text: Emergency Management, Incident Response and Cyber Insurance – The Company has invested in technology and processes for timely incident response to security and crisis events. Physical and cybersecurity staff, health and safety, legal, operational and human resources personnel are part of the overall emergency and incident response team. The Company has partnerships with third parties for forensics, and incident response consulting. The Company also maintains effective levels of cyber insurance against large data breaches or cybersecurity events.


text: Service and Business Continuity – The Company conducts service continuity exercises and monitors network fault and performance 24 hours a day, 365 days a year to quickly detect and respond to service degradation or impairment. A set of business continuity plans and scenarios are also in place to address catastrophic events to personnel, critical infrastructure, and applications. The Company conducts periodic internal tabletop exercises and joint exercises with customers. Business continuity efforts are overseen by the Company's Business Continuity Committee following policy set by the Company's Security Council.

companyName: CINCINNATI BELL INC

secItem: Item 1C


text: In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors– Intellectual Property Tax, Regulatory, and Litigation Risks" in this annual report on Form 10-K.


text: Website Access and Other Information The Company was incorporated under the laws of Ohio in 1983 with its headquarters at 221 East Fourth Street, Cincinnati, Ohio 45202 (telephone number (513) 397-9900 and website address http://www.altafiber.com). The Company has ceased to be subject to the reporting requirements of the Securities Exchange Act of 1934, as amended, but continues to voluntarily file annual, quarterly and certain other information with the SEC due to contractual provisions included in certain indentures. The SEC maintains an internet site that contains reports, proxy statements, and other information about issuers which file electronically with the SEC. The address of that site is http://www.sec.gov. Cincinnati Bell Inc.


text: The Company's information is primarily maintained by PSCM, which has implemented robust information security controls, frequent testing, periodic assessments and advanced monitoring of information security threats to protect the Company's sensitive information. In addition, PSCM has formed an Information Security Committee (the "InfoSec Committee"), which consists of the Chief Technology Officer, the Chief Compliance Officer, the President and a Compliance Officer. The InfoSec Committee is responsible for developing and overseeing the implementation of controls, policies and procedures, evaluating and addressing ongoing information security-related risks and periodically reviewing the effectiveness of the information security policies and procedures that protect the Company's information. In preparing and approving PSCM's information security policies and procedures, the InfoSec Committee has relied upon guidelines published by the National Institute of Standards and Technology and the International Organization for Standardization, guidance issued by the SEC and National Futures Association and industry practice. The InfoSec Committee provides periodic reports to the Board which include updates on cyber risks and threats, system upgrades, assessments of the information security program and the emerging threat landscape.

companyName: Pershing Square SPARC Holdings, Ltd./DE


text: Additionally, prior to engaging any vendor that will store sensitive Company information, PSCM performs due diligence on the vendor's information security infrastructure and requires that the vendor agree contractually that the Company's information will be encrypted in transit and at rest and that the appropriate user access controls will apply. As of the date of this report, we are no t aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition.


text: Assessment, Identification and Management of Material Risks from Cybersecurity We rely on the cybersecurity strategy and policies implemented by Inland. Inland's cybersecurity strategy prioritizes detection and analysis of and response to known, anticipated or unexpected threats, effective management of security risks and resilience against cyber incidents. Inland's cybersecurity risk management processes include technical security controls, policy enforcement mechanisms, monitoring systems, tools and related services, which include tools and services from third-party providers, and management oversight to assess, identify and manage risks from cybersecurity threats. Inland has implemented and continues to implement risk-based controls designed to prevent, detect and respond to information security threats and we rely on those controls to help us protect our information, our information systems, and the information of our investors, and other third parties who entrust us with their sensitive information.

companyName: IPC Alternative Real Estate Income Trust, Inc.


text: Inland's cybersecurity program includes physical, administrative and technical safeguards, as well as plans and procedures designed to help our sponsor and Advisor to prevent and timely and effectively respond to cybersecurity threats and incidents, including threats or incidents that may impact us, our Advisor, and Dealer Manager. Inland's cybersecurity risk management process seeks to monitor cybersecurity vulnerabilities and potential attack vectors, evaluate the potential operational and financial effects of any threat and mitigate such threats. The assessment of cybersecurity risks, including those which may impact us, our Advisor, and Dealer Manager, is integrated into Inland's risk management program. In addition, Inland periodically engages with third-party consultants and key vendors to assist it in assessing, enhancing, implementing, and monitoring its cybersecurity risk management programs, including performing penetration testing of Inland's networks, and security assessments of the effectiveness of Inland's information technology environment to identify potential vulnerabilities.


text: Inland's cybersecurity risk management and awareness programs include periodic identification and testing of vulnerabilities as well as regular phishing simulations for all of the employees of the Advisor and its affiliates. Inland undertakes periodic internal security reviews of its information systems and related controls, including systems affecting personal data and the cybersecurity risks of our Advisor, and Dealer Manager, and our critical third-party vendors (including the transfer agent) and other partners.


text: Inland has established a Computer Security Incident Response Team ("Inland CSIRT"), which aims to manage and mitigate the impact of cybersecurity breach events, including those arising from or impacting our Advisor, Dealer Manager and service providers (including the transfer agent), tenants, and other business contacts. Members of the Inland CSIRT include Inland's VP Director of IT Infrastructure & Information Security, who has more than 20 years of experience in information technology security and leads Inland's cybersecurity program, and its Head of Technology Strategy, as well as members of the firm's legal, risk, and communications groups. Inland has established a notification decision framework to determine when the Inland CSIRT will provide notifications regarding certain cybersecurity incidents, with different severity thresholds triggering notifications to different recipient groups, including members of our Advisor's management, and our Board and Audit Committee, as appropriate.


text: Oversight of Cybersecurity Risks The Board and our Audit Committee oversee our cybersecurity risk exposures and the steps taken by management to identify, monitor and mitigate cybersecurity risks to align our risk exposure with our strategic objectives. With respect to such cybersecurity risk oversight, our Board and/or our Audit Committee receive periodic reports and/or updates from management on the primary cybersecurity risks facing us and the Advisor, and the Dealer Manager and the measures we, the Advisor, and the Dealer Manager are taking to mitigate such risks. In addition to such reports and updates, our Board and/or our Audit Committee receive updates from management as to changes to our and the Advisor's and the Dealer Manager's cybersecurity risk profile or certain newly identified risks. In the event of an incident, we intend to follow Inland's incident response plan, which outlines the steps to be followed from incident identification, mitigation, recovery and notification to legal counsel, senior leadership and the Board or Audit Committee, as appropriate.


text: Impact of Cybersecurity Risks As of the date of this filing, we have not experienced a material information security breach incident and the expenses we have incurred from information security breach incidents have been immaterial, and we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business. However, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on our business, financial condition, results of operations, or cash flows. See "Part I, Item 1A, Risk Factors, Risks Related to Our Organizational Structure" for more information regarding cybersecurity risks.


text: Fidelity and its Enterprise Cybersecurity organization, on behalf of the Fund, have established a comprehensive risk management program, which includes processes to identify, assess, and manage cybersecurity risks, including material risks from cybersecurity threats, and to put in place appropriate controls to mitigate these risks and reduce the potential impact to the Fund and its Members. The Fund does not currently have any employees and relies upon Fidelity and its Enterprise Cybersecurity organization for the Fund's day-to-day operations and to establish strategies, policies, and standards for the security of, and operations in, cyberspace.

