text: • Routine Evaluation and Assessment of Systems and Processes. We routinely evaluate our IT systems and infrastructure, including with respect to system security, and regularly implement upgrades to improve system functionality and performance as well as to enhance security. Security controls are routinely assessed by our annual general controls audit and other audits and assessments as well as a thorough assessment performed during the annual cyber insurance application process. In addition to periodic in-depth evaluations of our systems and processes, we monitor our IT systems and processes on a regular basis with the goal of identifying and remediating real and potential threats as they arise. • Security Awareness Program to Train and Test Personnel. We operate a security awareness program that includes regular, mandatory trainings for relevant personnel on data protection and malware detection, policy and process awareness, periodic phishing simulations and other kinds of preparedness testing. • Incident Response Process and Team. We maintain an incident response process with defined roles, responsibilities and reporting protocols. This process focuses on responding to and recovering from any significant breach as well as mitigating any impact to our business. Generally, when a breach or suspected breach is identified, the IT Security Team would escalate the issue to the Council for initial analysis and guidance. In the event of a serious IT incident, the crisis management team would be notified and the incident response team would typically be tasked with preparing an initial response. The incident response team, in consultation with others regarding impact and materiality, would be responsible for determining whether a particular incident (alone or in combination with other factors) triggers any reporting or notification responsibilities. • Regular Evaluation of Initiatives, Results and Priorities. The IT Security Team, in consultation with the Council and other members of senior management, updates its strategy at least annually to account for changes in our business strategy, legal and regulatory developments, and further developments in the cybersecurity threat landscape. In addition, we periodically engage a third-party provider to conduct an external assessment of our security program. The results of this assessment, which are reported to the Audit and Finance Committee (and the Board, as appropriate), assist us in determining whether any further changes to our existing policies and practices are warranted.


text: We expect that our cybersecurity risk management processes and strategy will continue to evolve as the cybersecurity threat landscape evolves.

companyName: EASTMAN KODAK CO

ticker: KODK

secItem: Item 1C


text: We engage third-party providers to assist us with our cybersecurity risk management and strategy. Examples of services provided by these third-party providers include threat monitoring, incident response support, testing, mitigation strategies, updates on emerging trends and developments and policy guidance. Prior to exchanging any sensitive data or integrating with key third-party providers, we assess their security fitness against our risk posture and request changes as we deem necessary. Security controls are imposed through comprehensive standard terms and conditions that include privacy and incident reporting requirements, and third parties are periodically re-evaluated for security risk.


text: Since the beginning of the last fiscal year, we have not identified any risks from cybersecurity threats (including any previous cybersecurity incidents) that have materially affected the Company, our business strategy, our results of operations or our financial condition. For a discussion of risks from cybersecurity threats that could be reasonably likely to materially affect us, please see our Risk Factors discussion under the heading, "Risks Related to Kodak's Business and Operations—Cyber-attacks or other data security incidents that disrupt Kodak's operations or result in the breach or other compromise of proprietary of confidential information about our workforce, our customers, or other third parties could disrupt our business, harm our reputation, cause us to lose customers, and expose us to costly regulatory enforcement and litigation, any of which could lead to material adverse effects on Kodak's results of operations, business and financial condition" in this Form 10-K.


text: Consistent with the overall risk management governance structure, management is responsible for the day-to-day management of cybersecurity risk while the Board and its Audit and Finance Committee perform an oversight function.


text: Board Oversight. The Board has delegated to its Audit and Finance Committee the responsibility for overseeing cybersecurity risk exposures in addition to our broader risk management program. Management (including the Chief Information Officer ("CIO") and the CISO) reports at least annually to the Audit and Finance Committee on information security and data privacy and protection. These presentations address a wide range of topics, including trends in cyber threats and the status of initiatives intended to bolster security systems and the cyber readiness of personnel.


text: Management's Role. The IT Security Team addresses and responds to cyber risk, including cyber risks related to security architecture and engineering, identity and access management and security operations. The team oversees compliance with the cybersecurity framework within the organization and facilitates cybersecurity risk management activities throughout the organization. The IT Security Team also assists with the review and approval of policies, completes benchmarking against applicable standards, and oversees the security awareness program.


text: The IT Security team is led by the CISO. The CISO reports to the CIO who, in turn, reports to the Executive Chairman and Chief Executive Officer. The CISO has 40 years of IT experience, with over 20 of those focused on IT security functions and strategies. Collectively, the other members of the IT Security Team have decades of relevant education and experience and maintain a wide range of industry certifications. Cybersecurity training is provided for the IT Security Team upon joining the IT Security Team, on an annual basis and more frequently when necessary.


text: As noted previously, the CISO is a member of the Council, which meets monthly to provide operational direction to the IT Security Team considering the evolving risk landscape. The IT Security Team and the Council, through ongoing communication, help monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents. The CISO or CIO, in consultation with the Council and other members of senior management, reports such threats and incidents to the Audit and Finance Committee, as appropriate. These reports may be included in, or in addition to, the regular annual reports to the Audit and Finance Committee.


text: Engage Third Parties As part of the Corporation's cybersecurity risk management process, the Corporation engages a range of third parties, including consultants, advisors and software providers, to assist with security assessments and operations, employee training and awareness, compliance, penetration testing, network and endpoint monitoring, threat intelligence, and the Corporation's vulnerability management platform. These relationships enable the Corporation to access specialized knowledge and insights with respect to its cybersecurity strategies and processes.

companyName: AMPCO PITTSBURGH CORP

ticker: AP


text: Risks from Cybersecurity Threats From time to time, the Corporation has experienced attempts by unauthorized parties to access or disrupt its information technology systems. To date, it has not experienced any known material breaches or material losses related to cyber-attacks. However, a failure of the Corporation's information systems or a cybersecurity breach could materially and adversely affect its business, results of operations and financial condition. The Corporation manages its cybersecurity risk by limiting its threat landscape. For example, the Corporation does not store, transmit or process many of the types of data commonly targeted in cyber-attacks, such as consumer credit card or financial information. The Corporation recognizes cyber-threats are a permanent part of the risk landscape, and new threats are constantly evolving. For these and other reasons, cybersecurity is a top risk management priority.


text: Board of Directors' Oversight The Audit Committee of the Board of Directors (the "Audit Committee") oversees and reviews the design and effectiveness of the Corporation's cybersecurity program and its contingency plans and provides regular reports to the Board of Directors of the Corporation. The DPM provides periodic reports to the Audit Committee, the Corporation's Chief Executive Officer, Chief Financial Officer, and other members of senior management at each of the Audit Committee meetings and in the event of a cyber incident deemed material. These reports include updates on the Corporation's cyber risks and threats, the status of projects to strengthen its information security systems, assessments of the information security program, and the emerging threat landscape.


text: We strive to safeguard our important data, hardware, and internal network from digital attacks, theft and damage. In the ordinary course of our business, we collect, use, store, and digitally transmit confidential, sensitive, proprietary, and personal information. The secure maintenance of this information and our information technology systems is important to our operations and business strategy. To this end, we have implemented processes designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein. At Gyre Therapeutics, these processes are managed and monitored by a third-party information technology ("IT") consulting company (the "Managed Service Provider") and are overseen by our Chief Financial Officer. At Gyre Pharmaceuticals, these processes are managed and monitored by a dedicated Information Security team, which is led by the General Manager. Gyre Therapeutics' and Gyre Pharmaceuticals' processes include mechanisms, controls, technologies, systems, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data. In the process of advancing the systematic development of information security, we seek to maintain a robust approach that encompasses policy formulation, organizational structuring, technological application enhancement, process optimization, and personnel training. For example, Gyre Therapeutics and Gyre Pharmaceuticals maintain software and hardware inventories, perform security monitoring and alerting, and complete ongoing risk assessments. Gyre Therapeutics and Gyre Pharmaceuticals also conduct regular employee trainings on cyber and information security, among other topics. In addition, both companies consult with outside advisors and experts on a regular basis to assist with assessing, identifying, and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on the Company's risk environment.

companyName: GYRE THERAPEUTICS, INC.

