text: In addition, our IT infrastructure management program maintains an IT Crisis Response Plan ("ICRP") where we have disaster recovery plans for key applications. The ICRP includes processes which address disruption of services that affect any IT services supplied by third-party vendors or service providers. Our IT infrastructure management program also ensures an initial risk assessment is conducted on all new third-party vendors prior to engagement.


text: We regularly complete periodic assessments and testing of our practices to address cybersecurity threats and incidents by performing internal audits of internal processes and controls. We engage third-party expertise and utilize threat intelligence feeds to supplement and enhance our CIST of cybersecurity professionals. In addition, we require all employees to take several mandatory cybersecurity training courses on an annual basis.

companyName: MOOG INC.

ticker: MOG-A

secItem: Item 1C


text: In the ordinary course of our business, we have experienced and expect to continue to experience, cyber-based attacks and other attempts to compromise our information systems. Based on the information we have as of the date of this Annual Report on Form 10-K, we do not believe that any risks from any cybersecurity threats or from any previous cybersecurity incident have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. Although our processes are designed to help prevent, detect, respond to and mitigate the impact of such incidents, whether directly or through our supply chain or other channels, we face a risk of such threats, the consequences of which could be material. Further, the preventative actions we have taken and continue to take to reduce the risk of cybersecurity threats and incidents may not successfully protect against these potential threats and incidents in the future. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. See Item 1A. "Risk Factors" under the heading "We face, and may continue to face, risks related to information systems interruptions, intrusions and or new software implementations, which may adversely affect our business operations" for a discussion of cybersecurity risks.


text: Cybersecurity Governance Our Board of Directors ("Board") is informed about cybersecurity risk matters pertaining to the Company and its operations as part of our overall enterprise risk assessment. At least annually, or more frequently as necessary, the Board receives cybersecurity briefings and is apprised of cybersecurity incidents deemed to pose significant risk to us. Our internal controls and procedures are designed to provide for the identification, notification, escalation and communication of cybersecurity incidents to management, including when appropriate to the Board, so that decisions regarding public disclosure and reporting of such incidents can be made in a timely manner.


text: The CIST, led by our CISO, is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture and processes that protect, detect and respond in the defense of our data and enterprise computing systems and networks.


text: The CIST is supported by experienced and knowledgeable leaders, who each have several decades of experience managing risk at Moog or similar companies, including risks arising from cybersecurity threats. The CIST consists of several centers of expertise comprised of persons with many types of skills and ability, including security operations center analysts, cyber engineers, threat hunters, threat modelers, cyber risk and compliance professionals, and threat and vulnerability management analysts. Members of the CIST maintain cybersecurity credentials, such as Certified Information Security Manager, Certified Information Systems Security Specialist, CompTIA Security+ and cybersecurity Analyst+, EC-Council Certified Ethical Hacker, Computer Hacking Forensic Investigator, and several vendor product certifications including from Amazon Web Services, Microsoft and Qualys.


text: We also perform annual internal assessments and audits of internal processes and controls related to cybersecurity and engage third-party experts to support the assessment of cybersecurity related risks, including cybersecurity penetration testing. The results of these assessments, audits and tests are reported to the CIO and CFO.


text: In the event of a cybersecurity incident, we engage our Incident Response Plan, which outlines the steps to be followed regarding preparation, detection, analysis, containment, eradication, recovery, notification, and post-incident remediation. Notification includes informing functional areas (e.g., legal), as well as senior management and the Board, as appropriate. We also have an insider threat detection program to proactively identify internal threats and mitigate those threats in a timely manner. As a defense contractor, we must comply with extensive regulations, including requirements imposed by the Defense Federal Acquisition Regulation Supplement to adequately safeguard controlled unclassified information and reporting cybersecurity incidents to the Department of Defense's Cybersecurity Maturity Model Certification program. Moog also shares and receives threat intelligence information with our defense industrial base peers, government agencies, information sharing and analysis centers and cybersecurity associations.


text: The CISO and the CIO present cybersecurity updates regularly and, as necessary, to the CFO. The CFO will engage the Board to participate in assessing cybersecurity risk as part of the Company's overall risk assessment. In addition, the Board is informed when a cybersecurity issue is identified that may pose significant risk to the Company.


text: Risk Management and Strategy Cybersecurity risk management is a critical component of the Company's overall risk management. The Company proactively addresses cybersecurity risk through a comprehensive cybersecurity program to identify, protect, respond to, and manage any reasonably foreseeable cybersecurity risks, threats and incidents. The Company's cybersecurity risk management program is aligned with the International Standards Organization (ISO 27001:2022) and mapped to National Institute of Standards Special Publication 800-53 Revision 5 (NIST 800-53). The Company's cybersecurity program is integrated into the Company's overarching enterprise risk management program.

companyName: Vestis Corp

ticker: VSTS


text: The Company's Chief Information Security Officer (CISO) is responsible for developing and managing the Company's cybersecurity program and reporting on cybersecurity matters to management, the Audit Committee and the Company's Board of Directors. The CISO has over twenty years of cybersecurity and technology experience, originating with cryptography and security experience as a military officer and progressing through senior management roles at prominent global audit and technology consulting corporations. The CISO is supervised by the Company's Chief Information Officer.


text: The Company has established and maintains a cross-functional Cyber Governance Committee that is responsible for helping the CISO prioritize and manage evolving cyber risks and reports to the Company's Chief Information Officer. The Cyber Governance Committee, which oversees the Company's governance and oversight of information security, meets quarterly and interfaces with other functional areas within the Company, including, but not limited to, legal, internal audit, accounting, risk management, human resources, as well as external third-party partners. The CISO serves as the chair of the Cyber Governance Committee. The CISO also provides response and oversight during any significant cybersecurity incidents and informs the Cyber Governance Committee of all cybersecurity incidents that have been identified by the Company to date.


text: The Company engages third parties to assist with the monitoring components of the security infrastructure that we have deployed. As required, the Company engages consultants and third parties to assist with penetration testing, tabletop incident response exercises, or other activities necessary to comply with various standards and certifications that are necessary for the Company's business operations. The Company provides regular awareness training to its employees and consultants using its collaboration platforms to help identify, avoid, and mitigate cybersecurity threats, as well as targeted security training for key departments that routinely process, store or handle sensitive data types. Where service providers are materially utilized, the company obtains SOC1 or SOC2 reports and complies with complementary user entity controls to keep those attestations valid. Where needed, the Company requires appropriate certifications and contractually requires adherence to data privacy and security requirements from its vendors.


text: The Company operates technologies that are exposed to the internet, and although robust cybersecurity programs, technologies, and safeguards are deployed to help protect the Company's operations and assets, the Company, by nature, is exposed to material cybersecurity attacks that are either generally targeted at companies that operate on the internet, or the Company, by nature, remains exposed to attacks that are specifically directed at the Company's technology systems exposed to the internet.


text: The Company's Board of Directors recognizes the importance of cybersecurity and has ultimate oversight of the Company's cybersecurity risk management program. As reflected in the Audit Committee's charter, the Audit Committee of the Company's Board of Directors has been delegated certain cybersecurity oversight responsibility and, among other things, monitors the Company's cybersecurity risk profile, receives periodic updates from management on all matters related to cybersecurity and reports to the full Board of Directors. The CISO presents quarterly updates to the Audit Committee on the Company's cyber risks and threats, status of projects to strengthen the Company's information security systems, and emerging threats.


text: During the normal course of business, the Company has experienced and expects to continue to experience cyber-based attacks and other attempts to compromise its information systems. Based on the information that the Company had as of the end of the fiscal year covered by this Annual Report on Form 10-K, the Company does not believe that it has experienced any cybersecurity incidents that have materially affected the Company. However, the sophistication of cyber threats continues to increase, and the preventative actions the Company has taken and continues to take to reduce the risk of cyber incidents and protect its systems and information may not successfully protect against all cyber incidents. For more information on how cybersecurity risk may materially affect the Company's business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors."


