessment, and management of critical risks and management's risk mitigation strategies. This includes the use of a 24/7 Security Operations Center as well as an in-house, dedicated threat hunting team. Additional safeguards also include employee training and awareness programs around phishing, malware, and other cybersecurity risks. In addition, the Company conducts periodic testing of software, hardware, defensive capabilities, and other information security systems and regularly engages consultants and other expert third parties to assist the Company in the identification and assessment of risks.


text: Ashland also maintains a similar risk-based approach to its third-party vendor management program including identifying and overseeing cybersecurity risks that such third parties may present. As part of this program, the Company, imposes additional scrutiny for vendors that may handle personally identifiable information (PII) data or trade secrets.


text: As of the date of this Annual Report on Form 10-K, the Company is not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect its business, results of operations or financial condition. However, despite the Company's best efforts, it cannot eliminate all risks from cybersecurity threats or provide assurances that undetected cybersecurity incidents have not occurred. See the "Risk Factors" in Item 1A of this Annual Report on Form 10-K for further information.


text: Ashland's information security program is led by the Company's Vice President of Cyber Security who is a Certified Information Systems Security Professional (CISSP) with more than 30 years of experience in information technology and 12 years of experience serving in a chief information security officer role or top executive leader in cyber. Our Vice President of Cyber Security is primarily responsible for integrating cybersecurity risk considerations into the Company's overall risk management strategy. The Vice President of Cyber Security also holds a master's in business administration and a Bachelor of Science degree in Computer Science and Engineering. In addition, other members of the Company's information security team also have significant experience in information security.


text: As noted above, management of Ashland's cybersecurity risks is part of the Company's overall ERM program, which is overseen by the Board. The Board's Audit Committee has primary responsibility for the oversight of the Company's information and cybersecurity risks and programs established to manage such risks. The Audit Committee fulfills this oversight responsibility through receiving regular (and as needed) reports and updates from the Company's Vice President of Cyber Security and Ashland's Board also receives periodic reports updates from the Vice President of Cyber Security and the Audit Committee regarding information and cybersecurity matters.


text: Surmodics has adopted the National Institute of Standards and Technology ("NIST") Cybersecurity Framework as the basis for our approach to assessing, identifying, and managing material risks from cybersecurity threats. Using a nationally recognized vendor partner, we conduct yearly cybersecurity assessments (including policy and procedures) and penetration testing based on the NIST Cybersecurity Framework and principles. From the assessment results, we create a roadmap and prioritize it to address any noted deficiencies with our identification, protection, detection, response and recovery functions. This roadmap is used as a basis for our yearly cybersecurity planning initiatives to continually improve our systems, tools, architecture, training campaigns, monitoring and policies.

companyName: SURMODICS INC

ticker: SRDX


text: Also using a nationally recognized vendor partner, we have continuous (24x7x365) monitoring of our cloud solutions, perimeter and internal networks in addition to sharing of threat intelligence and remediation steps. Threat intelligence is evaluated, prioritized, and remediated on a continual basis throughout the year.


text: With the help and guidance of a vendor partner, we conduct quarterly end-user training campaigns designed to educate our end-user community on the social engineering methods used by sources of cybersecurity threats. In addition, monthly security updates are provided to the end-user community with information on current threats and general cybersecurity information.


text: On an annual basis, we collaborate with the third-party consulting firm that performs internal audit services for us to conduct a risk assessment of information systems controls for managing changes, operations, security and system development life cycles. In addition, we review System and Organization Controls ("SOC") 1 or SOC 1 Type 2 reports for third-party service providers deemed significant to our environment. We perform the risk assessment and review of service providers in connection with Management's annual assessments of the effectiveness of internal control over financial reporting. They serve as the basis for developing an internal audit plan to test information systems controls as they relate to the effectiveness of internal control over financial reporting. The results of the internal audit conducted under that audit plan are reviewed by the Audit Committee of the Board of Directors (the "Audit Committee").


text: For any vendors providing or supporting critical business information systems, we require confidentiality provisions as part of a services agreement defining our business relationship and our requirements for protecting our data.