ticker: GYRE


text: Our Chief Financial Officer, who reports directly to our Chief Executive Officer, is responsible for assessing and managing Gyre Therapeutics' cybersecurity risks with support from the Managed Service Provider, which employs IT consultants with over 20 years of experience managing information technology and cybersecurity matters and are certified as Microsoft Certified Systems Engineers. Our Gyre Pharmaceuticals information security team, who reports to the Secretary of the General Manager at Gyre Pharmaceuticals, comprises of three employees with an average of 20 years of experience managing information technology and cyber security matters. The Secretary of the General Manager reports to the General Manager at Gyre Pharmaceuticals, and the General Manager reports to the Board of Directors and is responsible for assessing and managing Gyre Pharmaceuticals' cybersecurity risks. We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. Since the beginning of the last fiscal year, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, but we face certain ongoing cybersecurity risks that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the heading "Breach, failure or disruption in or to our information system could compromise sensitive information related to our business and expose us to liability or reputational harm, and our ability to effectively manage our business operations could be adversely affected."


text: Our Cybersecurity Committee is comprised of information technology, finance, legal, human resources and data privacy employees. It meets regularly to review and oversee the Company's data security programs, policies, and strategies, including with respect to cybersecurity risk mitigation, business continuity, and business resiliency. Our Cybersecurity Committee (along with the Chief Financial Officer and General Counsel) also reviews, analyzes, and responds to cybersecurity incidents and breaches.

companyName: KYNTRA BIO, INC.

ticker: KYNB


text: Our head of Information Technology ("IT") oversees overall cybersecurity management and implements our cybersecurity programs with the IT group, including appropriate risk mitigation strategies, systems, processes, and controls and provides periodic reports to our Audit Committee at least semi-annually. The head of IT holds a Masters in Computer Information Systems and a Bachelor of Science degree in Microbiology, and has served in leadership roles within the pharmaceutical and biotechnology industries for over 25 years, including leading enterprise-wide cybersecurity strategies, regulatory compliance programs, and IT transformation initiatives at leading biopharmaceutical companies. The head of IT has expertise spanning cybersecurity governance, risk management, cloud security, AI-driven cybersecurity enhancements, infrastructure modernization, and enterprise-wide IT resilience. The head of IT plays a key role in aligning cybersecurity frameworks with industry regulations such as SOC compliance, SOX, GxP, and data privacy standards, ensuring a secure and compliant IT environment to support business objectives.


text: We consider risks from cybersecurity threats alongside other company risks as part of our overall risk assessment process. As discussed in more detail under "Cybersecurity Governance; Management" below, our board of directors and our audit committee provide oversight of our cybersecurity risk management and strategy processes, which are led by our Chief Compliance Officer, Chief Administrative Officer, Chief Operating Officer, Security Officer, Data Protection Officer, Senior Director of Cybersecurity and IT, and Governance Risk and Compliance Manager.

companyName: Hyperfine, Inc.

ticker: HYPR


text: We also identify our cybersecurity threat risks by comparing our processes to standards established by HITRUST and SOC2 frameworks and any findings resulting from penetration testing and threat modeling conducted by third party service providers. To provide for the confidentiality, integrity, and availability of critical data and information systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and protect against and respond to cybersecurity incidents, we undertake the following internal security measures: • maintain a cybersecurity program through formally-defined documented policies, standards, processes, and procedures to ensure internal security measures are implemented to protect against cybersecurity threats, to assess emerging cybersecurity and data privacy laws, and to implement changes to our processes that are designed to comply with laws applicable to our organization; • implement policies and procedures to identity organizational assets, data and critical IT systems, assess (and periodically re-assess) those assets, data, and systems for cybersecurity risks, and to develop management plans for identifying and remediating identified risks; • through our policies, practices and contracts (as applicable), require employees, as well as third parties that provide services on our behalf, to handle confidential data and systems in a legally compliant and acceptable manner; • employ technical security tools that are designed to protect our critical data and information systems from cybersecurity threats, including network firewalls and access controls, vulnerability scanners, intrusion prevention and detection systems, anti-malware/endpoint protection systems, and identity and access management systems which are evaluated for effectiveness and improved through vulnerability assessments and cybersecurity threat intelligence; • provide quarterly, mandatory training for our employees regarding cybersecurity threats to equip them with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices; • implement administrative processes and procedures to define acceptable security parameters and baselines of IT assets and information systems, and utilize access controls to prevent unauthorized alterations to system parameters and to maintain oversight over configuration changes and modifications to those systems; • conduct third party security reviews of critical and high-risk third-party suppliers and vendors; • conduct quarterly phishing email simulations for all employees with access to our email systems to enhance awareness and responsiveness to possible threats; • conduct cybersecurity management and incident training for employees involved in our systems and processes that handle sensitive data; • run annual tabletop exercises to simulate a response to a cybersecurity incident and use the findings to improve our processes and technologies; • implement a formal Incident Response Plan, based upon NIST, HITRUST, and SOC2 frameworks, to help us identify, protect, detect, respond and recover when there is an actual or potential cybersecurity incident, which Incident Response Plan includes processes to triage, assess severity for, escalate, contain, investigate and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate damage to our business and reputation; and • carry information security risk insurance to insure against potential losses arising from a cybersecurity incident.


text: In the last three fiscal years, we have not experienced any material cybersecurity incidents and any expenses we have incurred from cybersecurity incidents were immaterial. This includes penalties and settlements, of which there were none. As needed, we will contract a professional cybersecurity investigation firm to conduct a full forensic analysis of any suspected material incident. To date, we have concluded that there has not been any evidence of material concern involving malware, persistence mechanisms or other compromised exchange of on-premises accounts within the Company's environment.


text: At least quarterly, our audit committee receives an update from management of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. Our audit committee generally receives materials that include a cybersecurity scorecard and other materials discussing current and emerging material cybersecurity threat risks, and describing our ability to mitigate those risks, as well as recent developments, evolving standards, technological developments and information security considerations arising with respect to our peers and third parties, and discusses such matters with our Chief Compliance Officer, Chief Administrative Officer, Chief Operating Officer, Security Officer, Data Protection Officer, Senior Director of Cybersecurity and IT, and Governance Risk and Compliance Manager. Such individuals have collectively over 50 years of prior work experience in various roles involving managing information security, developing cybersecurity strategy, and implementing effective information and cybersecurity programs. Our audit committee is also designated to receive prompt and timely information regarding any material cybersecurity incident that meets reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.


text: We describe whether and how risks from cybersecurity threats are reasonably likely to affect our business, results of operations and financial condition, under the heading "Our internal computer systems, or those of our third-party CROs, CMOs, licensees, collaborators or other contractors or consultants, may fail or suffer security breaches, which could result in a material disruption in our business and operations or could subject us to sanctions and penalties that could have a material adverse effect on our reputation or financial condition. " included as part of our Item 1A. Risk Factors of this Annual Report on Form 10-K, which is incorporated by reference into this Item 1C.

companyName: AGENUS INC

ticker: AGEN


text: Following these risk assessments, we evaluate how to appropriately implement and maintain reasonable safeguards to mitigate identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate members of our management team, including our executive staff, information technology ("IT") team, and Global Director of IT who reports to our Chief Executive Officer ("CEO") and Chief Financial Officer ("CFO"), to manage the risk assessment and mitigation process. As part of our overall risk management, we collaborate cross-functionally to monitor and test our safeguards and to train our employees on cybersecurity risks and safeguards. We offer cybersecurity training programs for employees at all levels and departments.

companyName: Identiv, Inc.

ticker: INVE


text: Cybersecurity Governance One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing our strategic risk exposure with respect to cybersecurity risks and the audit committee of our board of directors oversees management of such risks. Our executive officers, including our CEO and CFO, are responsible for day-to-day management of the material risks we face.


text: Our Global Director of IT, in coordination with our executive officers, including our CEO and CFO, are responsible for assessing and managing material risks from cybersecurity threats, as well as managing and responding to material cybersecurity incidents if any occur. Our Global Director of IT has over 30 years of experience in various information technology roles, which experience includes management of cybersecurity matters, including over 20 years of experience as an IT Director. Our CFO has over 10 years of experience in risk management at the Company and at similar companies, including risks arising from cybersecurity threats.


text: Our Global Director of IT provides weekly briefings to the CEO and CFO about our cybersecurity risks and activities, including cybersecurity incidents and responses, cybersecurity systems testing, third-party activities and related topics. In the event threats and incidents are identified as potentially significant, the CEO and CFO will promptly report to our audit committee. Our Global Director of IT also provides periodic updates to the audit committee on the Company's cybersecurity policies and processes, material cybersecurity risks and mitigation strategies, and the audit committee provides periodic reports to the board of directors on such matters.