text: Cybersecurity Risk Management and Strategy Inotiv's cybersecurity risk management framework is grounded in external standards, specifically those of the National Institute of Standards and Technology (NIST) and the Center for Internet Security (CIS). These guidelines provide a strong, structured foundation designed to systematically protect business operations, customer data, and intellectual property in an environment of rapidly evolving cyber threats. We deploy a multifaceted security strategy that includes multi-factor authentication (MFA), advanced malware defenses, and comprehensive endpoint protection supported by Extended Detection and Response (XDR) technology. Additionally, we leverage the expertise of a third-party provider of Managed XDR services, which provides continuous monitoring across our environment to respond swiftly to potential security events.

companyName: Inotiv, Inc.

ticker: NOTV


text: To reinforce our commitment to cybersecurity, we engage in regular third-party assessments and testing to validate and strengthen our defenses. Independent experts review our incident response and disaster recovery plans, evaluating our capacity to respond to cyber incidents and restore business continuity under adverse conditions. We further enhance our security posture by commissioning robust internal and external penetration tests conducted by third-party providers. These assessments rigorously evaluate our systems for potential vulnerabilities, enabling us to mitigate threats proactively and strengthen resilience against both known and emerging threats.


text: Our organization employs a comprehensive process to oversee and identify cyber threats associated with third-party service providers. For critical systems that handle confidential data, we conduct annual third-party security reviews to evaluate and mitigate potential risks. These reviews include a multifaceted approach combining security questionnaires, in-depth manual assessments of vendor security practices, and automated rating systems to assess vendors' cybersecurity postures. We also maintain an incident response plan that coordinates internal teams and third-party providers to triage, investigate, escalate, contain, remediate and recover from incidents, and to meet applicable legal and contractual obligations.


text: The forensic investigation of the 2025 Cybersecurity Incident is complete and determined that between approximately August 5-8, 2025, a threat actor gained unauthorized access to the Company's systems and may have acquired certain data. While we have identified the likely scope of the incident, the full operational and financial impacts are still being evaluated. Accordingly, we have not yet determined whether the 2025 Cybersecurity Incident is reasonably likely to have a material impact on the Company. Further, we are subject to ongoing risks from cybersecurity threats that could materially affect us, including our business strategy, results of operations, or financial condition, as further described in Item 1A. Risk Factors – Risks Related to Technology and Cybersecurity.


text: Governance of Cybersecurity Management Our cybersecurity governance structure is specifically designed to provide a clear chain of responsibility and accountability for assessing, managing, and mitigating cybersecurity risks. The Vice President of Information Security, who reports directly to the Chief Technology Officer ("CTO"), a member of our Executive Committee, leads our cybersecurity initiatives. Together, the Vice President of Information Security and the CTO bring a combined 50 years of technology experience with over 20 years dedicated to IT and security leadership. The Vice President of Information Security is tasked with overseeing cybersecurity risk assessments, implementing strategic security initiatives, and ensuring alignment with evolving regulatory requirements. The Vice President of Information Security provides weekly briefings to the CTO. Additionally, the Vice President of Information Security presents updates to the Executive Committee and the Board of Directors at least annually, although these updates generally occur on a quarterly basis. These presentations cover critical security issues and significant emerging threats.


text: The Board of Directors, through its Audit Committee, is responsible for the oversight of Inotiv's cybersecurity risk management practices. The Audit Committee reviews and assesses our approach to risk management, including risk associated with cybersecurity, against industry standards and regulatory obligations. We believe this governance structure is integral to maintaining high-level visibility and accountability across all levels of leadership. By providing the Board of Directors with regular and detailed updates on cybersecurity initiatives and significant developments in the threat landscape, we foster transparency and maintain cybersecurity as a central priority within the organization.


text: The Board of Directors' involvement in cybersecurity governance underscores our commitment to safeguarding our operations and stakeholders from digital risks. With dedicated oversight from both executive leadership and the Board of Directors, we integrate cybersecurity into our risk management and governance frameworks.


text: Following the 2025 Cybersecurity Incident, management provided briefings to the Audit Committee and the full Board of Directors regarding incident status, operational impacts, response and recovery efforts and enhancements to our security program and business continuity plans.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our information assets and communication networks and mitigate risks to our assets, data, employees and customers. Our cybersecurity risk management program includes a cybersecurity incident response plan which is regularly updated to include structured processes encompassing preparation, identification, notification, containment, analysis, eradication, recovery and follow up.

companyName: COOPER COMPANIES, INC.

ticker: COO


text: We have designed and assessed our program based on the Center for Internet Security Critical Security Controls (CIS Controls) and Safeguards. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the CIS Controls as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: • responsibility for inventory and control of enterprise and software assets, technical and administrative controls and testing of our controls and security measures; • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls, including monitoring and alerting; • cybersecurity awareness training of our employees, incident response personnel, and senior management; and • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.


text: There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – Cybersecurity threats continue to increase in frequency and sophistication; a successful cybersecurity attack could interrupt or disrupt our information technology systems, or those of our third-party service providers, or cause the loss of confidential or protected data which could disrupt our business, force us to incur excessive costs or cause reputational harm."


text: Cybersecurity Governance Our Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated oversight of cybersecurity and other information technology risks to the Audit Committee. The Audit Committee oversees management's implementation of our cybersecurity risk management program.


text: The Audit Committee receives regular reports from management on our cybersecurity risks and reviews our cybersecurity program on at least an annual basis, or more frequently as necessary or advisable. In addition, the Audit Committee is informed, as necessary, regarding material cybersecurity incidents, as well as incidents with lesser impact potential.


text: The Audit Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity. The Board of Directors also receives an annual briefing from our Chief Information Officer, or CIO, on our cybersecurity program, including risks and priorities.


text: Our cybersecurity program is led by our CIO, who has over 25 years of experience in information technology. Our CIO leads a credentialed and experienced Information Security team who has primary responsibility for our overall cybersecurity risk management program and who supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Enterprise Risk Leadership Team, including our Chief Operating Officer & General Counsel, and the Chief Financial Officer, is responsible for assessing and managing our material enterprise risks, including risks from cybersecurity threats.


text: Our Information Security team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: Risk management and strategy Protecting our business information, intellectual property, customer and employee data, and technology systems is crucial for our business continuity, regulatory compliance, and stakeholder trust. We have established processes to assess, identify, and manage significant risks from cybersecurity threats as part of our broader enterprise-wide risk management system and processes, which is overseen by our Board. Our cybersecurity policies, standards, processes, and practices are part of our information security management program, which is aligned to ISO 27001, an international standard to manage information security. ISO 27001 is published by the International Organization for Standardization (ISO), the world's largest developer of voluntary standards, and the International Electrotechnical Commission (IEC). Mitek uses guidance from standard bodies such as the NIST (Cyber Security Framework). Mitek also adheres to Service Organization Control (SOC2) security framework for securing customer data.

companyName: MITEK SYSTEMS INC

ticker: MITK


text: Our information technology cybersecurity team, with oversight from our Board, is tasked with monitoring cybersecurity and operational risks related to information security and system disruption. The Mitek cybersecurity team uses principles of confidentiality, integrity and availability to design and implement information technology systems. The team employs measures designed to protect against, detect, and respond to cybersecurity threats, and has implemented processes and procedures aligned with our enterprise-wide risk management system. These include: • Enterprise-wide security framework and cybersecurity standards; • Cybersecurity awareness and training programs; • Security assessments and monitoring; • Restricted physical access to critical areas, servers and network equipment; and • Cyber incident response, crisis management, business continuity and disaster recovery plans.


text: We assess and test our cybersecurity policies and practices on an annual basis. These efforts include tabletop exercises, vulnerability and penetration tests, and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We also engage third parties to assess and test our cybersecurity measures.