companyName: Fidelity Private Credit Co LLC


text: The Fund depends on and engages various third parties, including suppliers, vendors, and service providers, to operate its business. Through its vendor management program, and on behalf of the Fund, Fidelity oversees and identifies risks from cybersecurity threats associated with the use of third-party service providers. This vendor oversight program includes periodic reviews of the cybersecurity controls of third-party service providers, The frequency of such reviews is generally based on the nature of the Fund's information processed by the vendor and the vendor's criticality to business operations.


text: On behalf of the Fund, Fidelity engages third-party consultants to assess, identify, and/or manage material risks from cybersecurity threats. For example, Fidelity engages third-party consultants to perform audits of its cybersecurity measures and risk management processes, including those applicable to the Fund. Fidelity has also hired qualified independent assessors to review applicable security controls in accordance with the AICPA's System and Organization Controls assurance programs. Additionally, Fidelity utilizes third-party consultants with specific areas of cybersecurity expertise to review and report on various aspects of its cybersecurity program, including those applicable to the Fund. The results of these consulting engagements are shared with the Fund's Board of Directors as part of periodic reports.


text: Fidelity's Enterprise Cybersecurity organization has a threat intelligence program which monitors for emerging cyber threats. Taking information gathered from public and private sources, including industry groups such as the U.S. Cybersecurity and Infrastructure Security Agency and the Financial Services Information Sharing and Analysis Center, the organization analyzes such information and incorporates tactics, techniques, and procedures into the program's security monitoring and detection tools and processes.


text: The potential impact of risks from cybersecurity threats on the Fund are assessed on an ongoing basis, and how such risks could materially affect the Fund's business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, the Fund did not identify any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Fund, including its day-to-day operations, financial condition, and business strategies. In conjunction with Fidelity's Enterprise Cybersecurity organization, the Fund participates in regular testing of applicable incident response processes to ensure appropriate escalation, mitigation, communication and reporting processes are in place.


text: The Board provides strategic oversight regarding cybersecurity risks and threats. The Board receives and reviews periodic reports from senior executives in Fidelity's Enterprise Cybersecurity organization and the Fund's management, including Fidelity's Chief Information Security Officer ("CISO"), members of the CISO's staff and the Fund's CCO. These reports contain information about risks from cybersecurity threats, including the results of recent independent reviews of the cybersecurity program, summaries of recent cybersecurity threat intelligence assessments, progress on key initiatives and strategies, and updates on recent regulatory activities, including new regulations and examinations.


text: The Fund's management, including the CCO of the Fund, is responsible for assessing and managing material risks from cybersecurity threats. In connection with the Fund's reliance on Fidelity and its Enterprise Cybersecurity organization, the CCO relies on the cybersecurity expertise of Fidelity's CISO and members of the CISO's staff to assist in assessing and managing the Fund's material risks from cybersecurity threats. The CISO has over thirty years of experience as a technology and information risk management leader, holding global senior management roles with large, diversified financial services companies. He has served as Fidelity's CISO since May 2024. The CCO has been responsible for this oversight function as CCO to the Fund for three years and has worked in the financial services industry for sixteen years, during which the CCO has gained expertise in assessing and managing risks applicable to the company.


text: Management of the Fund is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Fund, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, information technology, and/or compliance personnel of Fidelity. The Board is also made aware of material cybersecurity incidents which impacted the Fund.


text: Fidelity and its Enterprise Cybersecurity organization, on behalf of the Fund, have established a comprehensive risk management program, which includes processes to identify, assess, and manage cybersecurity risks, including material risks from cybersecurity threats, and to put in place appropriate controls to mitigate these risks and reduce the potential impact to the Fund and its shareholders. The Fund does not currently have any employees and relies upon Fidelity and its Enterprise Cybersecurity organization for the Fund's day-to-day operations and to establish strategies, policies, and standards for the security of, and operations in, cyberspace.

companyName: Fidelity Private Credit Fund


text: On behalf of the Fund, Fidelity engages third-party consultants to assess, identify, and/or manage material risks from cybersecurity threats. For example, Fidelity engages third-party consultants to perform audits of its cybersecurity measures and risk management processes, including those applicable to the Fund. Fidelity has also hired qualified independent assessors to review applicable security controls in accordance with the AICPA's System and Organization Controls assurance programs. Additionally, Fidelity utilizes third-party consultants with specific areas of cybersecurity expertise to review and report on various aspects of its cybersecurity program, including those applicable to the Fund. The results of these consulting engagements are shared with the Fund's Board of Trustees as part of periodic reports.


text: The Board provides strategic oversight regarding cybersecurity risks and threats. The Board receives and reviews periodic reports from senior executives in Fidelity's enterprise cybersecurity organization and the Fund's management, including Fidelity's Chief Information Security Officer ("CISO"), members of the CISO's staff and the Fund's CCO. These reports contain information about risks from cybersecurity threats, including the results of recent independent reviews of the cybersecurity program, summaries of recent cybersecurity threat intelligence assessments, progress on key initiatives and strategies, and updates on recent regulatory activities, including new regulations and examinations.


text: The Fund's management, including the CCO of the Fund, is responsible for assessing and managing material risks from cybersecurity threats. In connection with the Fund's reliance on Fidelity and its Enterprise Cybersecurity organization, the CCO relies on the cybersecurity expertise of Fidelity's CISO and members of the CISO's staff to assist in assessing and managing the Fund's material risks from cybersecurity threats. The CISO has over thirty years of experience as a technology and information risk management leader, holding global senior management roles with large, diversified financial services companies. He has served as Fidelity's CISO since May 2024. The CCO has been responsible for this oversight function as CCO to the Fund for three years, and has worked in the financial services industry for sixteen years, during which the CCO has gained expertise in assessing and managing risks applicable to the Fund.


text: Risks related to Cybersecurity Incidents We face significant risks related to cybersecurity threats, which could adversely affect our business, financial condition, and results of operations. Cybersecurity incidents, including but not limited to unauthorized access, data breaches, and other malicious activities, could result in the loss or theft of sensitive information, disruption of our operations, and damage to our reputation. While we have implemented measures to protect our information systems, there can be no assurance that these measures will effectively prevent all cybersecurity incidents.

companyName: ONE STOP SYSTEMS, INC.

ticker: OSS


text: 1. Data Breaches: A breach of our information systems could lead to unauthorized access to customer or employee data, resulting in reputational harm and legal liabilities.


text: 2. Operational Disruption: Cybersecurity incidents could disrupt our operations, leading to delays in production, delivery, or fulfillment of customer orders.


text: 3. Intellectual Property Theft: Unauthorized access to our proprietary information could result in intellectual property theft, which would impact our competitive position in the market.


text: 4. Regulatory and Legal Compliance: Cybersecurity incidents may subject us to regulatory investigations, legal claims, and penalties, affecting our compliance with applicable laws and regulations.


text: 5. Third-Party Relationships: Our reliance on third-party vendors and service providers exposes us to additional cybersecurity risks, and a security breach affecting these entities could impact our operations.


