text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management. The Audit Committee of our Board is responsible for the oversight of cybersecurity-related risks. The Audit Committee regularly receives reports from management on our cybersecurity threat risk management and strategy processes, including on topics such as our data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, incident response plans, and cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to these risks. The Audit Committee received reports from our Chief Information Officer ("CIO") and/or CISO five times in 2024.


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our CISO. The CISO works closely with the CIO, Chief Privacy Officer ("CPO"), and other members of the legal team who report to the General Counsel, to review the cybersecurity program while monitoring global data protection regulations and cyber security laws. The CISO, CIO, and CPO, collectively, have over 35 years of work experience in various roles involving managing information security, developing cybersecurity strategy, and implementing effective information and cybersecurity programs. Our CISO is currently a board member for the National Technology Security Coalition, a non-profit, non-partisan trade association serving as the voice of CISOs to help improve national cybersecurity and has served on the board of advisors of many security technology companies.

companyName: GE HealthCare Technologies Inc.

ticker: GEHC

secItem: Item 1C


text: Risk Management and Strategy We have strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. Our cybersecurity program is aligned with industry standards and best practices, such as the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. Our measures to prevent, detect and mitigate cyber threats include training for employees, multi-factor authentication, backup servers, threat monitoring, periodic strategy review and penetration testing performed by a third-party advisory firm, and coverage under an information security risk insurance policy. Third-party suppliers are pre-screened as part of our vendor onboarding process to evaluate their cybersecurity programs and assess risk. As a part of our pre-screening process, we evaluate each vendor's overall cybersecurity risk profile relative to the services they provide for Biohaven, including questions relating to cybersecurity insurance, security operations and access and management of our data. Cybersecurity incidents involving third-party supplier systems are evaluated for their impact on the Company and managed through our cyber incident management process. In addition, our employees are required to complete an annual cybersecurity training managed through our internal compliance training system.

companyName: Biohaven Ltd.

ticker: BHVN


text: The Board recognizes the importance of cybersecurity in maintaining the trust and confidence of our stakeholders, patients and employees. Our Audit Committee is central to the Board's oversight of cybersecurity and bears the primary responsibility for overseeing risks associated with our information systems and technology, including cybersecurity.


text: Our Chief Technology Officer ("CTO") is tasked with updating the Board and Audit Committee on cybersecurity risks. Our CTO provides comprehensive briefings to our Audit Committee on a quarterly basis regarding our strategy for managing and mitigating cybersecurity and technology-related risks. Beginning in 2024, our CTO will also provide such comprehensive briefings to the Board on an annual basis. Our CTO has been in the position for over three years and has over 35 years of industry experience focusing on large scale business transformations leveraging technology, cybersecurity, and technical operations excellence. Our CTO has held various senior technology leadership roles at other companies prior to joining the Company.


text: Cybersecurity Risks Although cybersecurity risks have not materially affected us, including our business strategy, results of operations or financial condition, to date, we are subject to various cybersecurity risks, which could, in the future, be material. For more information about the cybersecurity risks we face, see risk factor entitled "Our business and operations may be materially adversely affected in the event of computer system failures or security breaches" in Item 1A, "Risk Factors."


text: Risk Management and Strategy We have strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. Our cybersecurity program is aligned with industry standards and best practices, such as the National Institute of Standards and Technology Cybersecurity Framework. Our measures to prevent, detect and mitigate cyber threats include training for employees, multi-factor authentication, backup servers, threat monitoring, periodic strategy review and penetration testing performed by a third-party advisory firm, and coverage under an information security risk insurance policy. Third-party suppliers are pre-screened as part of our vendor onboarding process to evaluate their cybersecurity programs and assess risk. As a part of our pre-screening process, we evaluate each vendor's overall cybersecurity risk profile relative to the services they provide for the Company, including questions relating to cybersecurity insurance, security operations and access and management of our data. Cybersecurity incidents involving third-party supplier systems are evaluated for their impact on the Company and managed through our cyber incident management process. In addition, our employees are required to complete an annual cybersecurity training managed through our internal compliance training system.


text: Our Chief Technology Officer ("CTO") is tasked with updating the Board and Audit Committee on cybersecurity risks. Our CTO provides comprehensive briefings to our Audit Committee on a quarterly basis regarding our strategy for managing and mitigating cybersecurity and technology-related risks. Our CTO also provides such comprehensive briefings to the Board on an annual basis. Our CTO has been in the position for over four years and has over three decades of industry experience focusing on large scale business transformations leveraging technology, cybersecurity, and technical operations excellence. Our CTO has held various senior technology leadership roles at other companies prior to joining the Company.


text: Cybersecurity Risks Although cybersecurity risks have not materially affected us, including our business strategy, results of operations or financial condition, to date, we are subject to various cybersecurity risks, which could, in the future, be material. For more information about the cybersecurity risks we face, see the risk factor entitled "Our business and operations may be materially adversely affected in the event of computer system failures or security breaches" in Item 1A, "Risk Factors."


text: Our board of directors is responsible for overseeing our risk management program, and cybersecurity is a critical element that has been integrated into our overall risk management program. Management is responsible for the day-to-day administration of our risk management program and our cybersecurity policies, processes, and practices.

companyName: Zymeworks Inc.

ticker: ZYME


text: We aim to incorporate industry practices throughout our cybersecurity program. Our cybersecurity strategy focuses on implementing effective and efficient controls, technologies, and other processes to assess, identify, and manage cybersecurity risks. Our cybersecurity program is informed by applicable industry standards and is assessed regularly by independent third-party auditors.


text: Cybersecurity Risk Management and Strategy Our cybersecurity risk management strategy focuses on several areas: • Identification and Escalation: We have implemented a cross-functional approach to assessing, identifying and managing cybersecurity threats and incidents. Our program includes controls and procedures to identify, classify and escalate certain cybersecurity incidents to provide management visibility and obtain direction from management. • Technical Safeguards: We implement technical safeguards that are designed to protect our information systems from cybersecurity threats, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence, as well as outside audits and certifications. • Incident Response and Recovery Planning: We have established and maintain incident response, business continuity, and disaster recovery plans designed to address our response to a cybersecurity incident. We conduct periodic tabletop exercises to test these plans and ensure personnel are familiar with their roles in a response scenario. • Third-Party Risk Management: We maintain a risk-based approach to identifying and overseeing cybersecurity threats presented by third parties, including vendors, service providers, and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems, including any outside auditors or consultants who advise on our cybersecurity systems. • Education and Awareness: We provide regular, mandatory training for all employees regarding cybersecurity threats as a means to equip our employees with tools to make employees aware of and to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes, and practices.


text: We conduct periodic assessments and testing of our policies, standards, processes, and practices in a manner intended to address cybersecurity threats and events. We adjust our cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these assessments, audits, and reviews. We, like any company operating in the current environment, have experienced cybersecurity incidents in the past. However, we have not experienced a cybersecurity event that was determined to be material. For additional information regarding whether any risks from cybersecurity threats are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, see Item 1A, "Risk Factors", of this Annual Report on Form 10-K, including the risk factor titled "Security breaches and incidents, loss of data and other disruptions could compromise sensitive information related to our business or protected health information or prevent us from accessing critical information and expose us to liability, which could adversely affect our business and our reputation."


text: Our board of directors, in coordination with the audit committee of our board of directors, oversees our risk management program, including the management of cybersecurity threats. Our board of directors and our audit committee receive prompt and timely information regarding cybersecurity risks, as well as ongoing updates regarding any such risk, from senior management.


text: Our Senior Director, IT who has over 20 years' experience with cybersecurity at public companies, in coordination with senior management including our Chief Executive Officer, works collaboratively across our company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to cybersecurity incidents in accordance with our incident response and recovery plans. To facilitate the success of our cybersecurity program, a cross-functional team throughout our company addresses cybersecurity threats and responds to cybersecurity incidents. Through ongoing communications with this team, the Senior Director, IT and senior management are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and report such threats and incidents to the Audit Committee when appropriate.