text: We perform risk assessments on critical third-party service providers, software and other tools used in the Company's operations that may have the potential to create cybersecurity threats to our business.


text: We have a documented incident response plan for identifying and responding to cybersecurity incidents that focuses on isolating, containing, mitigating, and eradicating the threat as quickly as possible. In the event of a cybersecurity incident, we will follow a documented incident escalation procedure.


text: Certain of our systems and those of our third-party service providers have experienced cybersecurity threats. Based on the information available as of the date of this Annual Report on Form 10-K, we have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, which have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. Despite our security measures, however, there can be no assurance that we, or the third parties with which we interact, will not experience a cybersecurity incident in the future that will materially affect us. Additional information about cybersecurity risks we face is discussed in "Item 1A. Risk Factors," which should be read in conjunction with the information above.


text: Risk assessment and oversight are an integral part of our governance and management processes. Our Board of Directors has ultimate oversight of the Company's risk management. Our Board receives regular presentations and reports on cybersecurity risks, prompt and timely information regarding cybersecurity incidents that meet specified thresholds, and updates on such incidents until they have been addressed.


text: Our management team, in coordination with our information technology department, is responsible for assessing and managing our material risks from cybersecurity threats and hiring appropriate personnel and third-party consultants to oversee the cybersecurity program. Our VP of Technology Operations and Information Security has primary responsibility for our organization's overall cybersecurity risk management program and supervises our cybersecurity personnel. He has over 25 years of experience driving innovation and security excellence, including design, implementation, and management of cyber-security and information technology programs at various levels and organizations.


text: Management and Board Oversight In the ordinary course of our business, we collect, use, store, and digitally transmit confidential, sensitive, proprietary, and personal information. The secure maintenance of this information and our information technology systems are important to our operations and business strategy. The Audit Committee, which is composed solely of independent directors, has been designated by our Board to review and discuss with management the Company's risk assessment and risk management policies, including the steps that management has taken to monitor and control related cybersecurity risks and exposures. Management updates the Audit Committee and the Board as necessary about significant cybersecurity occurrences and measures the Company is taking to prevent the same.

companyName: LIVE VENTURES Inc

ticker: LIVE


text: Risk Management and Strategy We rely on our information technology professionals at the subsidiary level to continuously monitor and update our information technology networks and infrastructure to prevent, detect, address, and mitigate risks associated with unauthorized access, misuse, computer viruses and other events that could have a security impact. We invest in industry-standard security technologies to protect the Company's and each subsidiary's data and business processes against cyber risks. To enhance our cybersecurity efforts and awareness, we have established an "IT Steering Committee," comprised of a team of information technology professionals from our subsidiaries, who will convene on a quarterly basis to discuss topics including cybersecurity threats, emerging attack methods, and best practices.


text: As part of our cybersecurity risk management program, we are working with our subsidiaries to develop a cyber training curriculum for their employees. While some have already implemented their programs, others are in the developmental phase. This training may encompass topics such as phishing, cybersecurity awareness, and email security best practices.


text: While we are dedicated to cybersecurity, it is not possible to fully mitigate all technology risks. We are currently unaware of any cybersecurity incidents that have, or are reasonably likely to have, a material impact on our business or operations. However, the ever-evolving nature of attack techniques, along with the increased volume and sophistication of these attacks, means that cybersecurity threats - including data breaches, ransomware, and similar threats - could materially impact our future results. Such impacts could include reputational, competitive, operational, or other business harm, as well as financial costs and regulatory action. For further discussion of how risks from cybersecurity threats could materially affect the Company, including its business strategy, results of operations or financial condition, see Item 1A "Risk Factors," which is incorporated by reference into this Item 1C.


text: Risk Management and Strategy We have processes in place aimed at assessing, identifying, and managing material risks from cybersecurity threats. Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.

companyName: SIFCO INDUSTRIES INC

ticker: SIF


text: Key elements of our cybersecurity risk management program include: • periodic risk assessments designed to help identify material cybersecurity risks to our critical systems and information; • a formal register documenting and mitigating identified risks, reviewed by management on a quarterly basis; • a data protection team principally responsible for managing our cybersecurity risk assessment processes, our security controls, and our response to cybersecurity incidents; • the regular use of external service providers to independently assess and test security posture, as well as to otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, including incident response personnel and senior management; • a written cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents, including data storage and restoration and disaster recovery plans; and • a third-party risk management process for key service providers based on our assessment of their criticality to our operations and respective risk profile.


text: Most recently, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, which have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors—Risks Related to Our Business and Operations."


text: Our Board of Directors considers cybersecurity risk as part of its risk oversight function and maintains oversight of risk assessment and risk management, including cybersecurity and other information technology risks. In addition, our Board of Directors oversees management's implementation of our cybersecurity risk management program.


text: The Board of Directors receives periodic reports from management on our cybersecurity risks. In addition, management updates the Board of Directors, where it deems appropriate, regarding cybersecurity incidents it considers to be significant or potentially significant. These presentations may cover a range of topics, including: • the current cybersecurity landscape and best practices for mitigating emerging threats; • progress on cybersecurity projects; • incident reports; • updates from past event(s); and • adherence to regulatory requirements and/or industry standards, as appropriate.


text: Our management team, including our Data Protection Officer and external counsel, are responsible along with the Company's Board of Directors for assessing and managing our material risks from cybersecurity threats. Our Data Protection Officer has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Data Protection Officer has extensive experience in overseeing information technology and cybersecurity programs. Collectively, has approximately twenty years of experience in information technology, including more than eight years with direct responsibility for cybersecurity oversight and implementation. This experience included developing and implementing a cybersecurity incident response playbook and leading initiatives to achieve compliance with the NIST CSF 2.0 cybersecurity regulatory framework. Other experience included expanding and maintaining cybersecurity program in response to evolving state regulatory requirements, implementing automated playbooks to prevent and mitigate cyber threats, and overseeing compliance efforts related to NYDFS and CCPA. This backgrounds equips management with practical cybersecurity knowledge, and includes direct experience in cybersecurity program development, incident response readiness, automation of threat prevention, and compliance with applicable cybersecurity and data privacy regulations.


text: Our management team takes steps to remain informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our IT environment.


text: We recognize the importance of assessing, identifying, and managing material risks from cybersecurity threats. Our policies, standards, and procedures for assessing, identifying, and managing material risks from cybersecurity threats are integrated into our overall risk management system. In this regard, we use various tools and processes to help prevent, identify, and resolve any identified vulnerabilities and security incidents in a timely manner. These include, but are not limited to, internal reporting, periodic employee awareness updates, engaging experts and third-party monitoring and detection tools.

companyName: BARNWELL INDUSTRIES INC

ticker: BRN


text: We employ third-party information technology ("IT") consultants to manage our information technology environment and help manage and assess cybersecurity risks.


text: Our IT Steering Committee, comprised of our Chief Executive Officer, our Chief Financial Officer, and our General Counsel, oversees efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which includes oversight over our third-party IT consultants, monitoring systems and employee engagement. Our senior management team is responsible for reporting any identified cybersecurity risks to the Audit Committee of our Board of Directors.


text: The Audit Committee of our Board of Directors meets periodically with management to review the Company's overall policies with respect to risk assessment and risk management, including a review the systems and processes implemented by management to identify, assess, manage, and mitigate cybersecurity risks. Our senior management is responsible for the day-to-day supervision of the material risks we may face.


text: Our risks from cybersecurity threats have not affected or are reasonably not likely to materially affect our business strategy, results of operations, or financial condition.


text: Risk Management and Strategy The Company has established a cybersecurity program intended to protect our information assets and those information assets of our clients that come under our control. Our cybersecurity risk management processes include technical security controls, monitoring systems, operational processes and policies, and management oversight to assess, identify and manage risks from cybersecurity threats. We have implemented risk-based controls to protect our information, information systems and business operations. We have adopted security-control principles and standards based on the National Institute of Standards and Technology Cybersecurity Framework (NIST), other recognized global standards and client contractual requirements, as applicable. We strive to evaluate and invest in technology, personnel and infrastructure to maintain cybersecurity measures in line with our risk exposure and to address the ever-changing threat, technology and regulatory landscape.