text: We maintain a security incident response plan that designates an incident response team comprised of information technology leadership and cybersecurity personnel as well as relevant third-party service providers. The objective of the plan is to provide for the timely diagnosis and mitigation of cyber events. The incident response team, in conjunction with the Company's legal counsel, is responsible for determining whether a cybersecurity incident is material and requires reporting to our cyber insurance carrier and/or reporting pursuant to the disclosure requirement of the SEC.


text: To date of this Annual Report on Form 10-K, to the actual knowledge of the executive officers of the Company, no risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company. However, we are subject to ongoing risks from cybersecurity threats that could materially affect us, including our business and reputation, as further described in Part I, Item 1A, "Risk Factors" of this Annual Report on Form 10-K.


text: Our Board of Directors addresses our cybersecurity risk management as part of its general oversight function. The Audit Committee is responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: The Senior Director of Information Technology, in collaboration with our Cybersecurity Analyst, is responsible for setting the strategic direction and priorities for information security, coordination of enterprise-wide compliance with information security policies and procedures, as well as day-to-day information security management. The Cybersecurity Analyst role reports directly to the Senior Director of Information Technology. The Senior Director of Information Technology has a 34 years of information technology experience, including with cyber threats.


text: As necessary, but not less than once per year, the Senior Director of Information Technology makes a presentation on cyber threats and the Company's efforts to mitigate them to the Company's Chief Executive Officer, Chief Financial Officer, and the Audit Committee. In addition, the results of annual internal audits of the effectiveness of internal control over financial reporting, including relevant information systems, are reviewed by the Audit Committee.


text: As noted in Part I, Item IA, Risk Factors, Cabot recognizes that the threat of cybersecurity breaches may create significant risks for the Company. Accordingly, we have taken measures to protect Company data and the continuing operation of our information technology and communications systems. Our cybersecurity program includes information technology ("IT") policies and standards and an IT risk management program. Our cybersecurity risk management program leverages standards established by the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, which provides guidance to organizations on how to identify, prevent, detect, respond and recover from cybersecurity threats.

companyName: CABOT CORP

ticker: CBT


text: Further, cybersecurity risk is integrated into our enterprise risk management ("ERM") approach and is among the core enterprise risks that are subject to oversight by the Board, as described below, acting through the Audit Committee. We use several tools and controls designed to manage IT risk, including, but not limited to, controls for the management of privileged access, anti-malware tools, simulated email phishing attacks, and other email security tools intended to detect and prevent intrusions as well as monitor risks. Cabot employees have access to formal IT policies that define and clarify expected behaviors with respect to IT resources in various areas. We have a Cyber Incident Response Plan, which establishes procedures to prepare for and respond to a variety of cyber incidents, and engage in response planning, simulations, trainings, tabletop exercises, and other efforts to prepare for any incidents should they occur.


text: We periodically engage assessors, consultants, auditors and other third parties to assess our cybersecurity programs, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. These assessments provide insight for areas of future improvement in risk mitigation and further program development. In addition, we rely on third parties for various business functions and oversee such third-party service providers by conducting vendor diligence upon onboarding as well as ongoing monitoring.


text: Governance and Oversight Management Oversight in Cybersecurity Governance Cabot's Cyber Risk Steering Committee is responsible for review and oversight of the Company's cybersecurity programs and risk assessment as well as the strategic direction of the program to address evolving risks. Bart Kalkstein, an Executive Vice President of Cabot and a member of Cabot's Management Executive Committee, is a member of the Steering Committee and has executive responsibility for Digital matters. He is supported by our Chief Digital Information Officer (the "CDIO") and our Senior Director of Digital Security (the "SDDS"). The SDDS is the member of the Company's management principally responsible for overseeing the Company's cybersecurity risk management programs in partnership with business and functional leaders across the Company as well as a managed security service provider that provides threat intelligence, global infrastructure monitoring and threat detection and response to cyber events. The SDDS has held various positions within Cabot's IT department over her approximately 30-year tenure with the Company, has an educational background in Information Systems and contributes technical expertise to the Company's management team.


text: We have established a process to assess the nature, scope and timing of a cyber incident and, as appropriate, communicate the facts of an incident to management and the Board of Directors and, as appropriate, investors. In the event of a cybersecurity incident, the incident response team is responsible for notifying senior management in a timely manner, to the extent that the facts and circumstances of a particular incident warrant such notification. If it is determined that the event is material to the Company, the matter will be escalated to the Board. For material incidents, the Company will provide information regarding the nature and scope of the incident to investors in compliance with SEC regulations.