text: Although cybersecurity incidents have not materially impacted our business strategy, results of operations, or financial condition to date, there can be no assurance that they will not do so in the future.


text: Risk Management and Strategy Assessing, Identifying, and Managing Material Cyber Threats We have specific infrastructure, systems, policies, and procedures designed to proactively and reactively address circumstances that arise when unexpected events such as a cybersecurity incident occur. These include processes for assessing, identifying, and managing material risks from cybersecurity threats. We consult with external parties, such as cybersecurity firms and risk management and governance experts, on risk management and strategy. We use a team of outside vendors and government services specializing in IT and cybersecurity that provide expertise, tools, and methodologies to identify and assess vulnerabilities and potential threats. Automated tools and AI-based user behavior analytics also support identifying and managing cyber threats. Response to a broad category of threats is immediate and automatic. Security personnel and members of our management are alerted when cyber threats or anomalies are detected. Persistent threats or issues that, in the opinion of management, are material are immediately brought to the attention of our board of directors.


text: In the event of a detected cyber incident by 24/7 monitoring software or employee notification, our IT and cybersecurity provider performs a detailed assessment of the incident, identifies the source of the problem, and resolves the issue as appropriate. If they cannot resolve the issue, the problem is escalated to our cybersecurity monitoring and detection software provider for resolution. Events that our IT and cybersecurity providers do not routinely resolve are brought to the Board's attention.


text: Critical business and operational data are backed up nightly and securely stored offsite to mitigate the risks of cybersecurity incidents or equipment failure. We provide cybersecurity awareness training to our employees, incident response personnel, and senior management.


text: Our management team, including our Vice President of Technology, is primarily responsible for assessing and managing our material risks from cybersecurity threats. Management supervises our internal cybersecurity and IT personnel and our retained external cybersecurity consultants and vendors. Additionally, they supervise efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefing from internal or external security personnel; threat intelligence and other information obtained from governmental, public, or private sources, including external consultants or vendors engaged by us; and alerts and reports produced by security tools deployed in our IT environment.


text: Our Board of Directors, through its Audit & Risk Committee, provides oversight and oversees management processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Management, including our Vice President of Technology and our Audit & Risk Committee members, regularly brief our board of directors on our cybersecurity and information security posture and cybersecurity incidents deemed to have a moderate or higher business impact, even if viewed as immaterial to us. As cyber threats evolve and become more sophisticated, we believe that the Board's involvement in cybersecurity governance ensures that we adequately focus resources to protect the Company's assets and reputation.


text: Vital aspects of our cybersecurity governance that are currently in process or have been implemented include the following: • Governance and Strategy: Management, the Audit & Risk Committee, and the Board ensure that our cybersecurity strategy is aligned with our business strategy. • Risk Management and Oversight: Our Audit & Risk Committee and the Board, as part of the board's enterprise risk management oversight, actively oversee our cybersecurity risk management framework, ensuring that material risks are identified, assessed, and mitigated. • Resource Allocation: o Budget Approval: The Board reviews and approves cybersecurity budgets and resource allocations to ensure we have adequate resources to implement and maintain effective cybersecurity measures.


text: o Investment Decisions: The Board evaluates and approves significant investments in cybersecurity technologies, training, and talent based on the recommendations of management or our external vendors and consultants. o Regulatory Compliance: Management and the Board oversee compliance with relevant cybersecurity regulations and legal requirements.


text: o Legal Oversight: Management and the Board ensure we have appropriate legal counsel to address cybersecurity-related issues, including incident notification requirements.


text: o Training and Awareness: Management and the Board take reasonable steps to stay informed about cybersecurity trends, threats, and best practices through ongoing education and training. o Management reviews Company employee training programs to ensure employees are trained appropriately and updated on evolving cyber trends. o Board Training: Certain board members have received training to understand cybersecurity risks and their role in overseeing cybersecurity.


text: o Periodic Updates: The Board receives periodic updates from management, responsible staff, and the Audit & Risk Committee regarding the Company's cybersecurity posture, incidents, and risk management efforts.


text: o Communication Strategy: Management and the Board have a communication strategy for addressing cybersecurity disclosures with stakeholders, including customers, employees, and the public.


text: • Performance Evaluation: The Board's annual evaluation of the Chief Executive Officer's performance includes assessing the effectiveness of implementing cybersecurity policy and measures and ensuring that cybersecurity policies and practices are effective and aligned with organizational goals. • Cybersecurity Culture: The Board fosters a cybersecurity-aware culture throughout the organization, supporting management's efforts to integrate risk management, including cybersecurity, into the operating culture.


text: The rapidly evolving nature of cybersecurity threats requires ongoing vigilance, and there can be no assurance that our efforts will prevent all incidents.


text: Management and the Board are evaluating and intend to implement further cybersecurity-related measures, including, without limitation, developing a more robust internal policy framework, incident response plan, crisis management planning, third-party vendor assessments, and contractual obligations for third parties that the Company engages with.


text: Despite these efforts, the rapidly evolving nature of cybersecurity threats requires ongoing vigilance, and there can be no assurance that our efforts will prevent all incidents. In addition to the foregoing, management and the board are evaluating, and intend to implement, further cybersecurity related measures, including without limitation developing a more robust internal policy framework, incident response plan, crisis management planning, and third-party vendor assessments and contractual obligations for third parties that the Company engages with. The Company intends to progress these efforts throughout 2024.


text: We recognize the critical importance of maintaining the trust and confidence of universities, medical institutions, clinical investigators, CROs, strategic collaborators, business partners, employees, and others, and are committed to protecting the confidentiality, integrity and availability of our business operations and systems. Our board of directors is involved in oversight of our risk management activities, and cybersecurity represents an important element of our overall approach to risk management. Our cybersecurity policies, standards, processes and practices are informed, in part, by recognized frameworks established by applicable industry standards. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Damora Therapeutics, Inc.

ticker: DMRA


text: Cybersecurity Risk Management and Strategy We face risks related to cybersecurity such as unauthorized access to information or information technology systems, cybersecurity attacks, and other cybersecurity incidents. Our processes to identify, assess, and manage material cybersecurity risks are informed, in part, by industry cybersecurity standards, including components of the National Institute of Standards and Technology Cybersecurity Framework, ISO 27001 standard, and HIPAA security regulations. Our processes include assessments to identify key risk areas and inform our overall cybersecurity strategy and cybersecurity assessments in connection with our review of key information technology systems. Our processes also include technical security controls, such as network monitoring tools and multi-factor authentication, where appropriate.


text: We conduct due diligence on third-party vendors and service providers that store or process sensitive company information. Our processes include a security review and implementation of procedures to receive and review security updates and alerts from such third parties.


text: We have established an incident response process designed to identify, assess, and respond to cybersecurity incidents. This process includes established roles, responsibilities and procedures to guide incident response operations, and reporting procedures for notifying members of management and the audit committee, where appropriate. We also maintain back-ups and disaster recovery plans designed to restore information in the event of a cybersecurity incident. We have not experienced any cybersecurity incidents, and are not aware of any threats, that have materially affected us or are reasonably likely to materially affect us, during the last fiscal year. However, like other companies in our industry, we and our third-party vendors may from time to time experienced threats and security incidents that could affect our information or systems. We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, in "Item 1A, Risk Factors."