companyName: Cushman & Wakefield Ltd.

ticker: CWK


text: We maintain a cybersecurity program that includes physical, administrative, and technical safeguards, and we maintain plans and procedures whose objective is to help us prevent, detect and timely and effectively respond to, and as necessary, recover from, cybersecurity incidents. Through our cybersecurity risk management program, we have established operational processes to address issues including monitoring and patching of vulnerabilities, regularly updating of our information systems, and evaluating new countermeasures made to defend against an evolving landscape of threats. This process is overseen by the Audit Committee of our Board.


text: In addition, we periodically engage third-party consultants and providers to assist us in assessing, testing, enhancing and monitoring our cybersecurity risk management programs and responding to any incidents. These third parties work in conjunction with the Company's information security team in an effort to continuously improve our cyber risk posture. Examples of third-party actions include the engagement of a security operations center for real-time monitoring and response to incidents, risk assessments and security certifications. The Company also receives independent audits on our global cybersecurity program from industry leading vendors at least annually.


text: We have established a vendor risk management program, which is a cross-functional program supported by our information security, compliance and procurement teams. As part of that program, we assess the security and privacy practices of our suppliers and third-party service providers who have access to, store or process our information through ongoing risk monitoring and security assessments, in line with the cybersecurity risks associated with the products or services they provide. We provide feedback and guidance to certain vendors as needed in an effort to enhance their security posture, including when new risks or threats are identified. Additionally, we perform periodic reassessments of applicable vendors to ensure our information security control requirements continue to be met.


text: At Cushman & Wakefield, we believe cybersecurity awareness is important in helping prevent cyber threats. To that end, we provide annual cybersecurity awareness training and regular phishing awareness exercises to our tech-enabled employees. We monitor and assess the success rate of employees reporting phishing scams, and the results inform the development of our security trainings, systems and programs. Additionally, role-based security training is provided to employees in certain higher-risk positions (including those who handle sensitive information, technology or funds), which is tailored to the heightened cybersecurity risks they face.


text: We have experienced, and may in the future experience, whether directly or through our service providers or other channels, cybersecurity incidents. While prior incidents have not had a material impact on us, future incidents could have a material impact on our business, operations and reputation. Although our processes are designed to help prevent, detect, respond to and mitigate the impact of such incidents, there is no guarantee that they will be sufficient to prevent or mitigate the risk of a cyberattack or the potentially serious reputational, operational, legal or financial impacts that may result. See "Risks Related to Our Business and Operations—A material breach in security relating to our information systems could adversely affect us." within Item 1A, "Risk Factors" in this Annual Report.


text: At Cushman & Wakefield, our Chief Information Security Officer ("CISO") oversees a global information security team which is responsible for protecting the information and operations of us and our clients. Our current CISO has over 23 years of experience and leadership in the cybersecurity industry, holds a master's degree in Information Security and Assurance, and has received numerous industry certifications, including ISO-27000 Specialist, EC-Council Disaster Recovery Professional and an ISACA certification in Risk and Information Systems Control, among others. The information security team has established a security operations center and other partnerships with service providers to monitor for technology and security incidents which are actioned based on the Company's incident response procedures.


text: Our Board has overall responsibility for risk oversight, with its committees assisting our Board in performing this function based on their respective areas of expertise. Our Board has delegated oversight of risks related to cybersecurity to the Audit Committee. The Audit Committee is charged with reviewing our overall guidelines, policies, processes and procedures with respect to risk assessment and risk management, including risks related to cybersecurity. Our CISO and our information security team provide more in-depth reporting on cybersecurity risks to the Audit Committee at least annually based on our established enterprise risk categories. These briefings include assessments of the threat landscape, updates on incidents, results of client security audits, and reports on our investments in cybersecurity risk mitigation. In addition, given its overall importance to the organization, our CISO also provides cybersecurity risk reporting to our Board on at least an annual basis as well as from time to time as needed.


text: Our CISO meets regularly with members of our senior management, including our executive officers. Executives also frequently attend meetings of our Audit Committee and our Board and are therefore able to hear the cybersecurity updates presented at those meetings.


text: Our information security team also participates in periodic global and regional Risk Assurance Committees to further strengthen our cybersecurity risk management activities across the Company. At these meetings, the information security team presents to members of Company leadership, including members of our internal audit team and regional and service line chief financial officers, on the current cybersecurity risk environment, including any newly identified areas of risk and updates on responses to existing risks.


text: We maintain a cybersecurity program that includes physical, administrative, and technical safeguards, and we maintain plans and procedures whose objective is to help us prevent, detect and timely and effectively respond to, and as necessary, recover from, cybersecurity incidents. Through our cybersecurity risk management program, we have established operational processes to address issues including monitoring and patching of vulnerabilities, regularly updating our information systems, and evaluating new countermeasures made to defend against an evolving landscape of threats. This process is overseen by the Audit Committee of our Board.


text: We believe cybersecurity awareness is important in helping prevent cyber threats. To that end, we provide annual cybersecurity awareness training and regular phishing awareness exercises to our tech-enabled employees. We monitor and assess the success rate of employees reporting phishing scams, and the results inform the development of our security trainings, systems and programs. Additionally, role-based security training is provided to employees in certain higher-risk positions (including those who handle sensitive information, technology or funds), which is tailored to the heightened cybersecurity risks they face.


text: We have experienced, and may in the future experience, whether directly or through our service providers or other channels, cybersecurity incidents. While prior incidents have not had a material impact on us, future incidents could have a material impact on our business, operations and reputation. Although our processes are designed to help prevent, detect, respond to and mitigate the impact of such incidents, there is no guarantee that they will be sufficient to prevent or mitigate the risk of a cyberattack or the potentially serious reputational, operational, legal or financial impacts that may result. See "Risks Related to Our Business and Industry—A security breach or other threat relating to our information systems could adversely affect us." within Item 1A, "Risk Factors" in this Annual Report.


text: Our Chief Information Security Officer ("CISO") oversees a global information security team which is responsible for protecting the information and operations of us and our clients. Our current CISO has over 24 years of experience and leadership in the cybersecurity industry, holds a master's degree in Information Security and Assurance, and has received numerous industry certifications, including ISO-27000 Specialist, EC-Council Disaster Recovery Professional and an ISACA certification in Risk and Information Systems Control, among others. The information security team has established a security operations center and other partnerships with service providers to monitor for technology and security incidents which are actioned based on the Company's incident response procedures.


text: Our Board has overall responsibility for risk oversight, with its committees assisting our Board in performing this function based on their respective areas of expertise. Our Board has delegated oversight of risks related to cybersecurity to the Audit Committee. The Audit Committee is charged with evaluating the Company's overall guidelines, policies, processes and procedures with respect to information security and cybersecurity risks. Our CISO and our information security team provide in-depth reporting on cybersecurity risks to the Audit Committee at least annually based on our established enterprise risk categories. These briefings include assessments of the threat landscape, updates on incidents, results of client security audits, and reports on our investments in cybersecurity risk mitigation. In addition, given its overall importance to the organization, our CISO also provides cybersecurity risk reporting to our Board on at least an annual basis as well as from time to time as needed.


text: Risk Management and strategy We have developed processes for assessing, identifying and managing material risks from cybersecurity threats. We maintain an enterprise risk management program, which includes management of material risks from cybersecurity threats alongside other Company risks as part of our overall risk assessment process. Our cybersecurity strategy includes defense in depth and zero trust based controls intended to protect our information technology systems. We maintain an enterprise information and cybersecurity program. As part of this program, we employ a range of tools and services to inform our assessment, identification and management of material risks from cybersecurity threats, which include, from time to time, monitoring emerging data protection laws and implementing responsive changes to our processes; undertaking periodic reviews of our partner facing policies and statements related to cybersecurity; conducting cybersecurity management and incident training for employees involved in our systems and processes that handle sensitive data; conducting phishing email simulations for employees and contractors with access to corporate email systems; requiring employees, as well as third-parties who provide services on our behalf, to treat information and data with care; and employing a cyber risk management and quantification system customized to our environment.