text: Board of Directors Oversight in Cybersecurity Governance Cabot's Board of Directors oversees the Company's cybersecurity program primarily through its Audit Committee, which comprises independent directors. Company executives along with external and internal cybersecurity personnel update the Audit Committee at least quarterly on risks related to cybersecurity and the steps taken to monitor and control risk exposure. Additionally, the results of periodic assessments of the Company's cybersecurity programs, described above, are communicated to the Audit Committee upon completion. Relevant matters are also reviewed with the full Board on at least an annual basis.


text: As of the date of this report, we have not experienced a cybersecurity incident that resulted in a material effect on our business strategy, results of operations, or financial condition. Despite our efforts, we cannot guarantee that our cybersecurity safeguards will prevent breaches or breakdowns of our or our third-party service providers' information technology systems, particularly in the face of continually evolving cybersecurity threats and increasingly sophisticated threat actors. A cybersecurity incident may materially affect our business, results of operations or financial condition, including where such an incident results in reputational, competitive or business harm or damage to our brand, lost sales, physical damage to facilities, physical harm to individuals, reduced demand, loss of intellectual property rights, significant costs or the Company being subject to government investigations, litigation, fines or damages. For additional information, see Part I, Item 1A, "Risk Factors—Operational Risks—Information technology systems failures, data security breaches, cybersecurity attacks or network disruptions have harmed us in the past and could compromise our information, disrupt our operations and expose us to liability, which may adversely impact our operations."


text: To prevent, detect and respond to information security threats, the Sponsor maintains a cyber risk management program. The program is supervised by an in-house dedicated Chief Information Security Officer ("CISO"), with over 15 years of experience in financial services risk management, whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. The Enterprise Risk Committee ("ERC"), which includes members of management of the Sponsor, receives regular reports from the CISO on, among other things, the Sponsor's cyber risks and threats, the status of projects to strengthen the Sponsor's information security systems, assessments of the Sponsor's security program and the emerging threat landscape.

companyName: Grayscale Stellar Lumens Trust (XLM)

ticker: GXLM


text: The CISO updates the ERC and the Board quarterly. These regular reports include the Sponsor's performance preparing for, preventing, detecting, responding to, and recovering from, cyber incidents. The CISO also promptly informs and updates the ERC and the Board of the Sponsor about any information security incidents that may pose a material risk to the Sponsor. The Sponsor contracts an independent third party to conduct a full cyber risk assessment annually, and the results of those assessments are reported to the ERC and the Board. Material outcomes from any penetration testing, vulnerability scanning, and business continuity or disaster recovery testing are additionally reported to the ERC and Board.


text: The Sponsor's Security Awareness Program includes training that reinforces the Sponsor's Information Security policies, standards, and practices, and the expectation that employees will comply with these policies. The Security Awareness Program engages personnel through training on how to identify potential cybersecurity risks and protect the Sponsor's resources and information. This training is mandatory for all employees upon onboarding at the firm and again annually, and it is supplemented by firmwide training and testing initiatives, including periodic phishing tests.


text: The Sponsor administers a Third-Party Risk Management Program at the firm to identify, assess and oversee the risk associated with service providers and third parties involved in the supply chain. Third parties are risk-rated and must adhere to additional security diligence requirements administered with oversight from the CISO according to risk, including cybersecurity diligence questionnaires, evidence validation, SOC report reviews, and/or on-site assessments. Material changes to the program, new, or worsening security risks associated with third parties are reported to the ERC at least quarterly.


text: There have not been any breaches at the Sponsor or the Trust during the year ended September 30, 2024. However, even though we take steps to employ reasonable cybersecurity efforts, not every cybersecurity incident can be prevented or detected. Therefore, while we believe there are currently no risks from any potential cybersecurity threat or cybersecurity incident that are reasonably likely to have a material effect on our results of operations or financial condition, the likelihood or severity of such risks are difficult to predict.