text: As part of the risk management oversight (including oversight of cyber risks) of the audit committee of our Board, our audit committee regularly interacts with, and receives reports from, our management, the Investment Adviser, AGM, and other service providers. The audit committee of our Board receives presentations and reports on cybersecurity risks from AGM's CSO or CISO, at least annually, and they address a wide range of topics including recent developments, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to AGM's peers and third parties. Additionally, AGM and other service providers periodically report to management as it relates to our cybersecurity practices.

companyName: MidCap Apollo Institutional Private Lending


text: Risk Governance and Oversight Cybersecurity represents an important component of the Company's overall cross-functional approach to risk management. Our cybersecurity practices are integrated into the Company's enterprise risk management (ERM) approach, and cybersecurity risks are among the core enterprise risks identified for oversight by the Board through our annual ERM assessment. While the Board is ultimately responsible for risk oversight, the Audit Committee oversees the overall review of our policies and procedures with respect to risk assessment and risk management, and has oversight of information technology and security matters, which includes cybersecurity strategies and risks, as well as data privacy and data protection (Information Security). The Audit Committee oversees the management of risks from cybersecurity threats, including the policies, processes, and practices that the Company's management implements to address risks from cybersecurity threats.

companyName: Burlington Stores, Inc.

ticker: BURL


text: On a quarterly basis, our Chief Information Officer (CIO) and Chief Information Security Officer (CISO) report to the Audit Committee on our Information Security program, including presentations and reports on cybersecurity risks, which address a wide range of topics including, for example, recent developments, security initiatives, vulnerability assessments, the threat environment, technological trends, and information security considerations arising with respect to the Company's peers and vendors; recent cybersecurity-related developments; strategic activities; and the execution of our cybersecurity awareness training. In turn, the chair of the Audit Committee reports out to the full Board on a quarterly basis regarding these matters, among other matters addressed by the Audit Committee.


text: Management utilizes a cross-functional approach designed to address the risk from cybersecurity threats, involving senior management personnel from the technology, operations, legal, risk management, internal audit and other key business functions, as well as members of the Company's Board and the Audit Committee of the Board. The Company's CIO, with support from our CISO and the other members of the cybersecurity team, is the member of the Company's management that is principally responsible for overseeing the Company's cybersecurity risk management program.


text: The CIO, in coordination with the CISO, works to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to cybersecurity incidents. To facilitate the success of this program, the cybersecurity team works to address cybersecurity threats and respond to cybersecurity incidents in accordance with the Company's written incident response plan. The CISO and cybersecurity team regularly meet to monitor the prevention, detection, mitigation and remediation of cybersecurity incidents, and the CISO consults with the CIO and executive management, including the Chief Executive Officer, to report such incidents to the Audit Committee and the Board and initiate a response to incidents when appropriate.


text: We believe our cybersecurity team, led by our CISO, has the appropriate expertise, background and depth of experience to manage risks arising from cybersecurity threats. Our CISO is a credentialed and industry-recognized security executive with over 20 years' experience in healthcare, government and the private sector implementing enterprise cybersecurity and privacy programs, building high performing teams, creating a risk-aware culture, managing cybersecurity incidents, and communicating cyber risks to boards of directors. He holds a Master degree in Computer Engineering and has obtained certifications, including Certified Information Security Manager and Certified Information Systems Security Professional. Prior to joining Burlington, the CISO served as the CISO at Hospital for Special Surgery for 6 years and as a CISO at NYC Health+Hospitals for 4 years. Our CISO reports to our CIO, who has more than 25 years of information technology leadership experience. Together our CIO and CISO have decades of leadership experience in information technology, cybersecurity and retail.


text: We have created a cybersecurity program that endeavors to prevent, detect, contain and respond to material risks from cybersecurity threats and incidents and integrate cybersecurity risk into our enterprise risk management framework and activities. Our program consists of policies and procedures for identification, assessment, remediation, response, and reporting of cybersecurity threats and incidents. The cybersecurity program is a part of our company's ERM framework and activities. The cybersecurity program employs a risk-based approach and draws upon a combination of industry standard frameworks, including the National Institute of Standards and Technology (NIST) Cybersecurity Framework and the Payment Card Industry Data Security Standard (PCI DSS).


text: Our cybersecurity risk management approach and processes are designed to manage risks from cybersecurity threats associated with our use of third-party service providers, ranging from vendor cyber vetting to conducting security assessments and monitoring activities. We also operate an employee awareness and training program to help ensure all relevant associates are equipped to recognize and respond to potential threats. Additionally, we leverage threat intelligence technologies to inform our response posture to potential emerging threats to our digital business infrastructure and systems. Furthermore, we engage with third-party cybersecurity consultants and technology vendors to assess our cybersecurity program and test our technical capabilities. The Company also carries information security risk insurance that is designed to mitigate against certain potential losses arising from a cybersecurity incident.


text: To date, we have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. As further discussed in Item 1A, Risk Factors, if we are unable to protect our information systems against service interruption, misappropriation of data, breaches of security, or other cyber-related attacks, our operations could be disrupted, we may suffer financial losses and our reputation may be damaged.


text: Cybersecurity Governance Cybersecurity is an important part of our overall risk management processes and an area of focus for our Board and management. Our Audit Committee of the Board oversees our cybersecurity risk and receives reports from our Chief Information Officer on a quarterly basis. This includes existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any), status on key information security initiatives, industry trends, and other areas of importance.

companyName: PROKIDNEY CORP.

ticker: PROK


text: We have also established an information technology management committee which is led by our Chief Information Officer, Chief Financial Officer, and Chief Legal Officer. The members of this committee are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan.


text: Risk Management and Strategy The Trust's cybersecurity risk management is established and governed by the Sponsor. The Sponsor determines and implements appropriate risk management processes and strategies as it relates to cybersecurity for the Trust and the Trust relies on the Sponsor for assessing, identifying and managing material risks to the Trust's business from cybersecurity threats. The Sponsor's cybersecurity policies and practices are set out in the Sponsor's compliance manual and are reviewed on an annual basis. In addition, all officers of the Sponsor and all employees of Bitwise Asset Management, Inc. ("BAM"), the parent of the Sponsor, receive annual compliance training and annual cybersecurity training. Attendance at the annual cybersecurity training and the annual compliance training is tracked and recorded.

companyName: Bitwise Ethereum ETF

ticker: ETHW


text: While neither the Sponsor nor the Trust has experienced a material cybersecurity incident during the year ended December 31, 2024, cybersecurity threat risks may materially affect either the Sponsor or the Trust, including the Trust's business strategy, results of operations or financial condition.


text: The Trust does not have any directors, officers or employees. Under the Trust Agreement, all management functions of the Trust have been delegated to and are conducted by the Sponsor, its agents and its affiliates. Hong Kim, the Chief Technology Officer of BAM is responsible for assessing and overseeing the Sponsor's and the Trust's cybersecurity risks and providing direction and oversight for risk mitigation action in conjunction with Katherine Dowling, the General Counsel and Vice President of the Sponsor. Mr. Kim graduated from the University of Pennsylvania with a Bachelor of Science in Computer Science, and, prior to BAM, worked on Google's backend infrastructure for Google Drive and worked in software security for the South Korean military. Ms. Dowling has served as a Chief Compliance Officer at various companies since 2015 and has more than ten years of experience as an Assistant U.S. Attorney, most recently in the Economic Crimes Unit of the U.S. Attorney's Office for the Northern District of California. Mr. Kim and Ms. Dowling receive periodic reports from the Experts and members of the Sponsor's Legal and Compliance team who take part in cybersecurity review, implementation, training and testing.


text: BAM, has a board of directors that is ultimately responsible for managing and directing the affairs of the Sponsor, including maintaining oversight of risks from cybersecurity threats. Mr. Kim serves on the BAM board of directors. Ms. Dowling serves as the General Counsel and Chief Compliance Officer and is on the Executive Management Team of BAM and therefore is able to report directly to BAM's board of directors regarding cybersecurity risks to the Trust and the Sponsor.


text: BAM has a board of directors that is ultimately responsible for managing and directing the affairs of the Sponsor, including maintaining oversight of risks from cybersecurity threats. Mr. Kim serves on the BAM board of directors. Ms. Dowling serves as the General Counsel and Chief Compliance Officer and is on the Executive Management Team of BAM and therefore is able to report directly to BAM's board of directors regarding cybersecurity risks to the Trust and the Sponsor.