companyName: Evolent Health, Inc.

ticker: EVH


text: We maintain an incident response plan that includes processes to triage, assess severity for, escalate, contain, investigate and remediate material cybersecurity incidents, as well as to comply with potentially applicable legal obligations. As part of the above processes, we periodically engage with assessors, consultants, auditors, and other third-parties, including by periodically annually having a third-party/an independent Qualified Security Assessor review our cybersecurity program to help identify areas for improvement and/or compliance. Our risk management processes also address cybersecurity threat risks associated with our use of third party service providers.


text: For a discussion of whether and how any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company, including our business strategy and results of operations, see "Risk Factors – "Risks Related to Data Protection Privacy, Cybersecurity, Intellectual Property and Technology" which is incorporated by reference into this Item 1C.


text: In the three most recently completed fiscal years, we have not experienced any material cybersecurity incidents and the expenses we have incurred from cybersecurity incidents were immaterial. This includes penalties and settlements, of which there were none.


text: The Compliance and Regulatory Affairs Committee of the Board (the "Compliance and Regulatory Affairs Committee") provides oversight of risks from cybersecurity threats. The Compliance and Regulatory Affairs Committee receives updates from our Chief Information Security Officer ("CISO") and other members of management to, among other items, review material cybersecurity incidents, review key metrics on our cybersecurity program and related risk management programs, and discuss our cybersecurity programs and goals. The Compliance and Regulatory Affairs Committee updates the full Board on matters relating to cybersecurity. The Audit Committee of the Board provides an additional layer of cybersecurity oversight on specific financial matters.


text: Our management disclosure and compliance committees, which include representatives from our legal, financial and accounting and information technology ("IT") teams, meet at least quarterly to monitor potential risks and review procedures and controls relating to cybersecurity. Management periodically assesses such risks and assists in the implementation of policies and procedures related to cybersecurity risk oversight in conjunction with the Compliance and Regulatory Affairs Committee.


text: Our CISO is responsible for assessing and managing the Company's material risks from cybersecurity threats. Our CISO has served in this role for the past four years, and has more than 25 years of experience in the aggregate in various roles involving managing information security, technology infrastructure, IT operations and developing cybersecurity strategy, and is a Certified Information Systems Security Professional (CISSP).


text: Our CISO is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents through the management of and participation in the cybersecurity risk management and strategy process described above, including the operation of our incident response plan. As discussed above, our CISO reports to the Compliance and Regulatory Affairs Committee, about the risks from cybersecurity threats among other cybersecurity related matters, and meets regularly with our Chief Technology Officer.


text: We maintain an incident response plan that includes processes to triage, assess severity for, escalate, contain, investigate and remediate material cybersecurity incidents, as well as to comply with potentially applicable legal obligations. As part of the above processes, we periodically engage with assessors, consultants, auditors, and other third-parties, including by periodically annually having a third-party/an independent Qualified Security Assessor review our cybersecurity program to help identify areas for improvement and/or compliance. Our risk management processes also address cybersecurity threat risks associated with our use of third-party service providers.


text: For a discussion of whether and how any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company, including our business strategy and results of operations, see "Risk Factors – Risks Related to Data Protection Privacy, Cybersecurity, Intellectual Property and Technology" which is incorporated by reference into this Item 1C.


text: The Compliance and Regulatory Affairs Committee of the Board (the "Compliance and Regulatory Affairs Committee") provides oversight of risks from cybersecurity threats. The Compliance and Regulatory Affairs Committee receives updates from our Chief Information Security Officer (" CISO ") and other members of management to, among other items, review material cybersecurity incidents, review key metrics on our cybersecurity program and related risk management programs, and discuss our cybersecurity programs and goals. The Compliance and Regulatory Affairs Committee updates the full Board on matters relating to cybersecurity. The Audit Committee of the Board provides an additional layer of cybersecurity oversight on specific financial matters.


text: Our CISO is responsible for assessing and managing the Company's material risks from cybersecurity threats. Our CISO has served in this role for the past five years, has more than 25 years of experience in the aggregate in various roles involving managing information security, technology infrastructure, IT operations and developing cybersecurity strategy, and is a Certified Information Systems Security Professional ("CISSP").


text: Our CISO is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents through the management of and participation in the cybersecurity risk management and strategy process described above, including the operation of our incident response plan. As discussed above, our CISO reports to the Compliance and Regulatory Affairs Committee, about the risks from cybersecurity threats among other cybersecurity related matters and meets regularly with our Chief Technology Officer.


text: Risk Management and Strategy We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: Cue Health Inc.


text: We conduct periodic risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: Following these risk assessments, we evaluate whether, and if so, how, to re-design, implement, and maintain reasonable safeguards to minimize identified risks; work to reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our Chief Technology Officer (CTO), who reports to our Chief Executive Officer, to manage the risk assessment and mitigation process.


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with human resources, IT, and management. Personnel at all levels and departments are made aware of our cybersecurity policies through trainings.


text: We engage independent third party auditors to validate our risk management program. Third party experts assist us to design and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards. We require each third-party service provider to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company.


text: Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, see Item 1A Risk Factors of this Annual Report on Form 10-K, including the risk factor entitled "Risks Related to Our Business and Strategy —Security breaches and incidents, loss of data, and other disruptions could compromise sensitive information related to our business, or information of our customers, users of our products, healthcare stakeholders or others, or prevent us or our customers, users of our products, healthcare providers, healthcare payors or others from accessing critical information, all of which could result in a material adverse effect, including without limitation, a material operational or service interruption, harm to our reputation, significant fines, penalties and liability, breach or triggering of Data Protection Laws, Privacy Policies and Data Protection Obligations, loss of customers or sales, or customers curtailing or ceasing their use of our services."


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight function directly as a whole, as well as through its audit committee.


text: Our CTO oversees a dedicated Vice President, Information Security and Privacy, and the CTO's team is primarily responsible to assess and manage our material risks from cybersecurity threats. The CTO oversees our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above.


text: The CTO provides periodic reports to our board of directors through its audit committee, as well as our Chief Executive Officer and other members of our senior management as appropriate. These reports include updates on our cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape. Our program is regularly evaluated by internal and external experts with the results of those reviews reported to senior management, including the CTO, and the board of directors through its audit committee.


text: The audit committee has oversight responsibility for risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements, cooperation with law enforcement, and related effects on financial and other risks, and it reports any findings and recommendations, as appropriate, to the full board of directors for consideration. Senior management regularly discusses cyber risks and trends and, should they arise, any material incidents with the audit committee.


text: As an externally managed company, our business is highly dependent on the communications and information systems of our Manager, its affiliates and third-party service providers. Our Manager is an affiliate of TPG, a leading global alternative asset management firm, founded in San Francisco in 1992, with $222 billion of assets under management (as of December 31, 2023) and investment and operational teams around the world. TPG invests across a broadly diversified set of strategies, including private equity, impact, credit, real estate and market solutions. We, in conjunction with our Manager and TPG, have adopted processes designed to identify, assess and manage material risks from cybersecurity threats. These processes include responses to and assessments of internal and external threats to the security, confidentiality, integrity and availability of our and TPG's data and systems along with other material risks to firm operations. As part of its collective risk management process, TPG engages outside providers to conduct periodic internal and external penetration testing. TPG also uses the NIST Cybersecurity Framework to assess our cybersecurity controls. TPG stores data, including ours, in cloud environments with security that we believe is appropriate for the data involved, and has adopted controls around, among other things, vendor risk assessment, access and acceptable use and backup and recovery.