companyName: Grayscale Horizen Trust (ZEN)

ticker: HZEN


text: Cyber Risk Management and Strategy We recognize the importance of assessing, identifying, and managing risks from cybersecurity threats. We have implemented a cybersecurity risk management program in accordance with our risk profile, which is informed by, and incorporates, elements of recognized industry standards. We leverage the support of third-party information technology and security providers, including for cybersecurity audits and risk assessments. We implement technical controls, such as multi-factor authentication and we deploy cybersecurity tools through a leading third-party cybersecurity firm to protect our systems from cybersecurity related risks. We have an enterprise risk management program and we maintain written information security policies, including an incident response plan, which is designed to establish our processes for identifying, responding to, and recovering from cybersecurity incidents. We test this incident response plan on an annual basis. Finally, we have implemented a process to assess and review the cybersecurity practices of certain third-party vendors and service providers, including through the use of vendor security questionnaires. We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, like other companies in our industry, we and our third-party vendors may, from time to time, experience threats and security incidents that could affect our information or systems. For more information, please see Item 1A - Risk Factors.

companyName: Cerence Inc.

ticker: CRNC


text: Related to Cybersecurity Risks Our cybersecurity risk management program is managed by our Information Security Management Committee. Led by our Chief Information Security Officer ("CISO"), the Information Security Management Committee is made up of cross-functional members of company management and works closely with our third-party information technology and security providers to develop and implement our cybersecurity strategy. Our CISO is responsible for the day-to-day oversight of the assessment and management of cybersecurity risks. The individual who is currently in this role has over 20 years of experience in information security. Our audit committee has oversight over cybersecurity risks. The audit committee reviews the enterprise risk management program quarterly, which includes the cybersecurity risk management program and any identified cybersecurity risks. With the input of the Information Security Management Committee and our information technology providers, the CISO regularly reports to the audit committee on our cybersecurity risk management process, including updates related to security testing, assessments, cyber risk and related cyber strategy, as applicable. In addition, the CISO makes annual cybersecurity reports to our board of directors.


text: The Company has processes in place to assess, identify, and manage material risks from cybersecurity threats. The Company's business is dependent on the communications and information systems of the Adviser and other third-party service providers. The Adviser manages the Company's day-to-day operations and has implemented a cybersecurity program that applies to the Company and its operations. The Adviser manages the Company's day-to-day operations and has implemented a cybersecurity program that applies to the Company and its operations.

companyName: PennantPark Floating Rate Capital Ltd.

ticker: PFLT


text: Cybersecurity Program Overview The Adviser has instituted a cybersecurity program designed to identify, assess, and manage cyber risks applicable to the Company. The Adviser's cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Company relies. The Adviser actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Company.


text: The Company relies on the Adviser to engage external experts, including cybersecurity assessors, consultants, and auditors to evaluate cybersecurity measures and risk management processes, including those applicable to the Company. The Company relies on the Adviser's risk management program and processes, which include cyber risk assessments.


text: The Company depends on and engages various third parties, including suppliers, vendors, and service providers, to operate its business. The Company relies on the expertise of risk management, legal, information technology, and compliance personnel of the Adviser when identifying and overseeing risks from cybersecurity threats associated with our use of such entities.


text: Board Oversight of Cybersecurity Risks The Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from the Company's Chief Compliance Officer ("CCO") regarding the overall state of the Adviser's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.


text: Management's Role in Cybersecurity Risk Management The Company's management, including the Company's Chief Financial Officer ("CFO") and CCO, is responsible for assessing and managing material risks from cybersecurity threats. The CFO and CCO of the Company oversee the Company's oversight function generally and rely on Information Technology staff of, and consultants to, the Adviser to manage the assessment and management of material risks from cybersecurity threats. The CFO has been responsible for his oversight function as CFO to the Company for two years and has worked in the financial services industry for more than 30 years, during which time the CFO has gained expertise in assessing and managing risk applicable to the Company. The CCO has been responsible for oversight functions for the Company for two years, serving as CCO since May 2023 and has worked in the financial services industry for more than 27 years, during which time the CCO has gained expertise in assessing and managing risks applicable to the Company.


text: Management of the Company, including the CCO, is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Company, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, information technology, and/or compliance personnel of the Adviser.