text: Governance Related to Cybersecurity Risks Our board of directors is involved in risk oversight as part of our overall business strategy and has delegated oversight of risk assessment and management to the audit committee. The audit committee administers its risk oversight function by receiving periodic reports from members of senior management. Our audit committee discusses cybersecurity threats and our risk management processes at least annually, receives updates on relevant cybersecurity developments, and considers steps that our management has taken to monitor and manage cybersecurity risk. The full board of directors also discusses with management, identified material cybersecurity risks, their potential impact on us, and the steps we take to manage them. Our audit committee and board of directors also receive prompt and timely information regarding any cybersecurity incident that meets establishing reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.


text: Our Information Technology Administrator, with support from third-party service providers, including our outsourced Data Protection Officer, implements and administers our information security program. Such individuals have collectively over 40 years of prior work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs. These individuals are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response processes. Additionally, our Information Technology Administrator, in conjunction with the Data Protection Officer, provides regular reports to our interim Chief Financial Officer and General Counsel on cybersecurity risks and the implementation of risk management processes. Such management team members report information on such cybersecurity risks and incidents to our audit committee and board of directors as discussed above.


text: We recognize the critical importance of maintaining the trust and confidence of stakeholders toward our business and are committed to protecting the confidentiality, integrity, and availability of our business operations and systems. Our board of directors is actively involved in oversight of our risk management activities, and cybersecurity represents an important element of our overall approach to risk management. Our cybersecurity policies, standards, processes, and practices are based on recognized frameworks established by the National Institute of Standards and Technology, or NIST, and other applicable industry standards. In general, we seek to address cybersecurity risks through a comprehensive approach that is focused on preserving the confidentiality, security, and availability of the information that we collect and store by monitoring, identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: SERA PROGNOSTICS, INC.

ticker: SERA


text: Cybersecurity Risk Management and Strategy; Effect of Risk Like all companies w e face risks related to cybersecurity such as unauthorized access, cybersecurity attacks and other security incidents, loss of data, and misappropriation of confidential information. To identify and assess material risks from cybersecurity threats, we maintain a comprehensive cybersecurity program to ensure our systems are effective and prepared for information security risks, including regular oversight of our programs for security monitoring for internal and external threats to ensure the confidentiality and integrity of our information assets. We consider risks from cybersecurity threats alongside other company risks as part of our overall risk assessment process. We employ a range of tools and services, including third-party real-time risk assessments of cyber assets and mitigation of security risks, data loss prevention, regular air-gapped backups, continuous monitoring and threat response, next generation firewall systems, and security information and event management. As discussed in more detail under "Cybersecurity Governance" below, our audit committee provides oversight of our cybersecurity risk management and strategy processes, which are led by our Chief Information Officer.


text: We also identify our cybersecurity threat risks by comparing our processes to standards set by NIST. To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and protect against and respond to cybersecurity incidents, we undertake the following activities: • monitor emerging data protection best practices and laws and implement changes to our processes that are designed to comply with such; • annual HIPAA security and privacy risk assessments performed with third party provider, as well as annual HIPAA compliance audits; • through our policies, practices and contracts (as applicable), require employees, as well as third parties that provide services on our behalf, to treat confidential information and data with care, and to maintain applicable compliance standards; • employ technical safeguards that are designed to protect our information systems from cybersecurity threats, including next generation firewall systems, endpoint detection and response, data loss prevention, regular air-gapped backups, and security information and event management, which are evaluated and improved through third-party real-time risk assessments and mitigation of security risks; • provide regular, mandatory training for our employees and contractors regarding cybersecurity threats as a means to equip them with effective tools, information and education to recognize and address cybersecurity threats; • conduct regular phishing email simulations for all employees and contractors with access to our email systems to enhance awareness and responsiveness to possible threats; • leverage the NIST incident handling framework to help us identify, protect, detect, respond and recover when there is an actual or potential cybersecurity incident; • carry and maintain information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident; and • document internal policies and procedures for cybersecurity incident response and recovery.


text: Our incident response plan coordinates the activities we take to prepare for, detect, respond to, and recover from cybersecurity incidents, which include processes to prepare for the incident, while complying with potentially applicable legal obligations and mitigate damage to our business and reputation.


text: Our policies and processes also address cybersecurity threat risks associated with our use of third-party service providers. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform due diligence on third parties that have access to our data to ensure they have adequate cybersecurity safeguards in place and continually monitor cybersecurity threat risks identified through such due diligence.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Security breaches, losses of data, and other disruptions could compromise sensitive information related to our business or prevent us from accessing critical information and expose us to liability, which could adversely affect our business and reputation," which disclosures are incorporated by reference herein.


text: Cybersecurity Governance; Management Cybersecurity is an important part of our risk management processes and an area of focus for our board of directors and management. The audit committee of our board of directors is responsible for the oversight of risks from cybersecurity threats.


text: At least annually, our audit committee receives an update from management of our cybersecurity threat risk management and strategy processes covering topics such as data security, results from third-party assessments, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, our audit committee generally receives materials that include a cybersecurity scorecard and other materials discussing current and emerging material cybersecurity threat risks, and describing our ability to mitigate those risks, as well as recent developments, evolving standards, and information security considerations arising with respect to our peers and third parties. The audit committee discusses such matters with our Chief Information Officer.


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Chief Information Officer and the information technology team. Such individuals have extensive experience in various roles, including in other publicly traded companies, involving managing information security, developing cybersecurity strategy, and implementing effective information and cybersecurity programs. These management team members monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. As discussed above, these management team members report to the audit committee of our board of directors about cybersecurity threat risks, among other cybersecurity related matters, at least annually.


text: Risk Management and Strategy We rely on the cybersecurity policies and procedures implemented by BDT & MSD. BDT & MSD have processes in place for assessing, identifying, and managing material risks from potential unauthorized occurrences on or through our electronic information systems that could adversely affect the confidentiality, integrity, or availability of our information systems or the information residing on those systems. These include a wide variety of controls, processes, systems, and tools that are designed to prevent, detect, or mitigate data loss, theft, misuse, unauthorized access, or other security incidents or vulnerabilities affecting our data. Pursuant to BDT & MSD's Information Security Policy, the BDT &MSD Chief Technology Officer ("CTO") is responsible for the oversight and implementation of the Information Security Policy. At times BDT & MSD may also engage assessors, consultants, auditors, or other third parties to assist with assessing, identifying, and managing cybersecurity risks.

companyName: MSD Investment Corp.


text: BDT & MSD use processes to oversee and identify material risks from cybersecurity threats, including those associated with the use of third-party service providers. Additionally, BDT & MSD use systems and processes designed to reduce the impact of a security incident at a third-party service provider. As part of its risk management process, BDT & MSD also maintain an incident response plan that is utilized when cybersecurity incidents impacting us are detected. BDT & MSD also require that all employees, including employees of BDT & MSD complete interactive security awareness training on an annual basis.


text: Material Impact of Cybersecurity Risks As of the date of this report, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. However, future incidents could have a material impact on our business.


text: Our cybersecurity risks and associated mitigations are evaluated by our management and BDT & MSD as needed, but no less frequently than annually. The BDT & MSD CTO periodically reports to our board of directors on developments to the information security and cybersecurity risks we face. Reports include, among other things, an overview of BDT & MSD's controls and procedures related to assessing, identifying, and managing risks related to cybersecurity threats, oversight of third-party service providers and related cybersecurity threats, and management's evaluation of cybersecurity risks material to us.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: scPharmaceuticals Inc.