companyName: TPG RE Finance Trust, Inc.

ticker: TRTX


text: Our board of directors has responsibility for the direction and oversight of our risk management. Our board of directors administers this oversight function directly, with support from its committees. In particular, the audit committee of our board of directors (the "audit committee") has the responsibility to consider and discuss our major financial risk exposures and the steps our Manager takes, or is required to take, to monitor and control these exposures, including guidelines and policies to govern the process by which risk assessment and management is undertaken. Our audit committee also monitors compliance with legal and regulatory requirements, in addition to overseeing the performance of our internal audit function.


text: With respect to cybersecurity, the audit committee engages in regular discussions with management regarding the Company's significant financial risk exposures and the measures implemented to monitor and control these risks, including those that may result from material cybersecurity threats. In addition, TPG's chief information security officer briefs the audit committee on TPG's information security program and cybersecurity risks at least annually, and will brief the audit committee as needed in connection with any potentially material cybersecurity incidents affecting the Company. Annual briefings of the audit committee by TPG's chief information security officer typically include topics such as risk assessment, risk management and control decisions, service provider arrangements, test results, security incidents and responses, and recommendations for changes and updates to policies and procedures.


text: As an externally managed company, we rely on TPG's information systems in connection with our day-to-day operations. Consequently, we also rely on the processes for assessing, identifying, and managing material risks from cybersecurity threats undertaken by TPG. TPG has established an enterprise risk committee ("ERC") to manage overall risk, including cybersecurity risks identified by the cybersecurity team. The ERC includes representatives from relevant functions and is led by TPG's chief executive officer. TPG has also established an operational risk committee ("ORC") which is responsible for applying the policy decisions of the ERC. Operational responsibility for ensuring the adequacy and effectiveness of TPG's risk management, control and governance processes is assigned to TPG's chief information security officer, who reports, among other things, potentially material cybersecurity incidents to the ORC and, in coordination with TPG's chief information officer, reports to the ERC at least annually. TPG's chief information security officer leads TPG's cybersecurity team, which includes individuals dedicated to incident detection and response. This team is responsible for identifying threats that can impact TPG and the Company, and designing controls to mitigate vulnerabilities before they are exploited and to detect and neutralize any threats that do materialize. TPG's chief information security officer and TPG's chief information officer each have more than 20 years of experience in their fields. TPG's chief information security officer and other senior members of TPG's cybersecurity team hold industry standard certifications.


text: TPG employs processes to oversee and identify material risks associated with the use of third-party service providers, taking into account the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider.


text: As of the date of this report, we are not aware of any material risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition.


text: As an externally managed company, our business is highly dependent on the communications and information systems of our Manager, its affiliates and third-party service providers. Our Manager is an affiliate of TPG, a leading global alternative asset manager with $246 billion in assets under management as of December 31, 2024. TPG offers a broad range of investment strategies across the alternative asset management landscape, primarily in private equity, credit, and real estate. We, in conjunction with our Manager and TPG, have adopted processes designed to identify, assess and manage material risks from cybersecurity threats. These processes include risk assessments of internal and external threats to the confidentiality, integrity and availability of our and TPG's data and systems along with other material risks to firm operations.


text: These risk assessments inform TPG's cybersecurity program and the continued development of a layered set of controls aimed at preventing, detecting and responding to threats. TPG's administrative, organizational, technical and physical security controls include, but are not limited to, policies and procedures, system hardening vulnerability scanning and patching, employee training and awareness, third-party risk management processes, backup and recovery processes, access controls, data encryption in transit and at rest, network perimeter controls, and identity verification. TPG also has policies and controls in place designed to detect and respond to cybersecurity events, including an incident response plan, an incident response team with dedicated roles and responsibilities for assessing and responding to a cybersecurity event, system logging and ongoing monitoring, and periodic training exercises simulating cybersecurity events that are designed to raise awareness and test the TPG team's response readiness capabilities.


text: The nature, scope and effectiveness of these controls are regularly reviewed through a series of internal and external processes. TPG's cybersecurity team performs both automated monitoring on a continuous basis and manual reviews of key controls. TPG also conducts annual assessments of TPG's cybersecurity program using industry standard cybersecurity frameworks, such as the NIST Cybersecurity Framework as benchmarks to perform TPG's evaluation. This does not imply that TPG fully meets any particular industry standards, specifications or requirements. In addition, independent reviews of TPG's cybersecurity control effectiveness are conducted by TPG's internal audit team on a periodic basis. TPG also engages external providers to conduct periodic external assessments, including penetration testing.


text: With respect to cybersecurity, the audit committee engages in regular discussions with management regarding the Company's significant financial risk exposures and the measures implemented to monitor and control these risks, including those that may result from material cybersecurity threats. Pursuant to our Cybersecurity Policy, our audit committee has appointed a dedicated member of the board of directors who is primarily responsible for our cybersecurity oversight (the "Board Cyber Lead"). TPG's chief information security officer periodically briefs the audit committee and/or the Board Cyber Lead on TPG's information security program and cybersecurity risks, and will brief the Board Cyber Lead or audit committee as needed in connection with any potentially material cybersecurity incidents affecting the Company. Periodic briefings of the Board Cyber Lead and/or audit committee by TPG's chief information security officer typically include topics such as risk assessment, risk management and control decisions, service provider arrangements, test results, security incidents and responses, and recommendations for changes and updates to policies and procedures.


text: As an externally managed company, we rely on TPG's information systems in connection with our day-to-day operations. Consequently, we also rely on the processes for assessing, identifying, and managing material risks from cybersecurity threats undertaken by TPG. TPG has established an enterprise risk committee ("ERC") to manage overall risk, including cybersecurity risks identified by TPG's cybersecurity team. The ERC includes representatives from relevant functions and is led by TPG's chief executive officer. TPG has also established an operational risk committee ("ORC") which is responsible for applying the policy decisions of the ERC. Operational responsibility for ensuring the adequacy and effectiveness of TPG's risk management, control and governance processes is assigned to TPG's chief information security officer, who periodically reports, among other things, potentially material cybersecurity incidents to the ORC and reports to the ERC at least annually. TPG's cybersecurity team also regularly coordinates with other key stakeholders within TPG, including compliance, human resources, internal audit and legal.


text: TPG's chief information security officer leads TPG's cybersecurity team, which is responsible for implementing, maintaining and enforcing TPG's cybersecurity program. TPG's chief information security officer previously held various leadership roles within the technology risk department of one of the world's largest banking institutions over a 17-year period. He holds a Bachelor of Science in Electrical Engineering and Mathematics from the University of Texas at Arlington and is a Certified Information Systems Security Professional (CISSP). TPG's cybersecurity team possesses a variety of cybersecurity skill sets and extensive expertise obtained through decades of experience, numerous industry certifications, and advanced degrees. TPG's cybersecurity team continues to take steps to maintain up-to-date knowledge of evolving cybersecurity threats and countermeasures.


text: Cyber criminals do, however, target us, TPG and TPG's employees and other third parties. Ongoing or future attacks such as these could have impacts on our or TPG's operations. For additional information on these ongoing risks, please refer to "Part 1. Item 1A. Risk Factors— Operational risks, including the risks of cyberattacks, may disrupt our businesses, result in losses or limit our growth".


text: Cybersecurity risk management and strategy Our cybersecurity risk management program is integrated into our enterprise risk management processes, and is informed by recognized cybersecurity industry frameworks and standards, including the National Institute of Standards and Technology. We use these frameworks, together with information collected from internal assessments, to develop policies for use of our information systems and assets (for example, B&W business information and information resources such as computers and workstations), access to specific intellectual property or technologies, and protection of personal information. We protect these information assets through industry-standard techniques, such as multi-factor authentication and malware defenses. We also work with internal stakeholders to integrate foundational cybersecurity principles throughout our operations, including employment of multiple layers of cybersecurity defenses, restricted access based on business need, and integrity of our business information.