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Company are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. During the reporting period the Company has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition.


text: The Company has effective processes in place to assess, identify, and manage material risks from cybersecurity threats. The Company's business is dependent on the communications and information systems of the Investment Adviser. The Company also relies on the communications and systems of other third-party service providers.

companyName: PENNANTPARK INVESTMENT CORP

ticker: PNNT


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Company are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, the Company has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition.


text: We maintain a cybersecurity risk management program based upon the National Institute of Standards and Technology Cybersecurity framework to assess, identify, and manage cybersecurity risks. This program is designed to protect business continuity and preserve the confidentiality, integrity, and continued availability of our IT systems and infrastructure used in our business as well as the information that we own or is in our care, and is integrated into our overall enterprise risk management program.

companyName: Woodward, Inc.

ticker: WWD


text: We have established processes to evaluate and address cybersecurity risks on an ongoing basis. As part of our risk management program, we engage with external third parties to measure the effectiveness of our cybersecurity program through penetration tests, control assessments, tabletop exercises, and other related activities. Further, we have implemented a defense-in-depth strategy in which we utilize real-time 24/7 monitoring to identify anomalies, potential threats, and alerts. This cybersecurity strategy incorporates frameworks, policies, and practices designed to protect the privacy and security of our sensitive information, backed by a suite of security technologies and tools to implement and automate select security protections. We maintain cyber risk and related insurance policies as a measure of added protection.


text: We educate our members to raise awareness of cybersecurity threats. As part of our program, we maintain annual training for all members on cybersecurity standards and provide training on how to recognize and properly respond to phishing, social engineering schemes, and certain other cyber threats. We equip our members with a mechanism to easily report suspicious emails which are analyzed by our security systems and dedicated incident response team. "Test" phishing assessments are periodically sent to our members. Any failures trigger a retraining exercise if not properly reported. Also, we have specific and regular training for our IT and finance members, as well as our system administrators.


text: In addition, we maintain processes governing interconnections with third-party systems and we perform due diligence procedures before onboarding service providers with access to our systems or processing sensitive data on our behalf. This process includes a review of System and Organization Controls ("SOC") 1 and SOC 2 reports (as each such report is defined by the American Institute of Certified Public Accountants), ISO 27001 certifications, and Cybersecurity Maturity Model Certifications ("CMMC"), as well as reviewing penetration tests, conducting vulnerability tests, and administering security questionnaires and assessments.


text: We are not aware of having experienced risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, risks from cybersecurity threats, including but not limited to exploitation of vulnerabilities, ransomware, denial of service, supply chain attacks, or other similar threats may materially affect us, including our execution of business strategy, reputation, results of operations and/or financial condition. Nonetheless, our IT infrastructure, systems, networks, products, solutions, and services remain potentially vulnerable to numerous additional known or unknown threats. For more information about the cybersecurity risks we face, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K, including the risk factor entitled "Our business and operations may be adversely affected by cybersecurity breaches or other information technology system or network interruptions or intrusions."


text: Our cybersecurity program is ultimately overseen by the Board of Directors. The Audit Committee has responsibility for the oversight of risk management activities related to cybersecurity and other information security and technology risks. Our cybersecurity program is implemented and administered by a dedicated team of internal and external cybersecurity professionals that conduct periodic control gap assessments, maturity assessments, and benchmarking against peers in the industry. The team has decades of experience with varied certifications and is led by our Chief Information Officer ("CISO"), who has over 17 years of experience as an IT professional and in cybersecurity and reports to our Vice President of IT. The CISO makes regular reports to senior management regarding the cybersecurity program. We also have a notification process for appropriate escalation of cyber incidents by members of our internal cybersecurity team to senior management as appropriate, including our Chief Executive Officer, Chief Financial Officer, Chief Accounting Officer, and/or General Counsel, as well as to the Audit Committee. Management provides quarterly data protection and cybersecurity reports to the Audit Committee, as well as periodic reports to the full Board of Directors, which include information about cyber risk management, the cybersecurity risk environment, and the status of ongoing efforts to strengthen cybersecurity effectiveness.


text: We have dedicated to advance our cybersecurity risk management and integrated it into our overall risk management program, which program manages cybersecurity, financial, operational and compliance risks. To access, identify and manage cybersecurity threats, we implemented a cybersecurity risk management program with oversight by our Board of Directors ("Board"). Our management, led by an experienced information security team, continually monitors cybersecurity risk incidents.