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program has recently undergone an effort to expand and mature our security controls and documentation. These efforts include: • A security risk assessment conducted by an external supplier to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment. This assessment was completed in the fourth quarter of 2024. • The implementation of revised information security program documentation and policies in the first quarter of 2024, including: o revision and implementation of a revised information security policy; o implementation of a revised incident response plan and policy; o implementation of a third-party risk management program that includes update procedures for third party vendor due diligence; o implementation of additional periodic cybersecurity and awareness training for all of our employees, including unannounced phishing simulations;


text: o implementation of a managed security operations center (SOC) to provide 24/7 managed detection and response (MDR) services for all corporate endpoints.


text: These efforts complement our current cybersecurity risk management program, which include a security team that is principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents. We also conduct employee cybersecurity awareness training upon onboarding to the company and periodically thereafter. However, there can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be complied with or effective in protecting our systems and information.


text: Our cybersecurity risk management program is integrated into our overall risk management program, and shares common methodologies, reporting channels and governance processes that apply across the risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section titled "Risk Factor— Our business and operations may suffer in the event of information technology system failures, cyberattacks or deficiencies in our cybersecurity."


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee, or the Committee, oversight of cybersecurity risks, including oversight of management's implementation of our cybersecurity risk management program.


text: The Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the Committee, where it deems appropriate, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Senior Director of Information Technology and/or external experts as part of the Board's continuing education on topics that impact public companies.


text: O ur Senior Director of Information Technology, who reports to our Vice President, Corporate Affairs and Human Resources, is primarily r esponsible for assessing and managing our material risks from cybersecurity threats. Our Senior Director of Information Technology has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Their experience includes 25 years of experience in information technology, and 8 years specifically involved in cybersecurity matters, as well as experience in security program development and review, implementation of security tools and software, security risk identification and remediation, incident identification and remediation, as well as managing enterprise risk. In addition, we rely on third party cyber security consultants and legal counsel to supplement our expertise.


text: Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our information technology environment.


text: Our cybersecurity program is designed to protect our information assets and operations from both internal and external cyber threats, while simultaneously ensuring business resilience. We rely on information systems and related technologies for critical internal functions, including secure data storage, processing, and transmission, as well as for interactions with key business partners such as customers and vendors.

companyName: Flowco Holdings Inc.

ticker: FLOC


text: Risk Management and Strategy We maintain a comprehensive cybersecurity risk management program (the “Cybersecurity Program”) aligned with the National Institute of Standards and Technology (NIST) cybersecurity framework. Strategic investments in this area have prioritized: • migration to cloud-based managed solutions to replace legacy systems; • workflow automation; • integration of digital and mobile tools for field service technicians; and • expansion of remote monitoring capabilities for our compressor fleets.


text: We employ industry-leading security tools and conduct regular security risk assessments and tool reviews with independent third parties to evaluate program effectiveness and inform our security roadmap. The Cybersecurity Program also includes continuous monitoring of industry news and updates to maintain awareness of the evolving cybersecurity landscape, including potential incidents or issues involving third-party service providers.


text: Key elements of our Cybersecurity Program include: • monthly cybersecurity awareness training for all employees, focusing on threat recognition and appropriate responses to phishing and social engineering attacks; • deployment of a phishing detection system to identify and flag suspicious emails for further review; • installation and regular updates of advanced endpoint detection and response (EDR) software on all company-managed systems and workstations to prevent malicious activity; • implementation of secure DNS and web filtering with category and malicious site blocking; • deployment of next-generation firewall technology at all locations to secure perimeter access and ensure secure inter-site connectivity; and • a documented incident response plan to guide response and mitigation efforts in the event of a cybersecurity incident.


text: We are further enhancing our Cybersecurity Program by implementing an industry-leading third-party security vendor risk management platform. This platform will automate vendor risk assessments and house our Standard Information and Governance (SIG) security questionnaire to streamline vendor procurement and response processes. To augment our internal capabilities, we utilize an outsourced cybersecurity operations center (SOC) for continuous monitoring, investigation coordination, and remediation support.


text: As of the date of this Annual Report, we are not aware of any cybersecurity threats, including those resulting from prior cybersecurity incidents from our predecessor’s operations, that have had, or are reasonably likely to have, a material adverse effect on our business strategy, results of operations, or financial condition. We acknowledge the inherent and ongoing risks posed by cybersecurity threats, which, if realized and significant, could materially affect our operations, business strategy, results of operations, or financial condition.


text: Cybersecurity is a critical component of our overall risk management framework and a key area of focus for our Board of Directors and management. Cybersecurity responsibility is shared across the organization, from facility technicians and operators to the members of our Board of Directors. Our Director of Information Technology (IT) has direct responsibility for assessing, monitoring, and managing cybersecurity risks, as well as developing and executing our cybersecurity strategy. The Board of Directors and Audit Committee provide oversight of the Cybersecurity Program.


text: The IT Department, led by our Director of IT, meets regularly to evaluate ongoing security threats and incidents, and continually refines policy and procedures surrounding cybersecurity risk. Identified cybersecurity threats and incidents are monitored and assessed for materiality by the Director of IT and the IT Department. This assessment includes whether our Board of Directors should be informed of a threat or incident. Cybersecurity risks are communicated and discussed with our Board of Directors at least annually.


text: Our Director of IT has over 25 years of experience in IT and has a proven track record of creating, implementing, and managing successful infrastructure security, business continuity, access management, and change management policies and programs.


text: Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, and confidential information that is proprietary, strategic or competitive in nature, including clinical trial data ("Information Systems and Data").

companyName: ARS Pharmaceuticals, Inc.

ticker: SPRY


text: Our Chief Executive Officer supervises our IT department (the "IT Department"), which coordinates with our cybersecurity incident management team, which consists of, among others, our Chief Financial Officer, Chief Legal Officer, Head of IT, and a third-party IT and cybersecurity consultant ("CSI Management Team") to identify, assess and manage our cybersecurity threats and risks. Members of our IT Department and CSI Management Team identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example manual tools, automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting scans of the threat environment, internal and external audits, conducting threat assessments for internal and external threats, third-party threat assessments, conducting vulnerability assessments to identify vulnerabilities, and evaluating threats reported to us.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: a cybersecurity incident response policy; incident detection and response; vulnerability management processes; a disaster recovery and business continuity plan; risk assessments; encryption of certain of our data; network security controls; segregation of certain of our data; access controls; physical security; asset management, tracking and disposal; systems monitoring; vendor risk management processes; employee training; penetration testing; and cybersecurity insurance.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, the IT Department works with the CSI Management Team to prioritize our risk management processes and mitigate cybersecurity threats that are expected to be more likely to lead to a material impact to our business. In addition, our management evaluates material risks from cybersecurity threats against our overall business objectives and reports to the audit committee of the board of directors, which, together with the board of directors, evaluates our overall enterprise risk.


text: We use third-party service providers to assist us to identify, assess, and manage material risks from cybersecurity threats, including for example: a third-party IT and cybersecurity consultant; professional services firms, including legal counsel; threat intelligence service providers; cybersecurity software providers; managed cybersecurity service providers; penetration testing firms; and dark web monitoring services.


text: We use third-party service providers to perform a variety of functions throughout our business, such as conducting nonclinical and clinical trials; supply and quality testing; development and manufacturing; and professional services firms, including legal counsel. Additionally, we rely on third-party service providers and technologies to operate critical business systems to process sensitive data in a variety of contexts, including, without limitation, cloud-based infrastructure, encryption and authentication technology for certain environments and systems, employee email, and content delivery. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider, which may include reputational due diligence and vendor risk evaluations.