text: Cybersecurity Risk Management and Strategy Our cybersecurity risk management strategy focuses on several areas: • Identification and Escalation: We have implemented a cross-functional approach to assessing, identifying and managing cybersecurity threats and incidents. Our program includes controls and procedures to identify, classify and escalate certain cybersecurity incidents to provide management visibility and obtain direction from management. • Technical Safeguards: We implement technical safeguards that are designed to protect our information systems from cybersecurity threats, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence, as well as outside audits. • Incident Response and Recovery Planning: We have established and maintain an incident response plan and a business continuity and disaster recovery plan designed to address our response to a cybersecurity incident. • Third-Party Risk Management: We maintain a risk-based approach to identifying and overseeing cybersecurity threats presented by third parties, including vendors, service providers, and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems, including any outside auditors or consultants who advise on our cybersecurity systems. • Education and Awareness: We provide regular, mandatory training for all employees regarding cybersecurity threats as a means to equip our employees with tools to make employees aware of and to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes, and practices.


text: We, like any company operating in the current environment, have experienced cybersecurity incidents in the past. However, we have not experienced a cybersecurity event that was determined to be material. For additional information regarding whether any risks from cybersecurity threats are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, see Item 1A, "Risk Factors", of this Annual Report on Form 10-K, including the risk factor titled "Security breaches and incidents, loss of data and other disruptions could compromise sensitive information related to our business or protected health information or prevent us from accessing critical information and expose us to liability, which could adversely affect our business and our reputation."


text: Our Vice President of Information Technology and Facilities, who has over 20 years' experience with cybersecurity at public companies, in coordination with senior management including our Executive Vice President, Chief Business and Financial Officer, works collaboratively across our company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to cybersecurity incidents in accordance with our incident response and recovery plans. To facilitate the success of our cybersecurity program, a cross-functional team throughout our company addresses cybersecurity threats and responds to cybersecurity incidents. Through ongoing communications with this team, the Vice President of Information Technology and Facilities and senior management are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and report such threats and incidents to the Audit Committee when appropriate.


text: Cybersecurity Governance Cybersecurity at our company is overseen by our Board, the Audit Committee and management, as well as through our Enterprise Information Security Policy ("EISP").

companyName: Brookfield Asset Management Ltd.

ticker: BAM


text: The Audit Committee of our Board is responsible for overseeing risk management strategies that are specific to our company, including reviewing management's assessment of the current and emerging risks and related mitigation strategies across financial and non-financial risks, including cybersecurity risks. Regular reports and updates on cybersecurity risks are made to senior management of BAM. Pursuant to the EISP, executive management has appointed a Chief Information Security Officer ("CISO"), who works closely with senior management, legal counsel and external counsel to develop and monitor our data protection, privacy and cybersecurity program and policies. The CISO provides periodic reports to the Audit Committee, which subsequently reports to the Board about data protection and cybersecurity risks and issues. The CISO has over 20 years' experience in cybersecurity oversight, holds a Bachelor's Degree in Computer Science and Economics from York University and holds a number of information security certifications, including: CISSP, CISM, CISA and CRISC.


text: Cybersecurity Risk Management and Strategy We have a cybersecurity program for assessing, identifying, and managing material risks from cybersecurity threats. This includes compliance with the EISP. Our cybersecurity program performance and effectiveness are also frequently assessed and audited internally and by third parties.


text: We believe our cybersecurity program is reasonably designed to materially protect the integrity and availability of our information and technology. This program addresses security governance, security awareness, employee training, relevant access and end-point security, vulnerability management, penetration testing, security monitoring and incident response. We use technologies to optimize our security risk detection and response capabilities, in addition to access controls and anti-malware protections. We believe our practices align with the NIST Cybersecurity Framework in meeting and exceeding the industry average in cybersecurity practice.


text: In addition, all employees regularly undergo mandatory continuing cybersecurity training. Employees in higher-risk functions receive additional training and cybersecurity awareness education. Audits, cybersecurity simulations and employee testing results indicate that our program is effective in protecting our information. The effectiveness of these programs is evaluated regularly through both internal and third-party audits.


text: In 2024, we undertook the following initiatives: further enhanced our data protection and threat-intelligence capabilities; improved our processes for third-party risk management; continued mandatory cybersecurity education for all employees; and incorporated social engineering to our phishing simulations. When we engage third parties, we have policies and processes to govern their access and reduce the risks associated with their access. For example, all third-party access must be authorized and have a legitimate business need. Prior to authorization and granting access, the terms and conditions of such access must be agreed to as part of a formal agreement or contract. In addition, all authorized third-party access must be limited, monitored and controlled as appropriate.


text: Our systems face cybersecurity risks, and we have in the past experienced threats to our data and systems. However, to date, these incidents have not had a material impact on our business strategy, results of operations, or financial condition. We can provide no assurance that we will not experience any material cybersecurity threats or incidents in the future. See "Part I—Item 1A. Risk Factors—Failure to maintain the security of our information and technology systems could have a material adverse effect on us".


text: Risk Management and Strategy We are externally managed by the Advisor, a subsidiary of Cohen & Steers, and representatives of the Company and the Advisor operate the Company's business through Cohen & Steers' information systems. Our business is dependent on the effectiveness of our and Cohen & Steers' information and cybersecurity policies and procedures to protect our and Cohen & Steers' network and telecommunications systems and the data that reside in or are transmitted through such systems.

companyName: Cohen & Steers Income Opportunities REIT, Inc.


text: Cybersecurity is a crucial component of our risk management processes and of Cohen & Steers' enterprise risk management program. Like many companies, we, Cohen & Steers and our and our external providers have been subject to, and expect to continue to be subject to, a range of cybersecurity threats and risks. Cohen & Steers has invested significant resources into cybersecurity and risk management processes to adjust to the continuing evolution in cybersecurity and respond to related threats.


text: Cohen & Steers has implemented and maintained various information security processes designed to identify, assess and manage material risks from cybersecurity threats to its critical computer networks, third-party hosted services, communications systems, hardware and software and critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature and information relating to Advisor clients and investments ("Information Systems and Data").


text: Cohen & Steers' cybersecurity risk management function is led by its Chief Information Security Officer ("CISO") and Chief Technology Officer ("CTO") and includes members of its Information Technology ("IT") department and other personnel that oversee its information security and engineering operations. Input and guidance are also provided by members of its Legal and Compliance departments. Together, these employees (collectively referred to as members of the "Cybersecurity Management") are primarily responsible for developing, implementing and monitoring Cohen & Steers' cybersecurity program and reporting on cybersecurity matters to Cohen & Steers' senior management as well as our Audit Committee, on behalf of our Board.


text: Members of Cybersecurity Management identify and assess risks from cybersecurity threats by monitoring and evaluating Cohen & Steers' threat environment and enterprise risk profile using various manual and automated tools as well as by: (i) utilizing shared information about vulnerabilities and exploits from various professional security organizations, reports or other services that identify cybersecurity threats and through the use of external intelligence feeds; (ii) analyzing reports of threats and actors; (iii) conducting scans of Cohen & Steers' threat environment; (iv) evaluating Cohen & Steers' and its industry's risk profile; (v) evaluating threats that are reported to or discovered by Cohen & Steers; (vi) coordinating with law enforcement concerning threats; (vii) conducting internal and external audits of the information security control environment and operating effectiveness; and (viii) conducting threat assessments for internal and external threats, including through the use of third party threat assessments and vulnerability threat assessments.


text: Cohen & Steers has implemented and maintained various technical, physical and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to Information Systems and Data, including, but not limited to: • technical and physical safeguards: (i) systems monitoring, including anti-virus/anti-malware software for workstations and servers, reports about correlated events detected from server log reviews, desktop forensics software and suspicious firewall traffic, firewall logs and alerts from users about blocked websites, systems monitoring of Cohen & Steers' websites, network monitoring software alerts and scheduled internal and external vulnerability scans; (ii) Cohen & Steers' asset management tracking and disposal; (iii) incident detection and response; (iv) data encryption; (v) notification monitoring from Cohen & Steers' personnel and from third parties regarding issues and signs of potential incidents; and (vi) access controls and network security controls; and • organizational safeguards: (i) incident response plans that address Cohen & Steers' response to a cybersecurity incident; (ii) personnel and vendors dedicated to overseeing Cohen & Steers' cybersecurity program; (iii) periodic mandatory employee cybersecurity training; (iv) periodic risk assessments and testing of Cohen & Steers' policies, standards, processes and practices that are designed to address cybersecurity threats and incidents, such as audits, tabletop exercises, threat modeling and vulnerability testing; (v) policies and programs such as security standards, a vendor risk management program, a vulnerability management policy and disaster recovery and business continuity plans; and (vi) insurance coverage dedicated to losses resulting from cybersecurity incidents.