companyName: Bitwise Bitcoin ETF

ticker: BITB


text: Assessment, Identification, and Management of Cybersecurity Risks The Company has processes in place to assess, identify and manage material risks from cybersecurity threats. We rely on the cybersecurity strategy implemented by the Adviser and the Antares Parties, the providers of our technology services. The Adviser manages the Company's day-to-day operations and has implemented, together with the Antares Parties, a firm-wide cybersecurity program that applies to the Company and its operations. References in this Item 1C to (i) any programs or processes of the Adviser shall be deemed to refer to any firm-wide programs and/or processes that have been implemented by the Antares Parties, and (ii) any actions of the Adviser shall be deemed to refer to actions of the Antares Parties and/or the Adviser, as the context may require.

companyName: Antares Strategic Credit Fund


text: The Adviser employs a proactive and risk-based approach to assess, identify, and manage material cybersecurity risks. Under the leadership and direction of the Chief Information Security Officer ("CISO"), the cybersecurity program is structured around industry-leading frameworks, including the National Institute of Standards and Technology; MITRE Adversarial Tactics, Techniques, and Common Knowledge; and International Organization for Standardization 27001 (Information Security Management System standard) ensuring a comprehensive risk identification process.


text: The Adviser is fully committed to protecting the Company's systems and information as well as the information of the clients and professionals it serves.


text: Material Impact of Cybersecurity Risks The Adviser recognizes that cybersecurity risks have the potential to impact business operations, financial performance, regulatory compliance, and reputation. To mitigate these risks, the cybersecurity program is built on scalable, future-ready solutions designed to address current and evolving threats.


text: • Operational Impact: Cyber risks, such as ransomware, data breaches, and insider threats, are managed through a combination of robust Identity and Access Management (IAM), Privileged Access Management (PAM), and Application Security programs. These initiatives ensure secure access to critical systems and protect sensitive data from unauthorized exposure. • Reputational and Regulatory Considerations: With increasing regulatory oversight, the Adviser ensures compliance with industry standards and regulatory requirements, aligning cybersecurity measures with expectations from stakeholders and regulatory bodies. • Business Resilience: Through a well-defined Cyber Crisis Management Plan (CCMP) and Business Impact Analysis (BIA), the Adviser maintains a high level of preparedness, ensuring rapid response and recovery from cyber incidents.


text: During the reporting period, we have not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or that are reasonably likely to materially affect the Company, including our business strategy, operational results and financial conditions. However, future incidents could have a material impact on our business strategy, results of operations or financial condition.


text: Oversight of Cybersecurity Risk Cybersecurity risk oversight at the Antares Parties is embedded within a governance structure that includes board-level engagement, cross-functional collaboration, and continuous monitoring of key cyber risk indicators.


text: The Company's Chief Compliance Officer ("CCO") is responsible for monitoring and reporting to the Board of Trustees about the Adviser's compliance with its responsibilities for the Adviser's and the Company's cybersecurity program. The Adviser's CISO works closely with Company management, including the CCO, to administer, assess, discuss, and prioritize the Company's cybersecurity efforts.


text: The Audit Committee provides strategic oversight of risk assessment and risk management matters, including risks associated with cybersecurity threats. The Company's CCO updates the Audit Committee as well as our full Board, as appropriate, on cybersecurity matters, primarily through presentations by the Company's CCO and the Adviser's CISO. Such reporting includes updates on the cybersecurity program applicable to the Company, the external threat environment, and the Adviser's programs to address and mitigate the risks associated with the evolving cybersecurity threat environment. These reports also include updates on the Company's preparedness, prevention, detection, responsiveness, and recovery with respect to cyber incidents.


text: Risk Management and Strategy We take a risk-based approach in implementing and maintaining various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and information related to our clinical trials, products in development and proprietary technologies (IT Systems and Data).

companyName: Pyxis Oncology, Inc.

ticker: PYXS


text: Our information security function, supported by members of our IT department and our third party IT service providers, helps identify, assess and manage our cybersecurity threats and risks. This team helps to identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example: automated tools, subscribing to reports and services that identify cybersecurity threats and analyzing such reports of threats and actors, conducting scans of our threat environment, evaluating threats reported to us, conducting vulnerability assessments, and working with third parties to conduct certain tests of our environment.


text: Depending on the environment and systems, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our IT Systems and Data, including, for example: incident detection and response procedures; an incident response policy; a disaster recovery plan; conducting risk assessments; maintaining network security controls; encrypting certain of our data; maintaining access and physical security controls; systems monitoring; assessing vendor risk; employee training; and maintaining cybersecurity insurance.


text: The cybersecurity risk management and mitigation measures we implement for certain of our IT Systems and Data including for example (1) cybersecurity risk is addressed as a component of our enterprise risk management assessment processes; (2) the information security function works with senior management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business; (3) our senior management evaluates material risks from cybersecurity threats against our overall business objectives and reports to the Audit Committee of the Board, which evaluates our overall enterprise risk, (4) policies and procedures to manage how IT Systems and Data are collected, maintained and stored, (5) communicating with and training personnel on cybersecurity risks and trends.


text: We use third party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats.


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part I. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "Our information technology systems, or those of any of our existing or future CROs, manufacturers, other contractors, consultants, or collaborators, may be compromised, which could result in additional costs, significant liabilities, harm to our reputation and material disruption of our operations."


text: Our Chief Financial Officer (CFO) is primarily responsible for assessing and managing cybersecurity risks across the company based on the assessments by our Senior Director of IT and third party IT specialists. Additionally, our cybersecurity risk assessment and management processes are implemented and maintained by our Senior Director of IT with assistance from third party IT specialists. Our CFO has extensive experience managing risks at our company and at similar companies in the past, including risks arising from cybersecurity threats. Our Senior Director of IT has over 25 years of experience in IT security, and data analytics.


text: Cybersecurity Risk Management and Strategy We, like other companies in our industry, face several cybersecurity risks in connection with our business. Our business strategy, results of operations, and financial condition have not, to date, been affected by risks from cybersecurity threats. During the reporting period, we have not experienced any material cyber incidents, nor have we experienced a series of immaterial incidents, which would require disclosure.

companyName: Coya Therapeutics, Inc.

ticker: COYA


text: In the ordinary course of our business, we may produce, store and process sensitive data. To effectively prevent, detect, and respond to cybersecurity threats, we maintain a cyber risk management program which is comprised of data segregation, physical, procedural, and technical safeguards along with policies and procedures. We have substantially outsourced our IT environment and utilize expert third party software-as-a-service providers for our financial accounting, human resource management, payroll and benefits functions. We also substantially outsource the conduct of our clinical programs and the associated IT infrastructure to expert third party CROs. As a result, the primary means by which we avoid cyber risk is minimizing the sensitive data within our own enterprise.


text: The cyber risk management program falls under the responsibility of our Chief Financial Officer ("CFO") and the Chief Operations Officer ("COO") who manages the overall security through routine communication and supervision of our third-party vendors. Under the guidance of our CFO, who reports to the Audit Committee, we try to minimize our data footprint to keep our cyber risk low.


text: We have implemented a cybersecurity risk management program that is designed to limit and mitigate risks from cybersecurity threats. Our cybersecurity risk management program incorporates several components, including employee training, SOC 2 Type 1 controls, multifactor authentication, endpoint monitoring, and we maintain Business Associate Agreements where required.


text: Governance; Board Oversight Under the ultimate direction of our CFO, with oversight from the Board, we maintain a security governance structure to evaluate and address cyber risk.


text: Our Board is responsible for the oversight of cybersecurity risk management. The Board delegates oversight function of the cybersecurity risk management program to the Audit Committee. Our CFO reports to the Audit Committee on the program. The Audit Committee provides updates to the Board on our cybersecurity risk management program, including any critical cybersecurity risks, ongoing cybersecurity initiatives and strategies, and applicable regulatory requirements and industry standards on a regular and as-needed basis. The Audit Committee also notifies the Board of any cybersecurity incidents (suspected or actual) and provides updates on the incidents as well as cybersecurity risk mitigation activities as appropriate.


text: As part of the QNB's overall risk management processes, it has established both the Information Technology Committee and the Information Security Committee. The Technology Committee comprises the executive management team, selected department heads, and the Information Security Officer ("ISO"). The Technology Committee reports to the Board of Directors. The second committee is the Information Security Committee, composed of QNB's Chief Operating Officer ("COO"), the Information Technology Director, and the ISO. The Information Security Committee reports to QNB's Audit Committee. QNB's COO presents a detailed report on information systems and cybersecurity matters to the Board of Directors at least once annually. The Board of Directors also receives and reviews copies of minutes of all meetings of the Audit Committee and the Information Technology Committee. The Audit Committee receives minutes from the Information Security Committee and audit reports related to Technology and Cyber control testing.