companyName: Babcock & Wilcox Enterprises, Inc.

ticker: BW


text: We have implemented a risk-based approach to our cybersecurity processes, inclusive of risks associated with our use of third-party IT service providers, which considers the sensitivity and volume of the relevant data, the potential effects on third parties and individuals and the needs of our business in determining what risk mitigation, remediation or prevention actions are appropriate.


text: In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform due diligence on third parties that have access to our most critical systems, data or facilities that house such systems or data, and establish contractual terms and oversight to manage and reduce the risks associated with such third-party vendors. Such contractual terms include requirements to provide notification of cyber incidents involving our systems or data and requirements to provide industry-accepted disclosures, such as SOC 2 Type II reports, on a regular basis.


text: We utilize several cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage material risks from cybersecurity threats, and to protect against, detect and respond to cybersecurity incidents (as defined in Item 106(a) of Regulation S-K), including, among others, the following: • maintain a global Security Operations Center to support visibility to cybersecurity incidents in real time; • require all salaried employees to complete an annual cybersecurity training program where specific threats and scenarios are highlighted based on our analysis of current risks to the organization; • provide regular cybersecurity awareness and confidential information protection training and conduct phishing email simulations for employees and contractors with access to corporate email systems to enhance awareness and responsiveness to such possible threats; • maintain a Cybersecurity Incident Response Plan, which provides a framework for handling cybersecurity incidents based on, among other factors, the potential severity of the incident and facilitates cross-functional coordination of our response to such incidents, should they occur; • maintain cybersecurity insurance and regularly review our policy and levels of coverage based on current risks; • monitor emerging data protection and cybersecurity laws, and implement changes to our processes and systems designed to comply, and through policy, practice and contract (as applicable) require employees, as well as third parties who provide services on our behalf, to treat customer information and data with care; • conduct several cyber-specific penetration tests per year; and • engage consultants and other third parties, as appropriate, in connection with our cybersecurity practices.


text: Governance of cybersecurity risk management The Board of Directors, as a whole, has oversight responsibility for our strategic and operational risks. Management is responsible for day-to-day assessment and management of cybersecurity risks. The IT Steering Committee, comprised of a cross-functional group of our executive management, leads management's oversight of the IT function, including IT risk management. Our Director of IT has primary oversight of material risks from cybersecurity threats. Our Director of IT has 20 years of experience across various software engineering, IT security and compliance, business and management roles, including serving as the Director of Engineering Applications and Data Management, leading the development and implementation of information technology strategies and roadmaps for Digital and Engineering applications group. The Director of IT is supported by our Director of IT Security and Compliance, who has more than 10 years of experience in information technology and IT security.


text: Our Director of IT and Director of IT Security and Compliance assess our cybersecurity readiness through internal assessment tools as well as third-party control tests, vulnerability assessments, audits and evaluation against industry standards. We have governance and compliance structures that are designed to elevate potential threats or vulnerabilities relating to cybersecurity to our Director of IT and IT Steering Committee. We also employ various defensive and continuous monitoring techniques using recognized industry frameworks and cybersecurity standards.


text: Our Director of IT meets with the IT Steering Committee monthly to review our information technology systems and discuss key cybersecurity risks. In addition, quarterly the Director of IT reviews our entire risk management program, which includes cybersecurity risks, with Executive management and the Board of Directors.


text: Material cybersecurity risks, threats & incidents To date, we do not believe that risks from cybersecurity threats, including as a result of any previous cybersecurity incidents have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial position. However, there can be no guarantee that we will not be the subject of future threats or incidents and we can give no assurance that we have detected all cybersecurity incidents or cybersecurity threats. Additional information on cybersecurity risks we face can be found in Item 1A, Risk Factors, which should be read in conjunction with the foregoing information.


text: Cybersecurity risk management and strategy Our cybersecurity risk management program is integrated into our enterprise risk management processes and is informed by recognized cybersecurity industry frameworks and standards, including the National Institute of Standards and Technology. We use these frameworks, together with information collected from internal assessments, to develop policies for use of our information systems and assets (for example, B&W business information and information resources such as computers and workstations), access to specific intellectual property or technologies, and protection of personal information. We protect these information assets through industry-standard techniques, such as multi-factor authentication and malware defenses. We also work with internal stakeholders to integrate foundational cybersecurity principles throughout our operations, including employment of multiple layers of cybersecurity defenses, restricted access based on business need, and integrity of our business information.


text: We utilize several cybersecurity tactics, techniques, processes and controls to aid in our efforts to assess, identify, and manage material risks from cybersecurity threats, and to protect against, detect and respond to cybersecurity incidents (as defined in Item 106(a) of Regulation S-K), including, among others, the following: • maintain a Security Operations Center to support visibility to cybersecurity incidents in real time; • require all salaried employees to complete an annual cybersecurity training program where specific threats and scenarios are highlighted based on our analysis of current risks to the organization; • provide regular cybersecurity awareness and confidential information protection training and conduct phishing email simulations for employees and contractors with access to corporate email systems to enhance awareness and responsiveness to such possible threats; • maintain a Cybersecurity Incident Response Plan, which provides a framework for handling cybersecurity incidents based on, among other factors, the potential severity of the incident and facilitates cross-functional coordination of our response to such incidents, should they occur; • maintain cybersecurity insurance and regularly review our policy and levels of coverage based on current risks; • monitor emerging data protection and cybersecurity laws, and implement changes to our processes and systems designed to comply, and through policy, practice and contract (as applicable) require employees, as well as third parties who provide services on our behalf, to treat customer information and data with care; • conduct several cyber-specific penetration tests per year; and • engage consultants and other third parties, as appropriate, in connection with our cybersecurity practices.


text: Governance of cybersecurity risk management Our Board of Directors, as a whole, has oversight responsibility for our strategic and operational risks. Management is responsible for day-to-day assessment and management of cybersecurity risks. The IT Executive Steering Committee, comprised of a cross-functional group of our executive management, leads management's oversight of the IT function, including IT risk management. The IT Steering Committee, comprised of operational management, provides tactical oversight of the IT function, including IT risk management Our Director of IT has primary oversight of material risks from cybersecurity threats. Our Director of IT has 20 years of experience across various software engineering, IT security and compliance, business and management roles, including serving as the Director of Engineering Applications and Data Management, leading the development and implementation of information technology strategies and roadmaps for Digital and Engineering applications group. The Director of IT is supported by our Director of IT Security and Compliance, who has more than 10 years of experience in information technology and IT security.


text: Our Director of IT and Manager of IT Cybersecurity, Compliance and Data Privacy assess our cybersecurity readiness through internal assessment tools as well as third-party control tests, vulnerability assessments, audits and evaluation against industry standards. We have governance and compliance structures that are designed to elevate potential threats or vulnerabilities relating to cybersecurity to our Director of IT, IT Steering Committee and IT Executive Steering Committee. We also employ various defensive and continuous monitoring techniques using recognized industry frameworks and cybersecurity standards.


text: Our Director of IT meets with the IT Steering Committee monthly to review our information technology systems and discuss key cybersecurity risks. In addition, quarterly the Director of IT reviews our entire risk management program, which includes cybersecurity risks, with the IT Executive Steering Committee and the Board of Directors.


text: Material cybersecurity risks, threats & incidents To date, we do not believe that risks from cybersecurity threats, including as a result of any previous cybersecurity incidents have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial position. However, there can be no guarantee that we will not be the subject of future threats or incidents, and we can give no assurance that we have detected all cybersecurity incidents or cybersecurity threats. Additional information on cybersecurity risks we face can be found in Item 1A, Risk Factors, which should be read in conjunction with the foregoing information.


text: Risk Management and Strategy As an externally managed company, our day-to-day operations are managed by our advisor and our executive officers under the oversight of our board of directors. As such, we rely on our advisor's cybersecurity program, as discussed herein, for assessing, identifying, and managing material risks to our business from cybersecurity threats.