text: Cybersecurity risk management processes are integrated into the Board's ongoing evaluation and management of risks that are essential to our success, including as it relates to its oversight of the Advisor. At least annually, our Audit Committee reviews the cybersecurity program of the Advisor. Further, cybersecurity risk management is integrated into the Cohen & Steers' overall enterprise risk management process. For example, (i) enterprise risk management-level cybersecurity risks are reviewed at least annually by Cohen & Steers' information technology security team; (ii) internal and external penetration tests are performed to identify any vulnerabilities and findings are risk ranked based on potential likelihood and impact and (iii) the CTO reports on cybersecurity risk management and related matters annually to the Audit Committee, as part of its ongoing evaluation and oversight of the Advisor's cybersecurity program.


text: Third-party service providers play a key role in Cohen & Steers' cybersecurity program. Cohen & Steers uses third-party service providers to assist in identifying, assessing and monitoring material risks from cybersecurity threats, including through penetration testing, provision of threat intelligence and monitoring Cohen & Steers' environment 24 hours a day and seven days a week. Cohen & Steers has currently engaged with professional services firms, including legal counsel, threat intelligence service providers, cybersecurity consultants, cybersecurity software providers, managed cybersecurity service providers, penetration testing firms, dark web monitoring firms and cyber insurance brokers and providers. Members of the Advisor's management report key findings of such assessments to our Audit Committee and Cohen & Steers adjusts its cybersecurity policies, standards, processes and practices as necessary based in part on information provided by these assessments and engagements.


text: Cohen & Steers also uses third-party service providers to perform a variety of functions throughout its business, such as application providers, hosting companies and supply chain resources. Cohen & Steers maintains a risk-based approach to identifying and overseeing cybersecurity risks and vulnerabilities presented by its engagement of third parties, including key vendors, service providers and other external users of its information systems, as well as the information systems of third parties that could adversely impact its business in the event of a cybersecurity incident affecting those third-party systems. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue and the identity of the provider, Cohen & Steers' vendor risk management program may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider. Cohen & Steers' vendor risk management program may entail: (i) vendor risk assessments; (ii) security questionnaires; (iii) vendor audits; (iv) vulnerability scans relating to vendors; (v) security assessment calls with the vendor's security personnel and Cohen & Steers' review of the vendor's written security program, security assessments and other reports; (v) provision from the vendor of a System and Organization Controls ("SOC") 1 or SOC 2 report to evidence cybersecurity preparedness; and (vi) the imposition of contractual obligations on the vendor.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part I. Item 1A. "Risk Factors" in this Annual Report on Form 10-K, including under the caption "We could incur financial losses, reputational harm and regulatory penalties if we or Cohen & Steers fail to implement effective information security policies and procedures."


text: Our cybersecurity risk assessment and management processes are implemented and maintained by members of Cohen & Steers' Cybersecurity Management, including its CISO, CTO and Head of IT Infrastructure.


text: • Cohen & Steers' CISO oversees the information security group and program within its IT department and holds a Bachelor of Arts degree in computer science. The CISO has served in various roles in information technology for over 24 years within the financial services industry, including previously serving as Head of Information Security and Enterprise Infrastructure, Head of IT Audit and Chief Information Security Officer at other companies, and holds the Certified Information Systems Auditor (CISA) and Certified in Risk and Information Systems Control (CRISC) certifications and is registered with FINRA for the Series 99. • Cohen & Steers' CTO oversees the IT department and holds a PhD in computer science, an MBA and Postgraduate Diploma in physics. The CTO has served in various roles in information technology for over 28 years, including senior leadership roles for the investment banking division of a financial services company. • Cohen & Steers' Head of IT Infrastructure oversees the infrastructure and service desk departments within the IT department and holds a Bachelor of Business Administration degree in finance and computer information systems. The Head of IT Infrastructure has served in various roles in information technology for over 20 years.


text: Members of Cohen & Steers' Cybersecurity Management, including the CISO and the CTO, are responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into Cohen & Steers' overall risk management strategy and communicating key priorities to relevant personnel. Members of Cybersecurity Management, including the CISO and CTO, are responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes and reviewing security assessments and other security-related reports.


text: Cohen & Steers' cybersecurity incident response plan is a key component of its cybersecurity program. The response plan is designed to report certain cybersecurity incidents to members of Cybersecurity Management, who then work with the Cohen & Steers' incident response team to help Cohen & Steers control, mitigate and remediate cybersecurity incidents of which they are notified. In addition, the response plan includes prompt reporting to our Board (or the Audit Committee) of certain cybersecurity incidents and of the materiality and disclosure determinations relating thereto.


text: Our Board has delegated the primary responsibility for oversight and review of the Company's cybersecurity program to the Audit Committee. The Audit Committee actively participates in discussions regarding cybersecurity risk exposures and steps taken by management of Cohen & Steers to monitor and mitigate such risks, further to their responsibility to manage, oversee and remain informed about the most significant risks to Cohen & Steers and align Cohen & Steers' risk exposure with our strategic and business objectives. At least annually, the Audit Committee reviews with the Advisor and Cohen & Steers' CTO the Cohen & Steers' cybersecurity program, including the robustness and efficacy of Cohen & Steers' overall cybersecurity program, steps taken to enhance defenses and security measures in place and its established plans to identify, detect and respond to threats Cohen & Steers may encounter. The Audit Committee also annually reviews and discusses with the Advisor cyber insurance coverage. In addition, as necessary, our Board (or the Audit Committee) receives reports and communications from the Advisor regarding material risks and specific developments that may cover topics such as: the Advisor's computerized information system controls; the impact of new cybersecurity-related rules and regulations; changes in the threat environment including new and emergent risks; and evolving information security standards and market practices including with respect to peers and third parties.


text: Risk Management and Strategy We are externally managed by the Advisor, a subsidiary of Cohen & Steers. Representatives of the Company and the Advisor operate the Company's business through Cohen & Steers' information systems. Our business depends on the effectiveness of our and Cohen & Steers' information and cybersecurity policies and procedures to protect our and Cohen & Steers' network and telecommunications systems and the data that reside in or are transmitted through such systems.


text: Cybersecurity is a crucial component of our risk management program and of Cohen & Steers' enterprise risk management program. Cohen & Steers has implemented and maintains various information security processes designed to identify, assess and manage material risks from cybersecurity threats to its critical computer networks, third-party hosted services, communications systems, hardware and software and critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature and information relating to Advisor clients and investments.


text: Cohen & Steers' cybersecurity risk management function is led by its Cybersecurity Management team which is composed of its Chief Information Security Officer ("CISO"), Chief Technology Officer ("CTO"), members of its Information Technology ("IT") department as well as members of its Legal and Compliance departments. Its Cybersecurity Management team is primarily responsible for developing, implementing and monitoring its cybersecurity program and reporting on cybersecurity matters to Cohen & Steers' senior management as well as our audit committee, on behalf of our Board.


text: Members of Cohen & Steers' Cybersecurity Management team identify and assess risks from cybersecurity threats by monitoring its threat environment and enterprise risk profile using various manual and automated tools as well as by: (i) utilizing shared information about vulnerabilities and exploits from professional security organizations, reports or other services that identify cybersecurity threats and through the use of external intelligence feeds; (ii) analyzing reports of threats and actors; (iii) conducting periodic vulnerability scans of Cohen & Steers' IT environment; (iv) evaluating Cohen & Steers' and its industry's risk profile; (v) evaluating threats that are reported to Cohen & Steers; (vi) coordinating with law enforcement concerning threats; (vii) conducting internal and external audits of Cohen & Steers' information security control environment and operating effectiveness; and (viii) conducting threat assessments for internal and external threats, including through the use of third party threat assessments and vulnerability threat assessments.