companyName: QNB CORP.

ticker: QNBC


text: QNB Bank's information technology resources are managed by the Information Technology Department, which is responsible for identifying, assessing, and managing material risks from cybersecurity threats. The present COO, who reports directly to the current President and Chief Executive Officer ("CEO"), has been with QNB Bank for over eight years and has over twenty-five years of experience in banking technology and operations. He has an MBA in Management Information Systems and is a current Certified Information Systems Security Professional. QNB's IT Director and ISO report directly to the COO. Additionally, the ISO has a reporting line to the Audit Committee to ensure independence and transparency. The Information Technology Department is managed by the IT Director. The present IT Director has been employed by QNB Bank in the information technology area for ten years has been in the technology industry for over fifteen years and holds numerous technology certifications. QNB's ISO, whose responsibilities include security relating to QNB's information systems, is a Certified Information Systems Security Professional and a Certified Information Security Manager. The ISO, among other duties, supervises internal employee training relating to cybersecurity risks, conducts access reviews relating to QNB's information systems, and monitors implemented checks and balances relating to access to information. Information relating to cybersecurity risks and cybersecurity incidents, if any, is reported by the COO and the ISO and to both the Information Technology Committee and the Information Security Committees. Additionally, cyber security incidents are reported to QNB's Board of Directors by the COO no less than quarterly.


text: QNB uses third-party vendors to assist in monitoring, detecting, and managing cyber threats, including managed security service monitoring, penetration testing, and vulnerability assessment. The Information Security Committee has established risk management guidelines for third-party vendors. QNB conducts due diligence reviews of third-party vendors before contracts or agreements for the provision of services are signed and conducts ongoing due diligence and oversight procedures with the frequency of the procedures determined based on a risk assessment of the services provided. Generally, QNB's agreements with service providers include cybersecurity and data privacy requirements.. All such agreements are reviewed at least annually. QNB cannot guarantee, however, that such agreements, due diligence, and oversight procedures will prevent a cybersecurity incident from impacting information systems. Moreover, as a result of applicable laws and regulations or applicable contractual provisions, QNB may be held responsible for cybersecurity incidents attributed to its service providers in relation to any data that QNB shares with such providers.


text: In accordance with our board policy for incident management and business continuity planning, we have implemented security incident response plans and security incident response teams. These teams include members from multiple functional areas of our organization that identify, investigate, respond, and resolve cybersecurity incidents. Cybersecurity incidents are evaluated and ranked by severity and prioritized for response. We also evaluate the need to include the use of third parties to assist us in the response to a cybersecurity incident. Our Senior Vice President of Power Supply leads the security response teams, and the activities of the security response teams are overseen by our senior management team. Based on the severity of incident, members of the senior management team determine whether the incident requires immediate escalation to our board of directors.

companyName: OLD DOMINION ELECTRIC COOPERATIVE


text: In the last three fiscal years, we have not experienced any material cybersecurity incidents and the expenses we have incurred from cybersecurity incidents have been immaterial. This includes penalties and settlements, of which there were none. For a description of whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business operations and financial condition, see "Risk Factors" in Item 1A.


text: We recognize the critical importance of maintaining the trust and confidence of our all of our stakeholders. Our business increasingly depends on the efficient and uninterrupted operation of our information technology systems and those of our third-party contract research organizations, contract manufacturing organizations, or other vendors, contractors or consultants. Our board of directors and our management team are actively involved in the oversight of risk management, and cybersecurity represents an important component of our overall approach to compliance and risk management. Our cybersecurity policies, standards, processes and practices are integrated into our approach to compliance and risk management and follow recognized industry best practices. In general, we seek to address cybersecurity risks through a cross-functional approach that is focused on preserving the confidentiality, integrity, and availability of the information that we collect, process, and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Stoke Therapeutics, Inc.

ticker: STOK


text: Cybersecurity Risk Mitigation As one of the critical elements of our overall approach to compliance and risk management, our cybersecurity program is focused on the following key areas:


text: Confidentiality and Integrity: To ensure the confidentiality and integrity of data and systems, we leverage encryption of data during transfer and at rest whenever possible and as necessary, least privileged access when granting access, strong passwords and two-factor authentication, and version-controlled file systems.


text: Availability: To preserve the availability of data and systems, we perform daily backups with some occurring multiple times a day. Additionally, to mitigate ransomware, data is stored in version-controlled file systems. When implementing systems, architectural patterns for redundancy and failover are used.


text: Other Technical Safeguards: Additional technical safeguards that are designed to protect our information systems from cybersecurity threats include endpoint tools that detect and prevent threats on a computer and monitor for vulnerabilities, next generation firewalls, intrusion prevention and detection systems, and cybersecurity testing of our systems.


text: Monitoring: We maintain a security operations center that monitors our systems and networks for anomalous activity. Additionally, our information technology ("IT") team actively monitors different cybersecurity threat intelligence sources and responds accordingly based on risk.


text: Education and Awareness: We provide regular, mandatory security awareness training for personnel to educate our employees on cybersecurity threats and to communicate our evolving information security policies, standards, processes, and practices. In addition to the training, we periodically test employees with phishing emails.


text: Collaborative Approach: We have implemented a cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.


text: Incident Response and Recovery Planning: We have established and maintain comprehensive incident response and recovery plans to address our response to a cybersecurity incident.


text: Third-Party Risk Management: We maintain a risk-based approach to identifying cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.


text: Policies and Processes: We engage in the periodic assessment of our policies, standards, processes, and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, penetration testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures. The results of such exercises, if material, are reported to the audit committee of our board and our board of directors, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: Our board of directors, in coordination with our audit committee, oversees our risk management process. Our audit committee receives presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties. Our board of directors and audit committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On a periodic basis, our board of directors and audit committee discuss our approach to cybersecurity risk management with our head of IT.


text: Our head of IT, in coordination and with support from our executive management team, works collaboratively across the company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans. Through ongoing communications with our entire employee basis and appropriate third-party contractors, the head of IT and the management team monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and report such threats and incidents to our audit committee when appropriate.


text: Our head of IT has over 21 years of experience building and managing information systems with cybersecurity principles, such as least privileged access, patching and vulnerability management, encryption, etc., as part of a foundation to ensure confidentiality, integrity, and availability. Our head of IT has also served in consulting and architecture roles for cybersecurity and compliance projects ranging from design and auditing systems, red team testing, to compliance audits and remediation for the Sarbanes-Oxley Act of 2002, as amended, and the payment card industry data security standards.


text: No cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to affect us, including our business strategy, results of operations or financial condition.


text: Cybersecurity Risk Management Strategy The Company addresses cybersecurity risks through a comprehensive approach that is focused on preserving the security of its operations and information and ensuring the appropriate acquisition, access, use, or disclosure of PHI. Veradigm has implemented an enterprise-wide information security program ("IS Program") that is informed by core elements of the security standards encouraged by HHS, including relevant National Institute of Standards and Technology ("NIST") cybersecurity standards such as NIST SP 800-30, NIST SP 800-53, and NIST SP 800-63B, and ISO 27001and SOC2 suite of controls. Designed from a risk- and compliance-based approach, the IS Program is designed to protect Company information and information systems from unauthorized access, use, disclosure, disruption, modification or destruction by identifying, preventing and mitigating cybersecurity threats, as well as effectively respond to cybersecurity incidents when they occur.

companyName: Veradigm Inc.


text: Veradigm's information security policies and procedures have been developed to align with recognized security practices and utilize multi-layered defenses. As part of the IS Program, the Company employs a range of tools and services to inform assessment, identification and management of material risks from cybersecurity threats, which include, from time to time, monitoring emerging data protection laws and implementing responsive changes to our processes; undertaking periodic reviews of our policies and statements related to cybersecurity; conducting annual privacy and security awareness training for all Veradigm workforce members, including contractors and subcontractors, and tracking compliance; and deploying phishing test campaigns. We have an incident response program, which is reviewed and updated annually, and our incident response team members participate in regularly scheduled management reviews and tabletop exercises to simulate responses to cybersecurity incidents.


text: Our IS Program includes the following elements: (i) internet and perimeter security; (ii) endpoint and email security; (iii) threat intelligence, monitoring and management; (iv) data security for PHI and Personally Identifiable Information ("PII"); (v) personal accountability, which includes comprehensive training for our employees and third party-contractors (including onboarding and annual training), exercises (including advanced phishing exercises) and awareness for our employees to promote vigilance of cybersecurity risks and opportunities; (vi) access management; (vii) application and cloud security; and (viii) compliance audits and assessments, which include routine technical and non-technical audits and assessments internally and in collaboration with independent third parties at least annually.