companyName: SemiLEDs Corp

ticker: LEDS


text: Our cybersecurity risk management program sets forth a framework provided by our information security team to identify and mitigate vulnerabilities and risks in our information systems. Elements of the program include, among the other things, penetration tests on our networks and engaging in annual employee cybersecurity training.


text: We have engaged a third-party service provider periodically to review and improve our cybersecurity risk management framework, including by identifying third-parties information systems that could cause cybersecurity incidents to our business.


text: Our information security team, including our system engineering department leader who manages our information technology, is responsible for accessing and managing cybersecurity operations and incident response, reports cybersecurity incidents to management and, if the incidents are material, our audit committee. The members of our information security team each have over 10 years of experience and extensive knowledge in managing cybersecurity programs.


text: Our Audit Committee assists the Board in overseeing cybersecurity risks, including discussing with management and the information security team if cybersecurity threats are identified, and recommends cybersecurity framework improvements to the Board.


text: We have continued to invest in an evolving state-of-the-art cybersecurity framework of tools, processes, training, and people designed to efficiently assess, identify, and remediate material risks that could affect business operations, financials, or public reputation. Our multi-layered approach to cybersecurity involves regular network monitoring, vulnerability scanning, advanced threat detection, and incident response capabilities against recognized cyber threats to our business and stakeholders, including ransomware, data breaches and insider threats. We regularly update our security measures, as necessary, to ensure we address all new threats and technologies, using the National Institute of Standards and Technology ("NIST") Framework as a guide, when appropriate and relevant to our business.

companyName: ENANTA PHARMACEUTICALS INC

ticker: ENTA


text: As further protections, we utilize encryption, access control mechanisms and secure cloud infrastructures, and we invest in extensive user training. All users regularly undergo updated cybersecurity awareness training in an ongoing effort to reduce the risk of human error contributing to any potential security incidents. All users are also subject to simulated phishing emails with real time feedback for a more continuous layer of training.


text: We have retained a seasoned virtual Information Security Officer ("vISO") to assist and guide our IT organization in maintaining and evolving a comprehensive and robust cyber security environment. Monthly meetings review all facets of our current status against appropriate NIST standards, review any incidents, and review the results of ongoing simulated phishing exercises to identify certain users who may need extended training. In addition, as part of our annual security review, we hire a third-party network penetration testing firm to provide simulated probing and subsequent reporting. We use the results of these annual tests to improve the strength and flexibility of our network's security.


text: Our Incident Response Plan ("IRP") has evolved with our cyber environment and consists of a set of state-of-the-art-tools capable of monitoring, reporting and alerting, as well as regular reviews. The IRP also sets forth guidelines on how to triage, assess the severity and materiality of findings, and remediate and escalate findings to upper management in a timely manner, as necessary. In addition, as part of our overall risk mitigation strategy, we also maintain cyber insurance coverage. However, such insurance may not be sufficient to cover us against all possible claims related to security breaches, cyber-attacks and other related breaches. Our current environment contains no known risks from cybersecurity threats that could materially impact our business operations, financials, or public reputation.


text: The Board of Directors has assigned the Audit Committee to be responsible for reviewing our cybersecurity risk management and strategy program and is presented, at least annually, with a review of our environment and reported incidents. Part of our IRP also calls for the elevation of any necessary incidents to upper management in a timely manner whenever they occur.


text: We have also formed a steering committee, composed of IT staff and relevant business leaders responsible for the Company's material information, including commercially sensitive data. The goals of this steering committee include overseeing our annual material risk assessment and documenting and reporting to senior management. The steering committee also reviews changes to procedural and other controls. We have also formed a risk register subcommittee to review and formally discuss any critical risks identified during our vISO annual assessment of our cyber environment.