text: Cohen & Steers has implemented and maintains various technical, physical and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats, including: • technical and physical safeguards: (i) real-time security information and event monitoring of systems, workstations, servers and networks, and periodic internal and external vulnerability scans; (ii) asset management tracking and disposal; (iii) incident detection and response; (iv) data encryption; (v) notification monitoring from Cohen & Steers' personnel and from third parties regarding issues and signs of potential incidents; and (vi) logical access controls and network security controls; and • organizational safeguards: (i) incident response plans that address Cohen & Steers' response to a cybersecurity incident; (ii) personnel and vendors dedicated to overseeing Cohen & Steers' cybersecurity program; (iii) periodic mandatory employee cybersecurity training; (iv) periodic risk assessments and testing of Cohen & Steers' policies, standards, processes and practices designed to address cybersecurity threats and incidents; (v) policies and programs such as security standards, a vendor risk management program, a vulnerability management policy and disaster recovery and business continuity plans; and (vi) insurance coverage dedicated to losses resulting from cybersecurity incidents.


text: Cybersecurity risk management is integrated into Cohen & Steers' overall enterprise risk management process. For example, (i) enterprise risk management-level cybersecurity risks are reviewed at least annually by Cohen & Steers' IT security team; (ii) internal and external penetration tests are performed to identify vulnerabilities and findings are risk ranked based on potential likelihood and impact; and (iii) members of Cohen & Steers' Cybersecurity Management report on cybersecurity risk management and related matters to our audit committee, as part of their ongoing evaluation and oversight of such risk pursuant to non-exclusive authority delegated by the Board.


text: Cohen & Steers uses third-party service providers to assist in identifying, assessing and monitoring material risks from cybersecurity threats, including through penetration testing, provision of threat intelligence and continuous monitoring of Cohen & Steers' environment. Members of the Advisor's management report key findings to our audit committee and Cohen & Steers adjusts its cybersecurity policies, standards, processes and practices as necessary based in part on information provided by these assessments and engagements.


text: Cohen & Steers also uses third-party service providers to perform a variety of functions throughout its business, such as application providers, hosting companies and supply chain resources. Cohen & Steers maintains a risk-based approach to identifying and overseeing cybersecurity risks and vulnerabilities presented by its engagement of third parties, as well as the information systems of third parties that could adversely impact its business in the event of a cybersecurity incident affecting those third-party systems. Cohen & Steers' vendor risk management program may involve different assessments designed to help identify cybersecurity risks including: (i) vendor risk assessments; (ii) security questionnaires; (iii) vendor audits; (iv) vulnerability scans relating to vendors; (v) security assessment calls with the vendor's security personnel and its review of the vendor's written security program, security assessments and other reports; (vi) evidence of cybersecurity preparedness through a System and Organization Controls ("SOC") 1 or SOC 2 report; and (vii) the imposition of contractual obligations on the vendor.


text: For a description of the risks from cybersecurity threats that may materially affect the Company, see our risk factors under Part 1. Item 1A. "Risk Factors" in this Annual Report on Form 10-K, including under the caption "We could incur financial losses, reputational harm and regulatory penalties if we or Cohen & Steers fail to implement effective information security policies and procedures."


text: • Cohen & Steers' CISO oversees the information security group and program within its IT department, has over 25 years of experience, including similar roles at other financial services companies, holds the Certified Information Systems Auditor (CISA) and Certified in Risk and Information Systems Control (CRISC) certifications and is registered with FINRA for the Series 99. • Cohen & Steers' CTO oversees its IT department and has served in various roles in information technology for over 29 years, including senior leadership roles at another financial services company. • Cohen & Steers' Head of IT Infrastructure oversees the infrastructure and service desk within its IT department and has served in various roles in information technology for over 13 years.


text: Members of Cohen & Steers' Cybersecurity Management, including its CISO and its CTO, are responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Cohen & Steers' overall risk management strategy and communicating key priorities to relevant personnel. Members of Cohen & Steers' Cybersecurity Management, including its CISO and its CTO, are responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes and reviewing security assessments and other security-related reports.


text: Cohen & Steers' cybersecurity incident response plan is a key component of its cybersecurity program. The response plan is designed to report certain cybersecurity incidents to members of Cybersecurity Management, who then work with Cohen & Steers' incident response team to help control, mitigate and remediate cybersecurity incidents. In addition, the response plan includes prompt reporting to our Board (or the audit committee) of certain cybersecurity incidents and related materiality and disclosure determinations.


text: Our Board has delegated the primary responsibility for oversight and review of the Company's cybersecurity program to the audit committee. The audit committee actively participates in discussions regarding cybersecurity risk exposures and steps taken by management of Cohen & Steers to monitor and mitigate such risks, further to their responsibility to manage, oversee and remain informed about the most significant risks to our Company and align our risk exposure with our strategic and business objectives. At least annually, the audit committee reviews with the Advisor and Cohen & Steers' CISO and its CTO Cohen & Steers' cybersecurity program, including the robustness and efficacy of Cohen & Steers' overall cybersecurity program, steps taken to enhance defenses and security measures in place and its established plans to identify, detect and respond to threats Cohen & Steers may encounter. The audit committee also annually reviews and discusses with the Advisor cyber insurance coverage. In addition, as necessary, our Board (or the audit committee) receives reports and communications from the Advisor regarding material risks and specific developments that may cover topics such as: the Advisor's computerized information system controls; the impact of new cybersecurity-related rules and regulations; changes in the threat environment including new and emergent risks; and evolving information security standards and market practices, including with respect to peers and third parties. As of December 31, 2024, neither we nor Cohen & Steers had experienced any cyber incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition.


text: Risk Management and Strategy We recognize the importance of being able to assess, effectively respond to, and manage material cybersecurity threats and incidents that may compromise the confidentiality, integrity or availability of our information systems, data, or network resources. To address these concerns, we plan to develop and implement company-wide policies and procedures to help raise awareness of, identify, assess, and manage cybersecurity threats. Our Information Security organization will have primary responsibility for the implementation of our cybersecurity policies and procedures and the management of our responses to information technology and security risks, including risks related to cybersecurity threats.

companyName: Revelyst, Inc.


text: Risk Identification and Assessment Risk identification will be managed through Information Technology ("IT") programs and service providers that specialize in identifying such risks, employee training, and information security policies. The cybersecurity team will conduct internal and external penetration testing with outside third-party cybersecurity experts. Employee training programs will be used to reinforce our information security policies, standards and practices, as well as the expectation that employees comply with these policies and to train employees on how to identify potential cybersecurity risks and protect our resources and information.


text: Our Information Security organization will be responsible for identifying the key responders for each security incident and maintaining engagement and communication throughout the incident lifecycle, which may include, among other things, containment, eradication, recovery, and a review of lessons learned. When necessary, the Information Security team will involve members of management and other representatives of our IT, Finance, Legal, and Internal Audit teams, with assistance of third-party consultants and outside legal counsel as appropriate, to assist in assessing the potential materiality of a cybersecurity incident. When necessary, these matters will be brought to the attention of the Audit Committee of the Board.


text: Risks Related to Third-party Service Providers To manage cybersecurity risks related to third-party service providers, we plan to conduct security assessments of certain third-party providers before engagement and will establish monitoring procedures related to data breaches or other security incidents originating from third parties. To assist in this effort, we may from time to time engage third-party consultants, legal advisors, and audit firms to evaluate and test our risk management systems and assess and remediate certain potential cybersecurity incidents as appropriate.


text: Risks from Cybersecurity Threats To date, we have not identified risks from cybersecurity threats or incidents, including as a result of any previous cybersecurity incidents, that have materially affected the Company or are reasonably likely to materially affect our operations, business strategy, results of operations, or financial condition. However, the sophistication of and risks from cybersecurity threats and incidents continue to increase, and there can be no assurance that our cybersecurity risk management policies and procedures will be fully implemented, complied with or successfully protect against all cybersecurity threats and incidents. For more information on how cybersecurity risk could materially affect our business strategy, results of operations, or financial condition, please refer to "Item 1A Risk Factors- Risks Related to the Revelyst Business- If Revelyst's efforts to protect the security of personal information about Revelyst's customers and consumers are unsuccessful and unauthorized access to that personal information is obtained, or Revelyst experiences a significant disruption in Revelyst's computer systems or a cybersecurity breach, such as the ransomware attack experienced by Fox Racing in April 2021 prior to being acquired by Revelyst, Revelyst could experience an adverse effect on its operations, Revelyst could be subject to costly government enforcement action and private litigation and Revelyst's reputation could suffer."