text: As a company managing the use and disclosure of PHI and PII, our Program incorporates annual independent Systems and Organization Control 2 (SOC 2) Type 2 audits that are conducted in accordance with attestation standards established by the American Institute of Certified Public Accountants, which provide an independent third party evaluation of the design and operating effectiveness of our controls. We also annually perform HIPAA Security Rule risk assessments of our administrative, physical and technical safeguards for protecting the confidentiality, integrity and availability of data.


text: Our IS Program includes frequent reviews and development of our security policies and standards, monitoring to detect potential threats or disruptions, testing of protocols to verify the effectiveness of our defense systems, and training for our workforce. Our teams continuously and proactively monitor our information systems for potential risks, threats, and disruptions, including at our U.S.-based third-party data centers. Through the use of our rapid response and incident management processes, which include our IT incident management and IT disaster recovery processes, we assess potential incidents and determine a course of action. This may involve risk mitigation, resolution plan development and process improvements.


text: In parallel with our Code of Conduct, we have created and posted publicly, and incorporate into vendor contracting, our security standards for our contractors, subcontractors and other vendors and suppliers, which holds the third parties with which we do business to equivalent data and privacy standards as the Company, as applicable. We request Attestations of Compliance with such standards and execute HIPAA-compliant Business Associate Agreements in these contexts as appropriate.


text: Veradigm's Privacy & Security Executive Council ("PSEC") provides oversight of risks from cybersecurity threats. The Chief Security Officer ("CSO") provides oversight of Veradigm's IS Program and, along with the PSEC and other members of management, reviews material cybersecurity incidents, reviews key metrics on Veradigm's cybersecurity program and related risk management programs and manages cybersecurity program goals. The CSO updates the full Board on matters relating to cybersecurity.


text: The CSO is responsible for assessing and working with the business to manage the Company's material risks from cybersecurity threats. The CSO is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents through the management of and participation in the cybersecurity risk management and strategy process described above, including the operation of Veradigm's incident response plan. Veradigm's CSO has served in this role for the past four years, and has more than 14 years of experience managing cybersecurity risk for HIPAA-regulated entities in various roles involving managing information security, developing cybersecurity strategy, application security, and developing healthcare cybersecurity at the Federal level, and has a Doctorate of Philosophy (Ph. D.) in privacy and security.


text: The Audit Committee is primarily responsible for overseeing and reviewing the Company's information security and technology risks, including cybersecurity. In this role, the Audit Committee monitors the prevention, detection, mitigation and remediation of cybersecurity incidents through the regular receipt of reports from management on the effectiveness of its cybersecurity programs. The Audit Committee reports to the full Board on a quarterly basis regarding its oversight activities and the risk management activities of the Company. In addition, the full Board receives periodic presentations from management on emerging information security and cybersecurity risks, as well as incident reports as significant matters may arise.


text: Our CSO conducts regular cross-functional management reviews of our programs, including with members of senior leadership. All employees and those contractors of the Company with access to our information systems receive annual cybersecurity awareness training, and we have integrated cybersecurity and data protection topics into our Code of Conduct. All critical information systems supporting our clients' clinical care have a written disaster recovery plan that is exercised at least annually. The entire program is audited annually by both internal and third-party auditors.


text: Cybersecurity is also included in our product development life cycle and part of our vendor and business partner evaluation process. Our product development approach considers cybersecurity best practices and builds security controls into our product design. Additionally, we conduct security risk assessments prior to engaging third-party suppliers and other vendors and business partners to validate that they maintain appropriate safeguards and require they adhere to mutually agreed upon security requirements, controls and responsibilities.


text: Impact of Recent Cybersecurity Incidents On July 19, 2024, the Company experienced customer facing systems disruption resulting from the CrowdStrike-caused outage. Upon detecting the event, the Company took immediate steps designed to mitigate the impact of the incident and implement its business continuity plans to restore and support customer operations. The majority of client facing systems were restored within 24 hours and all affected systems were fully restored in fewer than three calendar days.


text: As previously disclosed, the Change Healthcare cybersecurity incident in the first quarter of 2024 disrupted our Company's customers' ability to use Change Healthcare's network connections, thus affecting their insurance claims submissions and billing activities through our systems. Although the Company's information systems were not affected, the cybersecurity incident experienced by Change Healthcare resulted in delay and downtime for our customers. The Company took immediate steps designed to mitigate the impact of the incident for our customers with respect to our solutions.


text: The Company did not experience a material cybersecurity incident in 2024. It did, however, experience the previously-disclosed impacts from the Change Healthcare cybersecurity incident in the first and second quarters of 2024. For a discussion of whether and how any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company, including our business strategy and results of operations, see "Risk Factors – "Significant disruptions of information technology systems or breaches of information security could materially and adversely affect our business, financial condition and operating results." which is incorporated by reference into this Item 1C.


text: As an externally managed company, our day-to-day operations are managed by our Adviser and our executive officers under the oversight of our board of directors. Our executive officers are senior professionals of our Adviser and our Adviser is a subsidiary of J.P. Morgan. As such, we are reliant on J.P. Morgan for assessing, identifying and managing material risks to our business from cybersecurity threats.

companyName: J.P. Morgan Real Estate Income Trust, Inc.


text: Cybersecurity risk is an important and continuously evolving focus for us, the Adviser, J.P. Morgan, and its affiliates. Significant resources are devoted to protecting and enhancing the security of computer systems, software, networks, storage devices, and other technology. The Adviser's security efforts are designed to protect against, among other things, cybersecurity attacks that can result in unauthorized access to confidential information, the destruction of data, disruptions to or degradation of service, sabotaging systems or other damage.


text: The Adviser, J.P. Morgan, and its affiliates have experienced, and expect to continue to experience, a higher volume and complexity of cyber attacks against the backdrop of heightened geopolitical tensions. J.P. Morgan has implemented measures and controls reasonably designed to address this evolving environment, including enhanced threat monitoring. In addition, J.P. Morgan continues to review and enhance its capabilities to address associated risks, such as those relating to the management of administrative access to systems.


text: Third parties with which we, the Adviser, J.P. Morgan and its affiliates do business, that facilitate our, the Adviser's, J.P. Morgan's, and its affiliates' business activities (e.g., vendors, supply chain, exchanges, clearing houses, central depositories, and financial intermediaries) or that J.P. Morgan has acquired are also sources of cybersecurity risk to us. Third party incidents such as system breakdowns or failures, misconduct by the employees of such parties, or cyber attacks, including ransomware and supply-chain compromises, could have a material adverse effect on J.P. Morgan, including in circumstances in which an affected third party is unable to deliver a product or service to us or the Adviser, where the incident delivers compromised software to J.P. Morgan or results in lost or compromised information of J.P. Morgan or its clients or customers.


text: Clients and customers are also sources of cybersecurity risk to us, the Adviser, J.P. Morgan and its affiliates and its information assets, particularly when their activities and systems are outside of J.P. Morgan's own security and control systems. J.P. Morgan engages in periodic discussions with its clients, customers and other external parties concerning cybersecurity risks including opportunities to improve cybersecurity.


text: Risks from cybersecurity threats, including any previous cybersecurity events, have not materially affected us or our business strategy, results of operations or financial condition. Notwithstanding the comprehensive approach that J.P. Morgan takes to address cybersecurity risk, J.P. Morgan may not be successful in preventing or mitigating a future cybersecurity incident that could have a material adverse effect on us, the Adviser, J.P. Morgan or its affiliates or its business strategy, results of operations or financial condition.


text: Organization and Management The Global Chief Information Security Officer ("CISO") reports to the Global Chief Information Officer, and is a member of key cybersecurity governance forums. The CISO leads the Global Cybersecurity and Technology Controls organization, which is responsible for identifying technology and cybersecurity risks and for implementing and maintaining controls to manage cybersecurity threats. The CISO and the members of senior management within Global Technology and the Cybersecurity and Technology Controls organizations all have relevant expertise and experience in cybersecurity and information technology risk management, including relevant experience at J.P. Morgan, at other financial services companies or in other highly-regulated industries.