text: Our cybersecurity strategy prioritizes detection, analysis and response to known, anticipated or unexpected threats as well as effective management of security risks and resiliency, with the goal of preventing, or mitigating, any cybersecurity incidents. Our processes for managing cybersecurity risks include the use of technical security controls, policy enforcement mechanisms, monitoring systems, employee training, contractual arrangements, tools and related services from third-party providers, and management oversight to assess, identify and manage material risks from cybersecurity threats. We utilize risk-based controls in seeking to protect our information, information regarding our customers, vendors, employees, and other third-parties, our information systems, our business operations, and our products and related services. We have adopted security-control principles based on the National Institute of Standards of Technology ("NIST") Cybersecurity Framework. Our program is comprehensive in scope and covers all of our general corporate Information Technology ("IT") systems, as well as operational technology systems supporting our businesses. When engaging third-party service providers, we also evaluate the sufficiency of the security of the technology systems used by our third-party service providers. Our senior leadership team, along with the Audit Committee of our Board of Supervisors, receive regular and recurring program updates, metrics, and roadmaps to assist us in overseeing and promoting the effectiveness of the program and its alignment with our business objectives. Our program and controls are periodically reviewed and tested by independent third-parties to enable us to employ industry best practices.

companyName: SUBURBAN PROPANE PARTNERS LP

ticker: SPH


text: Our cybersecurity risk management program includes an incident response plan ("IRP"). Our IRP provides us with a plan for identifying, responding to, reporting and remediating cybersecurity incidents. Our IRP has been established to reduce or minimize the impact of cybersecurity incidents on our networks, IT systems, users or business processes. Our Information Services Breach Response Team ("ISBRT") takes a central role in developing and maintaining our incident response framework in coordination with our Cybersecurity Response Team ("CRT") that is dedicated to proactively addressing and managing potential breaches and incidents to ensure that our cybersecurity defenses are well designed and managed. Our Incident Management Team ("IMT") handles the response process for all cybersecurity incidents.


text: Our cybersecurity risk management program and strategy also includes: • a continuous vulnerability management process to monitor and identify threats in our environment, including our IT networks and legacy systems, that could potentially have a materially adverse impact on our critical systems, information protection and broader enterprise IT environment; • the use of reputable cybersecurity consultants and other experienced third-party experts to enhance our cybersecurity posture, assist us in evaluating risks, conduct security assessments and provide guidance so we can maintain a posture of continual enhancement of our cybersecurity risk management program and strategy; • continuous and updated cybersecurity awareness training for our employees, incident response personnel and senior management; and • a risk management process for critical third-party service providers and vendors that includes due diligence in the selection of third-parties and vendors and the periodic monitoring thereof to ensure that they adhere to applicable cybersecurity standards.


text: Our Board of Supervisors is responsible for overseeing our enterprise risk relative to cybersecurity governance through the Audit Committee of the Board, with specific responsibility for overseeing cybersecurity threats, among other things. Our CRT is led by the Senior Vice President of Information Services ("SVP, Information Services"), who reports to the Partnership's CEO and is responsible for assessing and managing material cybersecurity risks and threats, in coordination with the ISBRT and the IMT, and regularly reports to the Audit Committee with regard to the Partnership's cybersecurity governance efforts. The SVP, Information Services has served in this role since 2014, and has more than 27 years of experience in various roles involving managing cybersecurity functions, developing cybersecurity strategies to protect privacy, customer safety and intellectual property, and developing key capabilities such as product security engineering, risk management and cybersecurity governance.


text: The ISBRT, CRT, IMT and the Audit Committee of the Board all play a role in the monitoring, prevention, mitigation, detection and remediation of cybersecurity incidents through their management and oversight of, and participation in, the cybersecurity risk management and strategy processes described above. As of the date of this Annual Report, we are not aware of any risks of, or actual, cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition and that are required to be reported in this Annual Report. For further discussion of the risks associated with cybersecurity incidents, see the cybersecurity risk factor in the section entitled "Item 1A. Risk Factors" in this Annual Report.


text: We have implemented and maintain a robust cybersecurity program to assess, identify, and manage risks from cybersecurity threats that may result in material adverse effects on the confidentiality, integrity, and availability of our information systems and the data residing therein.

companyName: Leslie's, Inc.

ticker: LESL


text: Our board of directors, with assistance from the audit committee, oversees the Company's management of risks arising from cybersecurity threats. The audit committee regularly reviews the measures implemented by the Company to identify and mitigate risks from cybersecurity threats. As part of such reviews, the audit committee receives reports and presentations from members of our team responsible for overseeing the Company's cybersecurity risk management, including certain IT leadership and our legal team, which may address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. The audit committee also reports to the board of directors at least annually on cybersecurity matters.