text: Board of Directors Oversight The Revelyst Board is expected to receive an annual report on the enterprise risk management review overseen by the Revelyst Audit Committee, which will include, among other things, an evaluation of cybersecurity risks (including cybersecurity risks that Revelyst may have exposure to via its suppliers and service providers), mitigation efforts, incident response preparedness and adequacy of internal controls. In addition, the Revelyst Board is expected to receive in-depth updates from Revelyst's information technology team on cybersecurity risks on a regular basis.


text: Management's Role in Managing Risk and Monitoring Incidents The leaders of our Information Security organization will be responsible for assessing and managing our material risks from cybersecurity threats and supervision of both our internal information security personnel and our retained external cybersecurity consultants.


text: Other members of our management team, including those from legal, finance, and internal audit, will supervise efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants we engage; and alerts and reports produced by security tools deployed in the IT environment.


text: The management team anticipated to have primary responsibility for assessing and managing Revelyst's cybersecurity risks have extensive years of collective experience on the subject and members hold multiple certifications, including CISSP, CCNP, CISA, and CySA+.


text: Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and sensitive data and applications of our customers ("Information Systems and Data"). Rubrik, Inc.

companyName: Rubrik, Inc.

ticker: RBRK


text: Our Chief Information Security Officer ("CISO") and the direct reports to the CISO (including the Senior Director of Information Security and the Senior Director for Governance, Risk and Compliance, collectively, the "CISO Team") help identify, assess and manage the Company's cybersecurity threats and risks, including through the use of a risk register. The CISO Team identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example, manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting scans of the threat environment, evaluating our and our industry's risk profile, evaluating threats reported to us, internal and/or external audits, conducting vulnerability assessments to identify vulnerabilities, use of external intelligence feeds, and third-party-conducted red/blue team testing and tabletop incident response exercises.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: an incident response plan and/or incident response policy, incident detection and response, a vulnerability management policy, disaster recovery/business continuity plans, risk assessments, implementation of security standards/certifications, encryption of data, network security controls, access controls, physical security, vendor risk management program, employee training, penetration testing, cybersecurity insurance, dedicated cybersecurity staff/officer, and systems monitoring.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, (1) cybersecurity risk is identified in and a component of the Company's risk register; (2) the CISO Team works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business; and (3) our information security team evaluates material risks from cybersecurity threats against our overall business objectives and reports to the board of directors, which evaluates our overall enterprise risk.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example professional services firms (including legal counsel), threat intelligence service providers, cybersecurity consultants, cybersecurity software providers, penetration testing firms, dark web monitoring services, and forensic investigators.


text: We also use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, and supply chain resources. We have a vendor management program to manage cybersecurity risks associated with our use of these providers. The program includes risk assessment for each vendor, security questionnaires, review of the vendor's written security program, review of security assessments and reports, audits, calls with vendors security personnel, and contractual obligations regarding cybersecurity imposed on each vendor. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part I. Item 1A. Risk Factors in this Annual Report on Form 10-K.


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors is responsible for overseeing Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including the CISO Team, along with other members of management.


text: Our CISO Team is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. The CISO Team is also responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our crisis management team. The CISO Team works with our crisis management team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response processes include reporting to the board of directors for certain cybersecurity incidents.


text: The board of directors receives periodic reports from the CISO team concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The board of directors also receives various reports, summaries or presentations related to cybersecurity threats, risk and mitigation. Rubrik, Inc.


text: Risk Management and Strategy Our process for assessing, identifying and managing material risks from cybersecurity threats is integrated into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. Our cybersecurity organization continually evaluates and addresses cybersecurity risk in alignment with our business objectives. We employ automation, and we also engage our internal audit function and a range of external consultants and other expert third parties in connection with the evaluation and management of cybersecurity risk and the maturation of our cybersecurity program.

companyName: Kenvue Inc.

ticker: KVUE


text: Our cybersecurity organization assesses and manages cybersecurity risk through technical, physical and administrative controls, including implementing cybersecurity policies, procedures and strategies, with the ultimate goal of preventing cybersecurity incidents to the extent feasible, while increasing our system resilience in an effort to minimize business impact should an incident occur. The underlying controls of the cybersecurity risk management program are based on recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology Cybersecurity Framework. In addition, we maintain a Data Incident Response Program, which is designed to identify, assess, manage and report significant data incidents, including those reasonably likely to affect our business strategy, results of operations or financial condition. The Data Incident Response Program outlines the steps to be followed from incident detection to mitigation, recovery and notification, including notifying functional areas, senior management, and the Company's disclosure committee or a sub-committee thereof as appropriate. The disclosure committee or a sub-committee thereof will consider the materiality of an incident elevated by the Data Incident Response Program, inform the Board and other key stakeholders as appropriate, and determine the Company's reporting obligation on a timely basis.


text: We rely heavily on our supply chain to deliver our products to our customers and consumers, and a cybersecurity incident at a supplier or partner could materially adversely impact us. As such, we have processes in place to oversee and identify risks from cybersecurity threats associated with suppliers and our use of third-party service providers, including through our Supplier Cyber Risk Assessment process, which assesses third-party cybersecurity controls through a combination of risk assessment questionnaires, commercially available risk data and proprietary algorithms. We also include security and privacy addendums to our contracts where applicable. We require that our suppliers and partners report cybersecurity incidents to us so that we can assess the impact of such an incident on us and have dedicated processes to respond to cybersecurity incidents at third parties.


text: Risks from cybersecurity threats did not materially affect our results of operations or financial condition during the period covered by this filing.


text: Cybersecurity related risks are one of the key risks contemplated by our Enterprise Risk Management ("ERM") Framework. The ERM Framework informs our strategic planning activities through a collaborative risk management environment that proactively identifies and prioritizes our strategic, preventable, and external risks (including new or changing regulations). The ERM Framework enables a clear understanding of the top risks and the exposure they have to our performance and strategic decisions. The ERM Framework is reviewed annually as part of a risk assessment that is presented to our Board.


text: Our ERM Framework describes the roles and responsibilities of the Integrated Risk Management Council, a cross-functional group of senior enterprise risk leaders, which meets regularly to review and discuss significant risk facing our business, including cybersecurity risk. Our Integrated Risk Management Council, which includes our Chief Information Security Officer ("CISO") proactively identifies, assesses and prioritizes key or emerging risks, which are then escalated to senior management as needed and, in the case of cybersecurity risk, reported to the Nominating Governance & Sustainability Committee or our full Board.


text: The Nominating, Governance and Sustainability Committee of our Board (the "NG&S Committee") is responsible for assisting the Board with respect to designated risk oversight matters, including privacy and cybersecurity. The NG&S Committee receives reports from, and meets at least twice a year and as needed with, the CISO and the Chief Privacy Officer. The CISO and the Chief Privacy Officer inform the NG&S Committee, which in turn informs our Board, of risks from cybersecurity threats during such meetings. The NG&S Committee reports to our full Board following each of its regularly scheduled meetings at a minimum and reviews with our Board significant issues or concerns that arise at NG&S Committee meetings.


text: Our cybersecurity organization is led by our CISO. Our CISO leads a global team to develop our strategic cybersecurity priorities and execute operational plans. He has over 25 years of cybersecurity experience in the healthcare, finance and telecommunications industries and in government. Prior to his role at Kenvue, our CISO spent over ten years at J&J in cybersecurity, and he retired from the United States Air Force Reserves in 2018 as a Lieutenant Colonel, where he had responsibility for cybersecurity. He is a Certified Information Systems Security Professional and holds a Masters in Telecommunications Management from the University of Maryland, University College. The members of the cybersecurity organization have decades of experience selecting, deploying, and operating cybersecurity technologies, initiatives, and processes around the world, and rely on threat intelligence as well as other information obtained from governmental, public or private sources, including external consultants.


text: Notwithstanding our cybersecurity measures, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. For a discussion of cybersecurity risks, see Item 1A, "Risk Factors —Risks Related to Our Operations—An information security incident, including a cybersecurity breach, or the failure, interruption, breakdown, invasion, corruption, destruction, or breach of an information technology system owned or operated by us or a third party, could adversely affect our business, results of operations or financial condition."