text: The CISO is responsible for J.P. Morgan's Information Security Program, which is designed to prevent, detect and respond to cyber attacks in order to help safeguard the confidentiality, integrity and availability of J.P. Morgan's infrastructure, resources and information. The program includes managing J.P. Morgan's global cybersecurity operations centers, providing training, conducting cybersecurity event simulation exercises, implementing J.P. Morgan's policies and standards relating to technology risk and cybersecurity management, and enhancing, as needed, J.P. Morgan's cybersecurity capabilities.


text: J.P. Morgan's Information Security Program includes the following functions: • Cyber Operations, which is responsible for implementing and maintaining controls designed to detect and defend us, the Adviser, J.P. Morgan, and its affiliates against cyber attacks, and includes a dedicated function for incident response and ongoing monitoring for cybersecurity threats and vulnerabilities, including those among our, the Adviser's, J.P. Morgan's and its affiliates' third-party suppliers. • Technology Governance, Risk & Controls, which is responsible for operationalizing technology risk and control frameworks, analyzing regulatory developments that may impact J.P. Morgan, and developing control catalogs and assessments of controls, as well as overseeing governance and reporting of technology and cybersecurity risk. • Security Awareness, which provides awareness and training that reinforces information risk and security management practices and compliance with J.P. Morgan 's policies, standards and practices. The training is mandatory for all employees globally on a periodic basis, and it is supplemented by firmwide testing initiatives, including periodic phishing tests. J.P. Morgan also provides specialized security training to employees in specific roles, such as application developers. J.P. Morgan's Global Privacy Program requires all employees to take periodic training on data privacy that focuses on confidentiality and security, as well as responding to unauthorized access to or use of information. • Technology Resiliency, which establishes control requirements for planning and testing the prioritized recovery of technology services in the event of degradation or outage, including incident response planning, data backup and retention, and recovery readiness in support of the J.P. Morgan's Business Resiliency Program and operational risk management practices.


text: J.P. Morgan has a cybersecurity incident response plan designed to enable J.P. Morgan to respond to attempted cybersecurity incidents, coordinate as appropriate with law enforcement and other government agencies, notify clients and customers, as applicable, and recover from such incidents. In addition, J.P. Morgan actively partners with appropriate government and law enforcement agencies and peer industry forums, participating in discussions and simulations to assist in understanding the full spectrum of cybersecurity risks and in enhancing defenses and improving resiliency in J.P. Morgan's operating environment.


text: Governance and Oversight The governance structure for the Global Cybersecurity and Technology Controls organization is designed to appropriately identify, escalate and mitigate cybersecurity risks. Cybersecurity risk management and its governance and oversight are integrated into J.P. Morgan's operational risk management framework, including through the escalation of key risk and control issues to management and the development of risk mitigation plans for heightened risk and control issues. Independent Risk Management ("IRM") independently assesses and challenges the activities and risk management practices of the Global Cybersecurity and Technology Controls organization related to the identification, assessment, measurement and mitigation of cybersecurity risk. As needed, J.P. Morgan engages third-party assessors or auditing firms with industry-recognized expertise on cybersecurity matters to review specific aspects of J.P. Morgan's cybersecurity risk management framework, processes and controls.


text: The governance and oversight for cybersecurity risk management includes governance forums that inform management of key areas of concern regarding the prevention, detection, mitigation and remediation of cybersecurity risks.


text: The Cybersecurity and Technology Controls Operating Committee ("CTOC") is the principal management committee that oversees J.P. Morgan's assessment and management of cybersecurity risk, including oversight of the implementation and maintenance of appropriate controls in support of J.P. Morgan's Information Security Program. The membership of the CTOC includes senior representatives from the Global Cybersecurity and Technology Controls organization and relevant corporate functions, including IRM and Internal Audit.


text: The CTOC escalates key operational risk and control issues, as appropriate, to the Global Technology Operating Committee ("GTOC") or its business control committee or to the appropriate LOB and Corporate Control Committees. The GTOC is responsible for the governance of the firmwide Global Technology organization, including oversight of firmwide technology strategies, the delivery of technology and technology operations, the effective use of information technology resources, and monitoring and resolving key operational risk and control matters arising in the Global Technology organization.


text: Our board of directors is ultimately responsible for the oversight of risks from cybersecurity threats and has delegated responsibility for such oversight of cybersecurity matters to the audit committee. J.P. Morgan's Cybersecurity Team provides our audit committee with updates, at least semi-annually, concerning cybersecurity risk matters. These updates generally include information regarding cybersecurity and technology developments, J.P. Morgan's Information Security Program and recommended changes to that program, cybersecurity policies and practices, and ongoing initiatives to improve information security, as well as any significant cybersecurity incidents and the Adviser's and J.P. Morgan's efforts to address those incidents.


text: We have also established a Cybersecurity Committee that meets on a quarterly basis to review and agree on actions to address cybersecurity risks. The Cybersecurity Committee is led by our chief information officer, or CIO, who is a part-time consultant, and includes our chief executive officer and chief financial officer. Our CIO, who reports to our chief financial officer, is responsible for the strategic leadership of our cybersecurity programs, identification of cybersecurity risks and the mitigation plans that address these risks. With over 25 years of experience in information technology, the CIO works alongside individuals across other functions, such as clinical operations, legal and quality compliance, to establish and implement our cybersecurity strategy. Our CIO has a bachelor's degree in Technology and an M.B.A. along with over 10 years of experience in information technology in the life sciences industry.

companyName: Trevi Therapeutics, Inc.

ticker: TRVI


text: In an effort to deter and detect cyber threats, we annually provide all employees, including part-time and temporary employees, with a data protection, cybersecurity training and compliance program, which covers timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, use of artificial information and machine learning applications, and asset use, and educates employees on the importance of reporting all incidents immediately. We conduct frequent phishing simulations requiring employees to identify and report simulated phishing emails. We also use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs.


text: Risk management and strategy We have established and maintain various information security processes designed to identify, assess, and manage cybersecurity risks to our critical computer networks, third-party hosted services, communication systems, hardware, software, and vital data, such as intellectual property, confidential proprietary information, strategic assets, and non-clinical/clinical trial data (Information Systems and Data). Our Chief Operating and Financial Officer, Vice President of Information Technology, vCISO (Virtual Chief Information Security Officer), cybersecurity business partner and IT & Legal teams collaborate to address cybersecurity threats and risks, leveraging our risk register when needed. Our VP of Information Technology, vCISO, members of our in-house IT team, and our third-party cybersecurity business partner all play an active role in monitoring and assessing risks from cyber threats through a variety of methods including automated tools, third-party testing, tabletop incident response exercises, threat actor analysis, industry risk profiling, and collaboration with law enforcement.

companyName: Olema Pharmaceuticals, Inc.

ticker: OLMA


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, the security team, which includes our VP of Information Technology, vCISO, and third-party service providers, works with management to prioritize our risk management processes and take steps to mitigate cybersecurity threats that are determined to be more likely to lead to a material impact to our business. Key findings and status of the cybersecurity landscape are reviewed with the Audit Committee of our Board of Directors (the Audit Committee), which evaluates our overall enterprise risk.


text: Security Program Overview The Company's cybersecurity program is framework-based, risk-focused, and metrics-driven. It is supported by a comprehensive set of policies, procedures, and standards based on the NIST cybersecurity framework, encompassing administrative, physical, and technical safeguards. As a service provider and technology partner, we continuously undertake initiatives to address the following areas, ensuring a comprehensive security program.

companyName: CINCINNATI BELL INC


text: Security Governance – The Company's Vice President and Chief Security Officer (CSO) regularly reports to the Board of Directors, providing updates on the threat and risk landscape and the management of cybersecurity incidents. Additionally, the Board has designated a subcommittee that meets quarterly to provide further oversight of the cybersecurity program. This subcommittee comprises board members and the executive leadership team. The CSO also leads a cross-functional, executive-level Security Council that meets quarterly to govern all aspects of the Company's security program.


text: Risk Management – The Company established an Enterprise Risk Management (ERM) Committee that employs the International Organization for Standardization (ISO) risk management standards. Members of the ERM Committee include the Company's CSO, Chief Financial Officer, Chief Network Officer, Director of Safety and Risk Management and the Director of Internal Audit. The committee leverages a risk management tool to maintain a risk register, which systematically identifies, assesses, prioritizes, and manages risks within the enterprise. This structured approach enables us to conduct a formal, periodic risk assessment, ensuring the continuous enhancement of our security posture. In addition to threats, vulnerabilities, impacts and costs, the risk assessment process also identifies the costs and effectiveness of countermeasures and action plans to reduce risk.