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part I, Item 1A. Risk Factors in this Annual Report on Form 10-K, including "Risk Factors—If our information technology systems or data, or those of third parties with whom we work, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; and other adverse consequences."


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing our cybersecurity risk management processes, including oversight of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of our management, including the CSI Management Team. Certain members of the CSI Management Team are information technology and security professionals, and we also rely on third-party security analysts who have certain certifications related to cybersecurity.


text: Our Chief Executive Officer, Chief Financial Officer and Chief Legal Officer are responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. Additionally, they are responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response policy is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our Chief Executive Officer, Chief Financial Officer, and Chief Legal Officer. These members of management work with our CSI Management Team to help us mitigate and remediate cybersecurity incidents of which they are notified. In addition, our cybersecurity incident response policy includes reporting to the audit committee of our board of directors for certain cybersecurity incidents.


text: The audit committee periodically reviews and discusses with the appropriate members of our management material risks relating to data privacy, technology and information security, including cybersecurity, threats and back-up of information systems and our processes for assessing, identifying, and managing such risks, as well as our internal controls and disclosure controls and procedures relating to cybersecurity incidents. The board and audit committee are also provided with reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: Risk Management and Strategy We have established policies and processes for assessing, identifying, and managing the risks from foreseeable cybersecurity threats and for detecting and responding to any cybersecurity incidents. These policies and processes are built into our information technology ("IT") function and are designed to align with the NIST Cybersecurity Framework, published by the U.S. National Institute of Standards and Technology.

companyName: Invivyd, Inc.

ticker: IVVD


text: We have adopted an IT Security Management Policy ("IT Policy") to establish the requirements for securing and managing our IT assets and data, as well as an Incident Response Policy designed to coordinate the activities for preparing for, identifying, responding to, and recovering from cybersecurity threats. Our Head of IT is primarily responsible for implementing and overseeing the IT Policy, which is applicable to all our employees and contractors, as well as any third parties with access to our IT assets and data. Our Head of IT is also primarily responsible for leading incident response services under the Incident Response Policy. Our Head of IT leverages over 20 years of experience in various cybersecurity functions. As part of our overall risk mitigation strategy, we maintain an Enterprise Risk Register to identify, prioritize and track system risks, including cybersecurity risks. Additionally, we maintain cybersecurity insurance; however, such insurance may not be sufficient in type or amount to cover the total losses or damages related to a cybersecurity incident.


text: We implement technical, physical, and organizational measures designed to manage and mitigate risks from cybersecurity threats. For example, we employ multifactor authentication, single sign-on, and email filtering services across our systems. Additionally, we conduct monthly video-based cybersecurity awareness trainings across our workforce, which cover relevant topics such as social engineering, phishing, password protection, confidential data protection, and mobile security. We regularly perform company-wide phishing tests. We currently leverage multiple third-party service providers to assist in monitoring, managing, and detecting cybersecurity threats and conducting periodic vulnerability assessments of our critical assets.


text: As of December 31, 2024, we are not aware of any cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, evolving cybersecurity threats make it increasingly challenging to anticipate, detect, and defend against cybersecurity threats and incidents. For discussion of cybersecurity risks, please see Item 1A, "Risk Factors."


text: While our Board of Directors has overall responsibility for risk oversight, the Audit Committee of our Board of Directors (the "Audit Committee") is responsible for overseeing our cybersecurity risk management and strategy. The Audit Committee reviews and discusses with management and the Company's auditors, as appropriate, our risks relating to data privacy, technology, and information security, including cybersecurity and back-up of information systems. The Audit Committee also confers with management and our auditors, as appropriate, regarding the adequacy and effectiveness of our policies and the internal controls regarding information security.


text: Our Head of IT meets regularly with our Chief Financial Officer to discuss our cybersecurity threat landscape, address opportunities for improvement and issues, and evaluate solutions to cover identified gaps. Our Head of IT, in collaboration with members of senior management, reports significant cybersecurity matters to our Audit Committee, consistent with the Incident Response Policy.


text: Cybersecurity Risk Management and Strategy We have implemented a cybersecurity risk management program, in accordance with our risk profile and business size, that is designed to detect, identify, assess, and respond to current and emerging cybersecurity threats. Our cybersecurity risk management program is supported by third-party information technologies and vendors, including a managed services provider that assists us with, among other things, information technology system monitoring, detection, and response support services. We also leverage third-party information technology service providers to monitor and evaluate our cybersecurity posture through vulnerability scans, penetration tests, and cybersecurity risk reviews and assessments. Our cybersecurity risk assessments are informed by industry standards and frameworks and incorporate elements of the same, including elements of the National Institute of Standards and Technology (NIST) cybersecurity framework.

companyName: Monte Rosa Therapeutics, Inc.

ticker: GLUE


text: We have adopted an incident response plan designed to coordinate the steps to identify, contain, eradicate, and recover from cybersecurity incidents. We have a process requiring newly hired employees to participate in security awareness training and we conduct periodic phishing email simulations. We also have a risk-based process to review certain third-party information technology service providers and vendors, including through contractual requirements and proactive threat intelligence monitoring, as appropriate.


text: To date, we have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. Like other companies in our industry, we and our third-party information technology service providers and vendors have from time to time experienced threats that could affect our information or systems. For more information, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K.


text: Our Head of Information Technology, or IT, with the support of our third-party information technology service providers and a team of IT professionals, is responsible for the strategic leadership and day-to-day management of our cybersecurity program, including the prevention, detection, mitigation, and remediation of cyber incidents. The individual serving as Head of IT has more than twenty-five years of experience in information technology and information security.


text: Our Board of Directors has delegated oversight of our cybersecurity risk management program to our Audit Committee, per the Audit Committee Charter. Our Head of IT provides quarterly updates to the Audit Committee regarding our cybersecurity risk management program, including information about cybersecurity risk management governance, and provides the Audit Committee with status updates on various projects intended to enhance the overall cybersecurity posture of the Company, as applicable.


text: We are committed to ensuring the confidentiality, availability and integrity of our data. Our cybersecurity strategy is informed, maintained and updated through various methodologies and external resources. As the concerns and issues evolve in cybersecurity, we remain focused on resiliency and continuous improvement to help enhance our cyber posture. We regularly reevaluate the threat landscape and evolve our controls to address new vulnerabilities and threats.