text: Risk Management and Strategy Our process for assessing, identifying, and managing material risks from cybersecurity threats is integrated into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. Our cybersecurity organization continually evaluates and addresses cybersecurity risk in alignment with our business objectives to address the evolving regulatory landscape and emerging risks, including those resulting from geopolitical shifts and technological innovations such as the growth of cloud technologies and artificial intelligence. We maintain a formal cybersecurity training program, including annual trainings for all Kenvuers, covering, among other topics, phishing, email security, and data privacy. We employ automation, and we also engage our internal audit function and a range of external consultants and other expert third parties in connection with the evaluation and management of cybersecurity risk and the maturation of our cybersecurity program.


text: Our cybersecurity organization assesses, monitors, and manages cybersecurity risk through technical, physical, and administrative controls, including implementing cybersecurity policies, procedures, and strategies, with the ultimate goal of preventing cybersecurity incidents to the extent feasible, while increasing our system resilience in an effort to minimize business impact should an incident occur. The underlying controls of the cybersecurity risk management program are based on recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology Cybersecurity Framework. In addition, we maintain a Data Incident Response Program, which is designed to identify, assess, manage, and report significant data incidents, including those reasonably likely to affect our business strategy, results of operations, or financial condition. In the event of a cybersecurity incident, our cybersecurity team assesses, among other factors, safety impact, supply chain and manufacturing disruption, data and personal information loss, business operations disruption, projected cost, and potential for reputational harm, with support from external technical and legal advisors and law enforcement, as appropriate. The Data Incident Response Program outlines the steps to be followed from incident detection to mitigation, recovery, and notification, including notifying functional areas, senior management, and the Company's Disclosure Committee or a sub-committee thereof as appropriate. The Disclosure Committee or a sub-committee thereof will consider the materiality of an incident elevated by the Data Incident Response Program, inform our Board and other key stakeholders as appropriate, and determine the Company's reporting obligation on a timely basis. Our organization tests and monitors these processes, including through table-top exercise testing with senior leaders.


text: We rely heavily on our supply chain to deliver our products to our customers and consumers, and a cybersecurity incident at a supplier or partner could materially adversely impact us. As such, we have processes in place to oversee and identify risks from cybersecurity threats associated with suppliers and our use of third-party service providers, including through our Supplier Cyber Risk Assessment process, which assesses third-party cybersecurity controls through a combination of risk assessment questionnaires, commercially available risk data, and proprietary algorithms. We also include security and privacy addendums to our contracts where applicable. We require that our suppliers and partners report cybersecurity incidents to us so that we can assess the impact of such an incident on us and have dedicated processes to respond to cybersecurity incidents at third parties.


text: Risks from cybersecurity threats did not materially affect our results of operations or financial condition during the fiscal twelve months ended December 29, 2024.


text: Cybersecurity-related risks are one of the key risks contemplated by our Enterprise Risk Management ("ERM") Framework. The ERM Framework informs our strategic planning activities through a collaborative risk management environment that proactively identifies and prioritizes our strategic, preventable, and external risks (including new or changing regulations). The ERM Framework enables a clear understanding of the top risks and the exposure they have to our performance and strategic decisions. The ERM Framework is reviewed annually as part of a risk assessment that is presented to our Board.


text: Our ERM Framework describes the roles and responsibilities of the Integrated Risk Management Council, a cross-functional group of senior enterprise risk leaders, which meets regularly to review and discuss significant risk facing our business, including cybersecurity risk. Our Integrated Risk Management Council, which includes our Chief Information Security Officer ("CISO"), proactively identifies, assesses, and prioritizes key or emerging risks, which are then escalated to senior management as needed and, in the case of cybersecurity risk, reported to our Board's Nominating, Governance & Sustainability Committee (the "NG&S Committee") or our full Board.


text: The NG&S Committee is responsible for assisting our Board with respect to designated risk oversight matters, including privacy and cybersecurity. The NG&S Committee receives reports from, and meets at least twice a year and as needed with, the CISO and the Chief Privacy and Digital Officer ("CPDO"). The CISO and the CPDO inform the NG&S Committee, which in turn informs our Board, of risks from cybersecurity threats during such meetings. The NG&S Committee reports to our full Board following each of its regularly scheduled meetings at a minimum and reviews with our Board significant issues or concerns that arise at NG&S Committee meetings. In addition, in February 2025, the CISO and the CPDO reviewed with our Board the cybersecurity and privacy programs, the Data Incident Response Program, and the role of our Board related thereto.


text: Our CISO leads a global cybersecurity organization, which develops our strategic cybersecurity priorities and executes operational plans. Our CISO has over 25 years of cybersecurity experience in the healthcare, finance, and telecommunications industries and in government. Prior to his role at Kenvue, our CISO spent over 10 years at J&J in cybersecurity, and he retired from the United States Air Force Reserves in 2018 as a Lieutenant Colonel, where he had responsibility for cybersecurity. He is a Certified Information Systems Security Professional and holds a Masters in Telecommunications Management from the University of Maryland, University College and a Directorship Certification from the National Association of Corporate Directors. Our CPDO has over 10 years of privacy and digital legal experience. Prior to his role at Kenvue, our CPDO worked for over 15 years in J&J's Law Department. He also worked as a lawyer in private practice at the law firm Linklaters LLP, in industry associations, and in government, and he acted as Vice Chair of the Consumer Goods Privacy+ Consortium, an association developing compliance strategies and best practices to meet requirements of global privacy laws. He holds a Juris Doctor from Luiss Guido Carli University (Rome, Italy) and a Master of Laws in European Law and Economic Analysis from the College of Europe (Bruges, Belgium). The other members of the cybersecurity organization have decades of experience selecting, deploying, and operating cybersecurity technologies, initiatives, and processes around the world, and rely on threat intelligence as well as other information obtained from governmental, public, or private sources, including external consultants.


text: Notwithstanding our cybersecurity measures, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. For a discussion of cybersecurity risks, see Part I, Item 1A, "Risk Factors—Risks Related to Our Operations—An information security incident, including a cybersecurity breach, or the failure of an information technology or operational technology system owned or operated by us or a third party, could adversely affect us."


text: Our operations are highly dependent on the information systems and technology of Blue Owl, the indirect affiliate of our Adviser, which has implemented a cybersecurity management program. Below are details Blue Owl has provided to us regarding its cybersecurity program that are relevant to us.

companyName: Blue Owl Real Estate Net Lease Trust


text: Cybersecurity Processes and Risk Assessment Blue Owl's cybersecurity program is focused on (i) protecting the confidentiality of business, client, investors in its funds and its employee information; (ii) maintaining the security and availability of systems and data; (iii) supporting compliance with applicable laws and regulations; (iv) documenting cybersecurity incidents and its responses; and (v) notification of cybersecurity incidents to, and communications with, appropriate internal and external parties.


text: Blue Owl has implemented an information security governance policy (the "ISG Policy") governing cybersecurity risk, which is designed to facilitate the protection of sensitive or confidential business, client, investor and any employee information that it stores or processes, and the maintenance of critical services and systems. Blue Owl's cybersecurity program is managed by Blue Owl's Chief Technology Officer and Blue Owl's Head of Technology Infrastructure (together, "Blue Owl IT Management"), who report to Blue Owl's Chief Operating Officer. Blue Owl IT Management and their team are responsible for implementing Blue Owl's monitoring and alert response processes, vulnerability management, changes made to its critical systems, including software and network changes, and various other technological and administrative safeguards. These processes and systems are designed to protect against unauthorized access of information, including by cyber-attacks, and Blue Owl's policy and processes include, as appropriate, encryption, data loss prevention technology, authentication technology, entitlement management, access control, anti-virus and anti-malware software, and transmission of data over private networks. Blue Owl's processes and systems aim to prevent or mitigate two main types of cybersecurity risk: first, cybersecurity risks associated with its physical and digital devices and infrastructure and second, cybersecurity risks associated with third parties, such as people and organizations who have access to its devices, infrastructure or confidential or sensitive information. The cybersecurity-control principles that form the basis of Blue Owl's cybersecurity program are informed by the National Institute of Standards and Technology Cybersecurity Framework ("NIST").