companyName: KBS Growth & Income REIT, Inc.


text: Our cybersecurity program, as implemented by our advisor and overseen by our board of directors, is fully integrated into our overall risk management system, and included as part of our information technology security incident response plan. The cybersecurity policies, standards, processes, and practices are based on recognized frameworks established by the National Institute of Standards and Technology ("NIST"). These processes include overseeing and identifying risks from cybersecurity threats associated with the use of third-party service providers.


text: Our advisor conducts annual cybersecurity training to ensure all employees are aware of cybersecurity risks and conducts monthly phishing e-mail simulations. Annually, our advisor engages a third party to conduct penetration testing to assess our cybersecurity measures and to review our information security control environment and operating effectiveness. Our advisor also uses a third-party platform to monitor our information security continually. The results of such assessments and reviews are reported to the board of directors, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments. In addition, our advisor evaluates key third-party service providers before granting the service provider access to its information systems and has a process in place to ensure that future access is appropriate. For any software platforms that are hosted by third parties, our advisor requires the vendor to maintain a System and Organization Controls ("SOC") 1 or SOC 2 report. Our advisor maintains third-party cyber insurance and upon identification of a significant cyber incident, our advisor would notify its cyber insurance carrier and engage a third-party cyber forensic analysis vendor to assist in investigating and remediating the incident.


text: As of the date of this Annual Report, we are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, our business strategy, results of operations, or financial condition is highly dependent on our ability to collect, use, store and manage organizational and property data. If any of our significant information and data management systems do not operate properly or are disabled, we could suffer a material disruption of our business or managing real estate, liability to tenant, loss of tenant or other sensitive data, regulatory intervention, inability to properly monitor our compliance with the rules and regulations regarding our qualification as a REIT, misstated financial reports, violations of loan covenants and/or missed reporting deadlines, breach of confidentiality or other contract provisions, or reputational damage. These systems may fail to operate properly or become disabled as a result of events wholly or partially beyond our control, including disruptions of electrical or communications services, natural disasters, political instability, terrorist attacks, sabotage, computer viruses, deliberate attempts to disrupt our computer systems through "hacking,"" "phishing," or other forms of both deliberate or unintentional cyber-attack, or our inability to occupy our office location.


text: Our board of directors is responsible for understanding the primary risks to our business, including risks from cybersecurity threats. The board of directors is responsible for reviewing our advisor's cybersecurity policies with management and evaluating the adequacy of the program, compliance and controls with management.


text: Our advisor's Information Technology Director reports at least annually to our board of directors and to our audit committee as appropriate. These presentations include developments in the cybersecurity space, including risk management practices, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, and information security issues encountered by our peers and third parties. Our board of directors also receives prompt and timely information regarding any cybersecurity incidents that meets pre-established reporting thresholds, as well as ongoing updates regarding any such risk. These reports come from a member of our advisor's Executive Committee, comprised of our advisor's key executives and certain department leaders.


text: Our advisor has formed a Cyber Governance Committee ("CGC"), among its members include our advisor's Chief Compliance Officer, Senior Vice President of Human Resources and Information Technology Director, to oversee cyber governance and to assess and manage, along with our advisor's Chief Executive Officer and our advisor's Chief Financial Officer (also our Chief Financial Officer) material risks, if any, from cybersecurity threats. The CGC meets quarterly to review incident summary reports, new threats, risks, industry and regulatory changes. Our advisor's Chief Executive Officer and Chief Financial Officer and the CGC are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents pursuant to criteria set forth in our incident response plan and related processes. In addition, our incident response plan and related processes provide for incident escalation procedures for any cybersecurity incidents that meets pre-established reporting thresholds.


text: Our advisor's Information Technology Director and Executive Committee are responsible for our incident response plan and related processes designed to assess and manage material risks, if any, from cybersecurity threats. Our advisor's Information Technology Director also coordinates with consultants, auditors and other third parties to assess and manage material risks, if any, from cybersecurity threats.


text: Our advisor's Information Technology Director has 15 years of prior management experience in digital technologies. He has nine years of experience in creating and implementing procedures for managing Payment Card Industries Security Standards (PCI), SOX Cybersecurity measures to include ransomware, email phishing, and data breaches, and bringing into effective action the five pillars of the NIST Cybersecurity Framework.


text: Risk management and strategy The Company recognizes the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. Our policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats are integrated into our overall risk management program and are based on the Center for Internet Security (CIS) benchmarks. CIS controls map to many established standards and regulatory frameworks, including the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) and NIST SP 800-53, the ISO 27000 series of standards, PCI DSS, HIPAA, and others.

companyName: Community Healthcare Trust Inc

ticker: CHCT


text: Managing Material Risks & Integrated Overall Risk Management The Company has strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. Our risk management team works closely with our IT department to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.


text: Engage Third-parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity threats, the Company engages with a range of external experts, including cybersecurity assessors, consultants, and auditors in evaluating and testing our risk management systems. These partnerships enable us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes remain at the forefront of industry best practices. Our collaboration with these third-parties includes real-time Company endpoint scanning, detection, prevention, and remediation; regular audits; threat assessments; and consultation on security enhancements.


text: Oversee Third-party Risk Because we are aware of the risks associated with third-party service providers, the Company implements stringent processes to oversee and manage these risks. We conduct thorough security assessments of all third-party providers before engagement and maintain ongoing review to ensure compliance with our cybersecurity standards. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third-parties. Risks from Cybersecurity Threats We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing.


text: The Board of Directors is acutely aware of the critical nature of managing risks associated with cybersecurity threats. The Board has established robust oversight mechanisms to ensure effective governance in managing risks associated with cybersecurity threats because we recognize the significance of these threats to our operational integrity and stakeholder confidence.


text: Board of Directors Oversight As mentioned above, management has formed an IT Committee consisting of the Chief Executive Officer, Chief Financial Officer, and the Vice President of Information Technology to review and discuss information security matters and cyber security risks. The committee meets at least twice a year and reports to the Board of Directors as needed.


text: Management's Role Managing Risk The Chief Executive Officer and Chief Financial Officer play a pivotal role in serving on the IT Committee, which meets at least twice a year and discusses a broad range of topics, including: • Current cybersecurity landscape and emerging threats; • Status of ongoing cybersecurity initiatives and strategies; • Incident reports and learnings from any cybersecurity events; and • Compliance with regulatory requirements and industry standards.


text: In addition, the IT Committee and the Board maintain an ongoing dialogue regarding emerging or potential cybersecurity risks, ensuring the Board's oversight is proactive and responsive. The IT Committee actively participates in strategic decisions related to cybersecurity, offering guidance and approval for major initiatives. This involvement ensures that cybersecurity considerations are integrated into the broader strategic objectives of the Company.


text: Risk Management Personnel Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the Vice President of Information Technology. Our Vice President of Information Technology has over 25 years of experience in the information technology field and has been a member of and led numerous teams responsible for cybersecurity operations. In addition, all Company employees are required to complete mandatory cybersecurity training each year.


text: Monitor Cybersecurity Incidents The Vice President of Information Technology is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. The Vice President of Information Technology implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the Vice President of Information Technology is equipped with a well-defined incident response plan. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.


text: Reporting to Board of Directors The Vice President of Information Technology, in his capacity, regularly informs the Chief Executive Officer and Chief Financial Officer of all aspects related to cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing the Company. Furthermore, significant cybersecurity matters, and strategic risk management decisions are escalated to the Board of Directors, ensuring that they have comprehensive oversight and can provide guidance on critical cybersecurity issues.


text: Board of Directors Oversight Management has formed an IT Committee consisting of the Chief Executive Officer, Chief Financial Officer, and the Vice President of Information Technology to review and discuss information security matters and cyber security risks. The committee meets at least twice a year and reports to the Board of Directors as needed.