companyName: GTJ REIT, INC.


text: Risk Management and Strategy We regularly utilize information technology and data to operate our business. We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to critical computer networks, third party hosted services, communications systems, software, and hardware. Our critical data includes confidential, personal, and proprietary data (collectively "Information Assets"). The Company's risk management program is designed to manage identified material risks, which would include material cybersecurity risks. We rely on a team of internal and external resources, including external information technology and information security vendors to assess how identified cybersecurity threats could impact our business. These assessments may leverage, among other processes, industry tools and metrics designed to assist in the assessment of risks from such cybersecurity threats.


text: Accordingly, we work with third party providers to assess the environment to identify cybersecurity threats, determine their likelihood of occurring, and assess potential material impact to our business. Based on the risk assessment, we implement and maintain risk management processes designed to protect the confidentiality, integrity, and availability of our Information Assets and mitigate harm to our business.


text: We implement and maintain various technical, physical and organizational controls designed to manage and mitigate material risks from cybersecurity threats to our Information Assets. The cybersecurity risk management and mitigation measures we implement for certain of our Information Assets include: policies and procedures designed to address information security, including external assessments to consider our exposure to cybersecurity threats, environment, compliance with risk mitigation procedures, and effectiveness of relevant controls; documented risk assessments; encryption of data; network security controls; physical and electronic access controls; asset management, tracking and disposal; systems monitoring; and employee security training. We also have a cybersecurity training and compliance program in place for the Company whereby our connected employees are tested routinely through simulated phishing attempts.


text: We have not identified known risks, including as a result of prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition. For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, refer to Part I, Item 1A. Risk Factors for additional information about cybersecurity-related risks.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by Company management. The Chief Executive Officer, President and Chief Financial Officer discuss the cybersecurity programming. The Chief Financial Officer is responsible for the ongoing engagement of outside third parties to evaluate and update controls as recommended. Management is also responsible for working with appropriate third party vendors to evaluate the Company's risk profile and to update the controls for the Company's technology resources. Management is tasked with integrating cybersecurity considerations into the Company's overall risk management strategy, focus on appropriate priorities and approving related budgets, helping prepare for cybersecurity incidents, and soliciting and reviewing security assessments.


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The Board is responsible for overseeing the Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats. The Board also has access to various reports, summaries or presentations related to cybersecurity threats, risk, and mitigation.


text: Management is involved with the Company's efforts to prevent, detect, and mitigate cybersecurity incidents by overseeing preparation of cybersecurity policies and procedures. Management participates in cybersecurity incident response by anticipating and directing the Company's response to cybersecurity incidents. Our cybersecurity incident response processes are designed to identify and escalate certain cybersecurity incidents and vulnerabilities to members of management. Depending on the circumstances, management may work with third party experts and escalate to the Board as necessary.


text: Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, and strategic or competitive in nature, and our clinical trial and related data ("Information Systems and Data").

companyName: Vor Biopharma Inc.

ticker: VOR


text: The Company's Vice President, Head of IT, Associate Director, IT Operations & Security, IT Steering Committee, Information Security Team, and third-party service providers (collectively, the "Information Security Function") help identify, assess, and manage the Company's cybersecurity threats and risks. The Information Security Function identifies and assesses risks from cybersecurity threats by monitoring and evaluating the Company's threat environment and risk profile using various methods and tools including, for example: subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and bad actors, conducting scans of the threat environment, and evaluating our industry's risk profile and threats reported to us. We also complete certain internal and external security audits, third party threat assessments, and vulnerability assessments.


text: The Company implements and maintains technical, physical, and organizational measures designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data. These measures include, for example: risk assessments, implementation of certain security standards and certifications, encryption of certain data, access and network security controls, physical security, asset management, tracking and disposal, systems monitoring, employee training, penetration testing, cybersecurity insurance, and an incident response plan. Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, the Company's Information Security Team maintains a risk register related to information and security threats and evaluates and manages material risks from cybersecurity threats against our overall business objectives. This information is reviewed with the IT Steering Committee and communicated to the audit committee of the board of directors, which evaluates the Company's risks relating to data privacy, technology and information security, including cybersecurity.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including cybersecurity software providers, managed cybersecurity service providers, penetration testing firms, external legal counsel, and dark web monitoring services. We also use third-party service providers to perform a variety of functions throughout our business, such as application providers and hosting companies. We have a vendor management program to manage cybersecurity risks associated with our use of these providers, which includes reviewing vendor security audits and reports. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "If our information technology systems, or those of our third-party vendors, collaborators, consultants or other third parties with whom we work, or our data are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to a material disruption of our product development programs, regulatory investigations or actions, litigation, fines and penalties, reputational harm and other adverse consequences."


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing Company's cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including the Associate Director, IT Operations and Security, who oversees the ISMS and Information Security Team and reports to the Vice President, Head of IT. The Vice President, Head of IT is responsible for strategic leadership of our cybersecurity risk management program. The Vice President, Head of IT is responsible for hiring appropriate personnel, approving budgets, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. The Head of IT role is currently held by an individual who has approximately 35 years of professional IT management experience. The Associate Director, IT Operations and Security leads the operational and ISMS oversight of company-wide cybersecurity strategy, policy, standards and processes and works across relevant departments to assess and help prepare employees and third-party service providers to address cybersecurity risks. The Associate Director, IT Operations and Security has approximately 10 years of experience in IT including infrastructure and cloud administration, participation in risk management and incident response activities, vendor management, and ensuring information security policy compliance.


text: Our cybersecurity incident response plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the Chief Financial Officer, and the Chief Executive Officer. The Company's information technology department and managed service partners work with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response plan includes reporting to the audit committee of the board of directors and the chair of the board of directors for certain cybersecurity incidents. The audit committee of the board of directors periodically receives summaries or presentations from the Vice President, Head of IT concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them.


text: Risk Management and Strategy We have processes in place for assessing, identifying, and managing material risks from potential unauthorized occurrences on or through our electronic information systems that could negatively impact the confidentiality, integrity, or availability of our information systems or the information held on such systems. These processes include controls, procedures, systems and tools that are designed to prevent, detect, or mitigate data loss, theft, misuse, unauthorized access, or other security incidents or vulnerabilities affecting the data. Such processes are set forth in our joint Cybersecurity Policy and Disaster Recovery Plan (collectively, the "Cybersecurity Policy"). The Cybersecurity Policy sets forth the role of the information security committee ("Information Security Committee") in preparing, implementing, and maintaining incident response procedures in consultation with senior management of the Adviser and Administrator.

companyName: Runway Growth Finance Corp.

ticker: RWAY


text: Our Information Security Committee is responsible for the development and implementation of policies and technical measures to reasonably prevent security incidents. The Information Security Committee includes our Chief Financial Officer, Chief Compliance Officer and legal representative. At times we may also engage assessors, consultants, or other third parties to assist with assessing, identifying and managing cybersecurity risk. As part of our risk management process, we conduct assessment and penetration testing, including regular trainings completed by employees of RGC who provide services to us pursuant to the Advisory Agreement and Administration Agreement.