text: Blue Owl's cybersecurity program includes review and assessment by third parties of the cybersecurity processes and systems. These third parties assess and report on Blue Owl's compliance with applicable laws and regulations and its internal incident response preparedness, including benchmarking to best practices and industry frameworks and helping identify areas for continued focus and improvement. Annual penetration testing of its network, including critical systems and systems that store confidential or sensitive information, is conducted with third party consultants and vulnerabilities are reviewed by Blue Owl IT Management for remediation. When Blue Owl engages vendors and other third-party partners who will have access to sensitive data or client systems and facilities, its infrastructure technology team assesses their cybersecurity programs and processes.


text: Blue Owl also provides its employees with cybersecurity awareness training at onboarding and annually, as well as interim security reminders and alerts. Blue Owl conducts regular phishing tests and provides additional training as appropriate.


text: Governance and Oversight of Cybersecurity Risks Blue Owl has developed an incident response framework to identify, assess and manage cybersecurity events. The framework is managed and implemented by Blue Owl's Cyber Risk Operating Committee (the "C-ROC"), a cross-functional management committee that includes its General Counsel, Chief Operating Officer, Chief Compliance Officer and Blue Owl IT Management. The C-ROC is responsible for gathering information with respect to a cybersecurity incident, assessing its severity and potential responses, as well as communicating with business heads and senior management, as appropriate. This framework contemplates conducting simulated cybersecurity incident response exercises with members of senior management on an interim basis in coordination with external cyber counsel.


text: Blue Owl's cybersecurity program, which is overseen by the C-ROC, is managed by an internal team that is responsible for enterprise-wide cybersecurity strategy, policies, engineering and processes. The team is led by Blue Owl's Chief Technology Officer, who has over 25 years of experience advising on technology strategy, including digital transformation, cybersecurity, business analytics and infrastructure, and Blue Owl's Head of Technology Infrastructure, who has over 20 years of experience in the information technology field with a focus on IT risk governance and management, information security, incident response capabilities and assessing effectiveness of controls. The C-ROC meets regularly and forms cross-enterprise teams, as needed, to manage and implement key policies and initiatives of Blue Owl's cybersecurity program.


text: Our Board of Trustees has delegated the primary responsibility for oversight and review of guidelines and policies with respect to risk assessment and risk management to the Audit Committee. Blue Owl's Chief Technology Officer periodically reports to the Audit Committee as well as our full Board of Trustees, as appropriate, on cybersecurity matters. Such reporting includes updates on Blue Owl's cybersecurity program, the external threat environment and Blue Owl's programs to address and mitigate the risks associated with the evolving cybersecurity threat environment. These reports also include updates on Blue Owl's preparedness, prevention, detection, responsiveness and recovery with respect to cyber incidents.


text: Impact of Cybersecurity Risks In 2023, we did not experience a material cybersecurity incident, and we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business. However, future incidents could have a material impact on our business strategy, results of operations or financial condition. For additional discussion of the risks posed by cybersecurity threats, see "Part I. Item 1A. Risk Factors—Risks Related to Our Business and Operations—Cybersecurity risks and cyber incidents could adversely affect our business by causing a disruption to our operations, a compromise or corruption of our confidential information and confidential information in our possession and damage to our business relationships." and "Part I. Item 1A. Risk Factors—Risks Related to Our Business and Operations—Increased data protection regulation may result in increased complexities and risks in connection with the operation of our business and products."


text: Cybersecurity Processes and Risk Assessment Blue Owl's cybersecurity program is focused on (i) protecting confidential business, client, investor and employee information that they store or process; (ii) maintaining the security and availability of systems and data; (iii) supporting compliance with applicable laws and regulations; (iv) documenting cybersecurity incidents and its responses; and (v) notification of cybersecurity incidents to, and communications with, appropriate internal and external parties.


text: Blue Owl has implemented an information security governance policy (the "ISG Policy") governing cybersecurity risk, which is designed to facilitate the protection of sensitive or confidential business, client, investor and any employee information that it stores or processes, and the maintenance of critical services and systems. Blue Owl's cybersecurity program is managed by Blue Owl's Chief Technology Officer and Blue Owl's Head of Technology Infrastructure (together, "Blue Owl IT Management"), who report to Blue Owl's Chief Operating Officer. Blue Owl IT Management and their team are responsible for implementing proactive and reactive measures, including Blue Owl's monitoring and alert response processes, vulnerability management, changes made to its critical systems, including software and network changes, and various other technological and administrative safeguards. These cybersecurity processes and systems are designed to protect against unauthorized access of information, including by cyber-attacks. Blue Owl's policy and processes include, as appropriate, encryption, data loss prevention technology, authentication technology, entitlement management, access control, anti-virus and anti-malware software, and transmission of data over private networks. Blue Owl's processes and systems aim to prevent or mitigate two main types of cybersecurity risk: first, cybersecurity risks associated with its physical and digital devices and infrastructure, and second, cybersecurity risks associated with third parties, such as people and organizations who have access to its devices, infrastructure or confidential or sensitive information. The cybersecurity-control principles that form the basis of Blue Owl's cybersecurity program are informed by the National Institute of Standards and Technology Cybersecurity Framework ("NIST").


text: Blue Owl's cybersecurity program includes review and assessment by third parties of the cybersecurity processes and systems. These third parties assess and report on Blue Owl's compliance with applicable laws and regulations and its internal incident response preparedness, including benchmarking to best practices and industry frameworks and helping identify areas for continued focus and improvement. Annual penetration testing of its network, including critical systems and systems that store confidential or sensitive information, is conducted with third party consultants and vulnerabilities are reviewed and addressed by Blue Owl IT Management. When Blue Owl engages vendors and other third-party partners who will have access to sensitive data or client systems and facilities, its infrastructure technology team assesses their cybersecurity programs and processes.


text: Blue Owl also provides its employees with cybersecurity awareness training at onboarding and annually, as well as interim security reminders and alerts. Blue Owl conducts regular phishing tests and provides additional training as appropriate. Blue Owl has a process designed to assess the cybersecurity risks associated with the engagement of third-party vendors. This assessment is conducted on the basis of, among other factors, the types of services provided and the extent and type of data accessed or processed by a third-party vendor.


text: Governance and Oversight of Cybersecurity Risks Blue Owl has developed an incident response framework to identify, assess, manage, and report cybersecurity events, which is managed and implemented by Blue Owl's Cyber Risk Operating Committee (the "C-ROC"), a cross-functional management committee that includes its General Counsel, Chief Operating Officer, Chief Compliance Officer and Blue Owl IT Management. The incident response framework determines when the C-ROC should provide notifications regarding certain cybersecurity incidents, with different severity thresholds triggering notifications to different recipient groups, including senior members of Blue Owl's management, their Audit Committee or their Board of Directors. The C-ROC is responsible for gathering information with respect to a cybersecurity incident, assessing its severity and potential responses, as well as communicating with senior members of Blue Owl's management, their Audit Committee or their Board of Directors, as appropriate. This framework contemplates conducting simulated cybersecurity incident response exercises with members of senior management on an interim basis in coordination with external cyber counsel.


text: Blue Owl's cybersecurity program, which is overseen by the C-ROC, is managed by Blue Owl's IT Management as part of its responsibility for enterprise-wide cybersecurity strategy, policies, implementing the monitoring and alert response processes, vulnerability management, changes made to critical systems, including software and network changes and various other technological and administrative safeguards. The team is led by Blue Owl's Chief Technology Officer, who has over 25 years of experience advising on technology strategy, including digital transformation, cybersecurity, business analytics and infrastructure, and Blue Owl's Head of Technology Infrastructure, who has over 20 years of experience in the information technology field with a focus on IT risk governance and management, information security, incident response capabilities and assessing effectiveness of controls. The C-ROC meets regularly and forms cross-enterprise teams, as needed, to manage and implement key policies and initiatives of Blue Owl's cybersecurity program.