text: Security Awareness and Training – The Company established a security awareness program that focuses on individual employees' impact to the overall security strength of the company. Through web-based and in-person training, surveys, and published literature, the Company continuously makes employees aware of the vital role they play in protecting both the Company and customers' data. Phishing exercises are also periodically conducted to improve employee knowledge of and response to security threats. Specialized web-based training covering Payment Card Industry ("PCI"), Health Insurance Portability and Accountability Act ("HIPAA") and Federal Tax Information is also required and tracked for employees who have access to that data.


text: Network Security – The Company employs a "defense in depth" strategy to secure our networks, servers, and data. Our critical networks utilize redundant components and connections to ensure high availability, reliability, and performance. We implement a security architecture based on zero trust principles, establishing rules for segmentation and access control that consider risk and business impact. This approach encompasses infrastructure, applications, and data in the cloud.


text: Security Assessments – Various company environments are regularly audited by a third-party AICPA- and PCAOB-registered certified public accounting firm and has consistently obtained PCI DSS, SSAE18 SOC1, SOC2, CSAE34-16 SOC1 and SOC2 certifications and HIPAA compliance. The Company currently holds 20 such certifications.


text: In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors– Intellectual Property Tax, Regulatory, and Litigation Risks" in this annual report on Form 10-K.


text: Additionally, prior to engaging any vendor that will store sensitive Company information, PSCM performs due diligence on the vendor's information security infrastructure and requires that the vendor agree contractually that the Company's information will be encrypted in transit and at rest and that the appropriate user access controls will apply. As of the date of this report, we are no t aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition.

companyName: Pershing Square SPARC Holdings, Ltd./DE


text: Inland has established a Computer Security Incident Response Team ("Inland CSIRT"), which aims to manage and mitigate the impact of cybersecurity breach events, including those arising from or impacting our Advisor, Dealer Manager and service providers (including the transfer agent), tenants, and other business contacts. Members of the Inland CSIRT include Inland's VP Director of IT Infrastructure & Information Security, who has more than 20 years of experience in information technology security and leads Inland's cybersecurity program, and its Head of Technology Strategy, as well as members of the firm's legal, risk, and communications groups. Inland has established a notification decision framework to determine when the Inland CSIRT will provide notifications regarding certain cybersecurity incidents, with different severity thresholds triggering notifications to different recipient groups, including members of our Advisor's management, and our Board and Audit Committee, as appropriate.

companyName: IPC Alternative Real Estate Income Trust, Inc.


text: Fidelity and its Enterprise Cybersecurity organization, on behalf of the Fund, have established a comprehensive risk management program, which includes processes to identify, assess, and manage cybersecurity risks, including material risks from cybersecurity threats, and to put in place appropriate controls to mitigate these risks and reduce the potential impact to the Fund and its Members. The Fund does not currently have any employees and relies upon Fidelity and its Enterprise Cybersecurity organization for the Fund's day-to-day operations and to establish strategies, policies, and standards for the security of, and operations in, cyberspace.

companyName: Fidelity Private Credit Co LLC


text: The potential impact of risks from cybersecurity threats on the Fund are assessed on an ongoing basis, and how such risks could materially affect the Fund's business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, the Fund did not identify any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Fund, including its day-to-day operations, financial condition, and business strategies. In conjunction with Fidelity's Enterprise Cybersecurity organization, the Fund participates in regular testing of applicable incident response processes to ensure appropriate escalation, mitigation, communication and reporting processes are in place.


text: The Fund's management, including the CCO of the Fund, is responsible for assessing and managing material risks from cybersecurity threats. In connection with the Fund's reliance on Fidelity and its Enterprise Cybersecurity organization, the CCO relies on the cybersecurity expertise of Fidelity's CISO and members of the CISO's staff to assist in assessing and managing the Fund's material risks from cybersecurity threats. The CISO has over thirty years of experience as a technology and information risk management leader, holding global senior management roles with large, diversified financial services companies. He has served as Fidelity's CISO since May 2024. The CCO has been responsible for this oversight function as CCO to the Fund for three years and has worked in the financial services industry for sixteen years, during which the CCO has gained expertise in assessing and managing risks applicable to the company.


text: The Fund's management, including the CCO of the Fund, is responsible for assessing and managing material risks from cybersecurity threats. In connection with the Fund's reliance on Fidelity and its Enterprise Cybersecurity organization, the CCO relies on the cybersecurity expertise of Fidelity's CISO and members of the CISO's staff to assist in assessing and managing the Fund's material risks from cybersecurity threats. The CISO has over thirty years of experience as a technology and information risk management leader, holding global senior management roles with large, diversified financial services companies. He has served as Fidelity's CISO since May 2024. The CCO has been responsible for this oversight function as CCO to the Fund for three years, and has worked in the financial services industry for sixteen years, during which the CCO has gained expertise in assessing and managing risks applicable to the Fund.

companyName: Fidelity Private Credit Fund


text: 3. Intellectual Property Theft: Unauthorized access to our proprietary information could result in intellectual property theft, which would impact our competitive position in the market.

companyName: ONE STOP SYSTEMS, INC.

ticker: OSS


text: Although cybersecurity incidents have not materially impacted our business strategy, results of operations, or financial condition to date, there can be no assurance that they will not do so in the future.


text: Risk Management and Strategy Assessing, Identifying, and Managing Material Cyber Threats We have specific infrastructure, systems, policies, and procedures designed to proactively and reactively address circumstances that arise when unexpected events such as a cybersecurity incident occur. These include processes for assessing, identifying, and managing material risks from cybersecurity threats. We consult with external parties, such as cybersecurity firms and risk management and governance experts, on risk management and strategy. We use a team of outside vendors and government services specializing in IT and cybersecurity that provide expertise, tools, and methodologies to identify and assess vulnerabilities and potential threats. Automated tools and AI-based user behavior analytics also support identifying and managing cyber threats. Response to a broad category of threats is immediate and automatic. Security personnel and members of our management are alerted when cyber threats or anomalies are detected. Persistent threats or issues that, in the opinion of management, are material are immediately brought to the attention of our board of directors.


text: In the event of a detected cyber incident by 24/7 monitoring software or employee notification, our IT and cybersecurity provider performs a detailed assessment of the incident, identifies the source of the problem, and resolves the issue as appropriate. If they cannot resolve the issue, the problem is escalated to our cybersecurity monitoring and detection software provider for resolution. Events that our IT and cybersecurity providers do not routinely resolve are brought to the Board's attention.


text: Critical business and operational data are backed up nightly and securely stored offsite to mitigate the risks of cybersecurity incidents or equipment failure. We provide cybersecurity awareness training to our employees, incident response personnel, and senior management.


text: Our management team, including our Vice President of Technology, is primarily responsible for assessing and managing our material risks from cybersecurity threats. Management supervises our internal cybersecurity and IT personnel and our retained external cybersecurity consultants and vendors. Additionally, they supervise efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefing from internal or external security personnel; threat intelligence and other information obtained from governmental, public, or private sources, including external consultants or vendors engaged by us; and alerts and reports produced by security tools deployed in our IT environment.


text: Our Board of Directors, through its Audit & Risk Committee, provides oversight and oversees management processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Management, including our Vice President of Technology and our Audit & Risk Committee members, regularly brief our board of directors on our cybersecurity and information security posture and cybersecurity incidents deemed to have a moderate or higher business impact, even if viewed as immaterial to us. As cyber threats evolve and become more sophisticated, we believe that the Board's involvement in cybersecurity governance ensures that we adequately focus resources to protect the Company's assets and reputation.


text: Vital aspects of our cybersecurity governance that are currently in process or have been implemented include the following: • Governance and Strategy: Management, the Audit & Risk Committee, and the Board ensure that our cybersecurity strategy is aligned with our business strategy. • Risk Management and Oversight: Our Audit & Risk Committee and the Board, as part of the board's enterprise risk management oversight, actively oversee our cybersecurity risk management framework, ensuring that material risks are identified, assessed, and mitigated. • Resource Allocation: o Budget Approval: The Board reviews and approves cybersecurity budgets and resource allocations to ensure we have adequate resources to implement and maintain effective cybersecurity measures.


text: o Investment Decisions: The Board evaluates and approves significant investments in cybersecurity technologies, training, and talent based on the recommendations of management or our external vendors and consultants. o Regulatory Compliance: Management and the Board oversee compliance with relevant cybersecurity regulations and legal requirements.


text: o Legal Oversight: Management and the Board ensure we have appropriate legal counsel to address cybersecurity-related issues, including incident notification requirements.