text: Material Impact of Cybersecurity Risks As of the date of this annual report on Form 10-K, we are not aware of any material risks from cybersecurity threats that have materially affected, or are reasonably likely to materially affect, the Company, including our business strategy, results of operations, or financial condition. However, future incidents could have a material impact on our business. Additional information about the cybersecurity risks that we face is discussed in Item 1A of Part I, "Risk Factors" in this Annual Report on Form 10-K under the heading "Cybersecurity risks and cyber incidents may adversely affect our business by causing a disruption to our operations, a compromise or corruption of our confidential information and/or damage to our business relationships, all of which could negatively impact our business, results of operations or financial condition."


text: Oversight of Cybersecurity Risks Our cybersecurity risks and associated mitigation strategies are evaluated by our management and the Information Security Committee as needed, but no less frequently than annually. On at least a quarterly basis, management and the Information Security Committee report to our Board of Directors on developments to cybersecurity risks we face. Such reports include, among other things, an overview of the controls and procedures related to assessing, identifying, and managing risks related to cybersecurity threats, oversight of third-party service providers and related cybersecurity threats, and management's evaluation of cybersecurity risks that are material to us.


text: The Company prioritizes the security of its information systems and data integrity. We have developed a cybersecurity strategy, underpinned by our Cybersecurity Incident Response Plan, to manage and mitigate potential cybersecurity risks. Our strategy is designed to safeguard our systems and data.

companyName: TIGO ENERGY, INC.

ticker: TYGO


text: Cybersecurity Risk Management and Strategy The Company's cybersecurity framework encompasses a proactive approach towards potential threats, focusing on prevention, detection, response, and recovery. Our cybersecurity risk management program is integrated into our overall risk management framework and shares common reporting channels and governance processes that apply across the risk management framework to other legal, compliance, strategic, operational, and financial risk areas. Our cybersecurity risk management program includes: • Risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a cybersecurity team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers and software, where appropriate, to monitor, assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training for our employees; and • a global incident response plan that includes procedures for responding to cybersecurity incidents.


text: Our Incident Response Team ("IRT"), which includes members from various functional areas within the Company, including our data center operations, software, internal information systems, customer support, legal, and marketing departments, which are responsible for managing and mitigating any cybersecurity incidents at the Company. This team operates under the policy procedures that are outlined in our Cybersecurity Incident Response Plan. This process includes notifying executive management when a cybersecurity breach or incident takes place, and taking necessary containment and mitigation steps to address the incident. Our comprehensive approach is designed to provide minimal impact on our operations and maintain the confidentiality and integrity of the personal information we handle.


text: Regular penetration testing, conducted by independent firms, forms a crucial part of our risk assessment process. These tests help us identify and mitigate potential vulnerabilities in our network security and data handling practices. Additionally, the Company monitors alerts and advisory statements from the Cybersecurity and Infrastructure Security Agency to keep abreast of relevant threats, vulnerabilities or alerts from actual incidents.


text: Our information technology management team has over two decades of experience in the technology industry in developing security strategies, playing a pivotal role in incident identification, leading security teams, and managing risks across various industries.


text: Governance and Oversight Cybersecurity governance at the Company involves executive and Board oversight. Our Board of Directors considers cybersecurity risks as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee regularly receives updates from management on our cybersecurity risks. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with less impact potential. The Audit Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity.


text: As part of the escalation procedures stated in our Cybersecurity Incident Response Plan, if we become aware that a cybersecurity incident has occurred, our information technology professionals shall notify the CEO and CFO immediately upon recognition of the breach or event, to help ensure high-level involvement and decision-making. The CEO and CFO shall assess the overall impact of the event and its potential impact on the Company's business operations. If deemed significant, the Audit Committee and full Board of Directors shall be informed of the incident.


text: Our cybersecurity policies and practices are regularly reviewed and updated in order to align with evolving threats and regulatory requirements to help ensure the Company complies with relevant laws and regulations and proactively manages cybersecurity risks.


text: Employee Training and Awareness Recognizing the importance of human factors in cybersecurity, the Company invests in employee training and awareness programs. Our efforts are particularly focused on common threats, such as phishing attacks, and we require all employees to complete annual cybersecurity training to stay informed about emerging and evolving cybersecurity threats.


text: Third-Party Service Providers We work with third parties that help us identify, assess, and manage cybersecurity risks, including professional services firms, consulting firms, threat intelligence service providers, and penetration testing firms.


text: To operate our business, we utilize certain third-party service providers to perform a variety of functions. We seek to engage reliable, reputable service providers that maintain cybersecurity programs. Depending on the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, our vendor management process may include reviewing the cybersecurity practices of such provider, contractually imposing obligations on the provider, conducting security assessments, and conducting periodic reassessments during their engagement.


text: Additional Information We have no t identified any known cybersecurity threats, including as a result of prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. However, there can be no assurance that our cybersecurity risk management program and processes, including our policies, controls, or procedures, will be fully implemented, complied with or effective in protecting our systems and information. Refer to "Item 1A. Risk Factors", including the risk factors that are described under the heading "Cybersecurity and Information Technology Risks," for more information regarding the risks we face from cybersecurity incidents that could adversely impact our business and operations, harm our reputation and subject us to claims or litigation.


text: Risk Management and Strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data related to our clinical trial and development of therapeutic proteins and antibodies ("Information Systems and Data").

companyName: Tectonic Therapeutic, Inc.

ticker: TECX


text: Our Information Technology ("IT") Department, led by our Vice President of IT, helps identify, assess and manage the Company's cybersecurity threats and risks. Our IT Department identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and threat actors, conducting scans of the threat environment, evaluating and assessing threats reported to us, coordinating with law enforcement about certain threats as may be appropriate, conducting internal and external audits and conducting risk and threat assessments.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: our incident response plan, incident detection and response procedures, disaster recovery and business continuity plans, encryption of certain data, network security controls, data segmentation, access and physical security controls, asset management and disposal, monitoring of our systems, employee training, and maintaining cybersecurity insurance.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, cybersecurity risk is addressed as a component of the Company's enterprise risk management program and the IT Department works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example cybersecurity consultants and managed cybersecurity providers.


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, and third parties associated with our clinical trial development, such as contract research organizations and contract manufacturing organizations.


text: We have vendor management processes to manage cybersecurity risks associated with our use of certain of these providers. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including if our information technology systems, or the information technology systems of our CROs, our CDMOs, service providers, our current and potential future partners or other third parties with whom we work were compromised, we could experience adverse consequences, including but not limited to material disruptions to our business operations, regulatory investigations or actions, litigation, fines and penalties, reputational harm, loss of revenue or profits, or other adverse consequences.


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing Company's cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our VP of IT, who has over 25 years of IT experience and 10 years of cybersecurity management expertise.


text: Our VP of IT is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Our Chief Financial Officer is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances. Management works with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response plan includes reporting to the audit committee of the board of directors for certain cybersecurity incidents as appropriate.


text: The audit committee receives periodic reports our VP of IT concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The audit committee also can request access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. We designed and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF), International Organization for Standardization (ISO) 27001, and Payment Card Industry Data Security Standard (PCI DSS). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use these frameworks as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: KOHLS Corp

ticker: KSS


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program and shares common methodologies, reporting channels, and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas. Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems and information; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, including our incident response personnel; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors who access our critical systems and data.