text: Our Board of Trustees has delegated the primary responsibility for oversight and review of guidelines and policies with respect to risk assessment and risk management, including cybersecurity risk, to the Audit Committee. Blue Owl's Chief Technology Officer periodically reports to the Audit Committee as well as our full Board of Trustees, as appropriate, on cybersecurity matters. Such reporting includes updates on Blue Owl's cybersecurity program, the external threat environment and Blue Owl's programs to address and mitigate the risks associated with the evolving cybersecurity threat environment. These reports also include updates on Blue Owl's preparedness, prevention, detection, responsiveness and recovery with respect to cyber incidents.


text: Impact of Cybersecurity Risks In 2024, we did not experience a material cybersecurity incident, and we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business. While we do not believe that our business strategy, results of operations or financial condition have been materially adversely affected by any cybersecurity incidents, we describe whether and how future incidents could have a material impact on our business strategy, results of operations or financial condition in "Part I. Item 1A. Risk Factors—Risks Related to Our Business and Operations—Cybersecurity risks and cyber data security incidents could adversely affect our business by causing a disruption to our operations, a compromise or corruption of our confidential information and confidential information in our possession and damage to our business relationships." and "Part I. Item 1A. Risk Factors—Risks Related to Our Business and Operations—Increased data protection regulation may result in increased complexities and risks in connection with the operation of our business and products."


text: Risk Management and Strategy The Company recognizes the importance of developing, implementing, and maintaining cybersecurity measures to safeguard our information and operational technologies and protect the confidentiality, integrity, and availability of our data. Our business is dependent upon our computer systems, devices, software and networks (operational and information technology) to collect, process and store the data necessary to conduct almost all aspects of our business, including the evaluation of acquisition and development opportunities, the monitoring and evaluation of our existing properties and the performance of and data from our operators and the recording and reporting of financial information.

companyName: Vitesse Energy, Inc.

ticker: VTS


text: Assessing, Identifying and Managing Material Cybersecurity Risks & Integrated Overall Risk Management. We have processes in place to assess, identify, manage, and address material cybersecurity threats and incidents. These include, among other things: annual and ongoing security awareness training for employees mechanisms to detect and monitor unusual network activity and containment and incident response tools. We regularly assess risks from cybersecurity and technology threats and monitor our information systems for potential vulnerabilities. We monitor issues that are internally discovered or externally reported that may affect our systems, and have processes to assess those issues for potential cybersecurity impact or risk.


text: The Company has integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration is designed to include cybersecurity considerations as part of our decision-making processes at every level. Our IT department seeks to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs and coordinates with our overall risk management framework.


text: In the event of a cybersecurity incident, we maintain an incident response plan. This plan sets forth immediate actions to mitigate the impact of cybersecurity incidents, including referring certain matters to the Company's Chief Executive Officer ("CEO") for additional evaluation and oversight, as well as long-term strategies for remediation and prevention of future cybersecurity incidents.


text: Engaging Third Parties on Cybersecurity Risk Management. Recognizing the complexity and evolving nature of cybersecurity threats, the Company engages with a range of third-party service providers, including cybersecurity assessors, and consultants, in evaluating and testing our cybersecurity risk management systems. This enables us to leverage knowledge and insights with the goal of aligning our cybersecurity strategies and processes with best practices for our industry and size. Accordingly, we engage third-party service providers for regular cybersecurity-related audits, threat assessments, and consultation on security enhancements.


text: Overseeing Third-Party Risk. Because we are aware of the risks associated with engaging third-party service providers, the Company has implemented processes designed to oversee and manage these risks. It is our policy to conduct security assessments of all third-party service providers before engagement and we aim to maintain ongoing monitoring for compliance with our cybersecurity standards. This monitoring includes regular assessments by our Director of Infrastructure and Cybersecurity.


text: Cybersecurity Threats. As of the date of this Annual Report on Form 10-K, though the Company and our service providers have experienced certain cybersecurity incidents, we are not aware of any previous cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including our operations or financial condition. We acknowledge that cybersecurity threats are continually evolving, and the possibility of future cybersecurity incidents remains. Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cybersecurity attack will not occur. While we devote resources to our security measures designed to protect our systems and information, no security measure is infallible. See Item 1A. Risk Factors "Risk Factors Relating to Our Business—We depend on computer and telecommunications systems, and failures in our systems or cyber security threats, attacks or other disruptions could significantly disrupt our business operations." for additional information about the risks to our business associated with a breach or other compromise to our information and operational technology systems.


text: Board of Directors Oversight. The Board has overall responsibility for the oversight of risk management at Vitesse, which includes cybersecurity risks. The Board receives periodic briefings on cybersecurity matters, including key risks to the Company, recent developments, and risk mitigation activities from members of management, who are responsible for overseeing our cybersecurity program. In addition, the Board receives annual briefings from our Director of Infrastructure and Cybersecurity,on our cybersecurity program. Our internal auditor also reports to the Audit Committee on the internal controls and procedures that are implemented to assess and mitigate cybersecurity risk on an as needed basis.


text: Management's Role. Our cybersecurity risk assessment and management efforts are led by our Director of Infrastructure and Cybersecurity, who is responsible for implementing and overseeing processes for the monitoring of our information systems. This includes responsibility for the deployment of cybersecurity measures and system audits to identify potential cybersecurity vulnerabilities. Our IT Department, including our Director of Infrastructure and Cybersecurity, reports directly to our CEO. Our Director of Infrastructure and Cybersecurity has significant experience in the field of information technology and is an ISACA Certified Information Security Manager (CISM).


text: Board of Directors Oversight. The Board has overall responsibility for the oversight of risk management at Vitesse, which includes cybersecurity risks. The Board receives periodic briefings on cybersecurity matters, including key risks to the Company, recent developments, and risk mitigation activities from members of management, who are responsible for overseeing our cybersecurity program. In addition, the Board receives annual briefings from our Director of Infrastructure and Cybersecurity, on our cybersecurity program. Our internal auditor also reports to the Audit Committee on the internal controls and procedures that are implemented to assess and mitigate cybersecurity risk on an as needed basis.


text: We have processes in place to assess, identify, and manage material risks from cybersecurity threats. Our business is dependent on the communications and information systems of the Adviser and other third-party service providers. The Adviser manages the our day-to-day operations and has implemented a cybersecurity program that applies to us and our operations.

companyName: Willow Tree Capital Corp


text: Governance and Oversight of Cybersecurity Risk The Adviser has instituted a cybersecurity program, overseen by the Adviser's Chief Compliance Officer ("CCO"), which is designed to assess, identify, and manage material cyber risks applicable to us. The cyber risk management program involves risk assessments, identification of sensitive information assets ("Critical Information"), implementation of security measures, and ongoing monitoring of systems and networks, including networks on which we rely on. The Adviser actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by us.


text: We rely on the Adviser to engage external experts, including cybersecurity consultants, to evaluate cybersecurity measures and risk management processes, and depends on and engages various third parties, including suppliers, vendors, and service providers. The Adviser conducts ongoing due diligence of its significant service providers to determine whether the cybersecurity programs of service providers include, among other things, procedures and safeguards designed to ensure the protection of Critical Information.


text: Our Board would be made aware of any material risks associated with cybersecurity threats. Our Board currently receives periodic updates from our CCO regarding the overall state of the Adviser's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting us.


text: Our management team, including our CCO, is responsible for assessing and managing material risks from cybersecurity threats. Our CCO, in managing such risks relating to cybersecurity threats, relies on the assistance provided by the Adviser.


text: Our management team is informed about and monitors the prevention, detection, mitigation, and remediation of material cybersecurity incidents impacting us, including through the receipt of notifications from service providers and reliance on communications with legal, information technology, and/or compliance personnel of the Adviser.


text: Impact of Cybersecurity Risk The potential impact of risks from cybersecurity threats on us are assessed on an ongoing basis, and how such risks could materially affect our business strategy, results of operations, and financial condition are regularly evaluated. During the reporting period, we have not identified any material risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that we believe have materially affected, or are reasonably likely to materially affect, us, including our business strategy, results of operation, and financial condition.


text: Risk Management and Strategy As an externally managed company, our day-to-day operations are managed by our Adviser and our executive officers under the oversight of our board of directors. We rely on IT systems, data hosting and other hardware and software platforms which are hosted by EQT, the parent company of our Advisor. As such, we are reliant on EQT for assessing, identifying and managing cybersecurity risk as part of its overall Risk Management Framework.

companyName: EQT Exeter Real Estate Income Trust, Inc.