text: We have an incident response plan under which certain cybersecurity incidents are escalated within the Company to senior executives on the cybersecurity risk management committee, and, where appropriate, reported to the Board and Audit Committee in a timely manner. At the management level, our cybersecurity risk management committee, comprised of senior executives representing functional and business areas, including our legal team, has broad oversight of the Company's risk management processes. Members of the Company's cybersecurity risk management committee includes certain IT leadership and the General Counsel. The committee meets regularly to discuss the risk management measures implemented by the Company to identify and mitigate data protection and cyber security risks. Certain IT leadership and the General Counsel attend each cybersecurity risk management committee meeting to report on ongoing cybersecurity matters. Our IT leadership also works closely with our legal team to oversee compliance with legal, regulatory and contractual security requirements.


text: Our Vice President of Security and Compliance, who has cybersecurity knowledge and skills gained from work experience at the Company, heads the team responsible for implementing, monitoring and maintaining cybersecurity and data protection practices across our business. The cybersecurity team receives reports on cybersecurity threats from a number of experienced information security team members responsible for various parts of the business periodically and in conjunction with management, regularly reviews risk management measures implemented by the Company to identify and mitigate data protection and cybersecurity risks.


text: Our cybersecurity processes include automated tools and technical safeguards managed and monitored by our cybersecurity team and include mechanisms, controls, technologies, systems, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data and maintain a stable information technology environment. For example, we regularly conduct penetration and vulnerability testing, security audits, and tabletop exercises. We conduct regular employee training on cybersecurity. We also employ systems and processes designed to oversee, identify, and reduce the potential impact of a security incident at a third-party vendor, service provider or customer that otherwise implicates third-party technology and systems we use. In addition, we consult with outside advisors and experts, when appropriate, to assist with assessing identifying and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on the Company's risk environment.


text: Due to evolving cybersecurity threats, it has and will continue to be difficult to prevent, detect, mitigate, and remediate cyber incidents. We consider cybersecurity threats, along with other significant risks that we face within our overall enterprise risk management framework. In the last fiscal year, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, but we face certain ongoing cybersecurity risks threats that if realized, are reasonably likely to materially affect us.


text: Additional information on cybersecurity risks we face can be found in Part I, Item 1A "Risk Factors" of this Report.


text: Cybersecurity risk may adversely impact our business. The impact could include weakened financial condition, litigation risk, degrading mining operations, loss of competitiveness, fraud, extortion, harm to employees, violation of applicable privacy or other regulations that could result in regulatory action and fines.

companyName: CLEANSPARK, INC.

ticker: CLSK


text: We have developed and implemented a cybersecurity program to manage the confidentiality, integrity and availability of our data and information systems that support our business. The program is aligned with the National Institute of Standards and Technology Cybersecurity Framework 2.0 and is integrated into our overall risk management program. It is designed to develop appropriate strategies for preserving the confidentiality, integrity and availability of our data and information systems that can evolve with the changing cybersecurity threat landscape. We have implemented policies, procedures and technological tools to prevent, detect and mitigate cybersecurity risks posed by third parties.


text: We use third party providers to help us consistently monitor and evaluate our cybersecurity program and performance through actions that include hiring a contract Chief Information Security Officer ("CISO") with decades of cybersecurity experience to help manage our program. We also use industry standard technology tools including vulnerability scans, penetration tests, firewalls, endpoint detection and threat intelligence. A written cybersecurity incident response plan that we tabletop yearly and cybersecurity insurance are also important pillars in our approach to managing the risk of a cyber event. Our incident response plan contains a materiality analysis framework based on Federal Information Processing Standards Publication 199. This materiality framework allows us to identify and classify cybersecurity events based on their impact to our data or information systems. This framework will assist us in expediting review of cyber events for materiality purposes that could require disclosure to the SEC.


text: We have implemented a third party risk management policy that categorizes the cybersecurity risk posed by third party vendors along with the type of cybersecurity controls we may require of those vendors. These may include employee training, cybersecurity tools like multi-factor authentication, and contractual requirements that vendors maintain appropriate technical, administrative and physical cybersecurity controls. This is in addition to the policies and practices we maintain to monitor access of our information systems and data using our internal staff and third party vendors. As part of communicating the importance of cybersecurity at an enterprise wide level, we require that all company employees participate in annual cybersecurity training.