text: Risk Management and Strategy We have developed processes for assessing, identifying and managing material risks from cybersecurity threats. Our enterprise risk assessment and management system incorporates risks from cybersecurity threats alongside other risks to the Company. We also have a management level risk management council that supports our processes to assess and manage cybersecurity and other risks. Our information security team oversees and implements security controls designed to minimize the risk or impact of any breach or unauthorized disclosure of our confidential and sensitive data, including protected health and personal information. These controls include endpoint protection and response software (anti-virus), network intrusion detection devices, a vulnerability management program, IT and third-party risk management programs, and multifactor authentication. We provide annual security awareness training for corporate and store associates, and we administer periodic phishing testing and training to associates who have access to a company email address. The security of the National Vision network is monitored by a Security Operations Center ("SOC"), which works with our information security team with the aim of preventing realization of attacks by threat actors. We also maintain an incident response plan which, among other things, is designed to mitigate the impact of an incident, assist in restoring normal business operations, comply with applicable regulatory obligations arising from an incident and prevent similar future incidents. Our risk management processes also address cybersecurity threat risks associated with our use of third-party service providers. Our Chief Technology Officer ("CTO") collaborates with our information security and legal teams to conduct periodic table-top exercises and testing of our data security and incident response procedures. Periodically, we engage specialized third parties to conduct exercises that stress test our data security systems and practice company-wide response tactics. We also conduct third-party HIPAA risk assessments to identify and catalog potential risks to health data.

companyName: National Vision Holdings, Inc.

ticker: EYE


text: As of the date of this report, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, as discussed under "Item 1A. Risk Factors – We rely heavily on our information technology systems, as well as those of our vendors, for our business to effectively operate and to safeguard confidential information; any significant failure, inadequacy, interruption or security breach could adversely affect our business, financial condition and operations," the sophistication of cyber threats continues to increase, and the actions we take to reduce the risk of cyber incidents and protect our systems and information may be insufficient. As such, no matter how well our controls are designed or implemented, we cannot assure that we will be able to anticipate all security breaches, and we may not be able to implement effective preventive measures against such security breaches in a timely manner.

secItem: Item 1C


text: Our CTO oversees our approach to cybersecurity and is responsible for assessing and managing our material risks from cybersecurity threats. Our CTO has served in this role at the Company since 2020, and has more than 25 years of experience in the aggregate in various senior roles involving managing global information technology and security teams spanning strategy, implementation, operations and compliance. The Vice President of Information Technology Infrastructure collaborates with the CTO and a supporting team to maintain and update the Company's technology infrastructure and corresponding safety measures. Our VP of Information Technology Infrastructure has served in this role at the Company for over six years, has over 25 years of experience in information technology systems and holds a bachelor of science degree in computer information systems.


text: Our CTO is informed about, and monitors the prevention, detection, mitigation and remediation of, cybersecurity incidents through the management of and participation in the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. When a cybersecurity incident occurs or we identify a vulnerability, we have cross-functional teams that are responsible for leading the initial assessment of priority and severity, and external experts may also be engaged as appropriate.


text: The audit committee of our Board oversees our enterprise risk management process, which includes risks from cybersecurity threats. The audit committee regularly receives reports from management with respect to risks from cybersecurity threats and quarterly reviews cybersecurity and data security risks and mitigation strategies, along with program assessments, planned improvements and the status of information technology initiatives with the CTO. These risks and mitigation strategies are also periodically reviewed by the entire Board.


text: Risk Management and Strategy We have developed processes for assessing, identifying and managing material risks from cybersecurity threats. Our enterprise risk assessment and management system incorporates risks from cybersecurity threats alongside other risks to the Company. We also have a management level risk management council that supports our processes to assess and manage cybersecurity and other risks. Our information security team oversees and implements security controls designed to minimize the risk or impact of any breach or unauthorized disclosure of our confidential and sensitive data, including protected health and personal information. These controls include endpoint protection and response software (anti-virus), network intrusion detection devices, a vulnerability management program, IT and third-party risk management programs, and multifactor authentication. We provide annual security awareness training for corporate and store associates, and we administer periodic phishing testing and training to associates who have access to a company email address.


text: The security of the National Vision network is monitored by a Security Operations Center ("SOC"), which works with our information security team with the aim of preventing realization of attacks by threat actors. We also maintain an incident response plan which, among other things, is designed to mitigate the impact of an incident, assist in restoring normal business operations, comply with applicable regulatory obligations arising from an incident and prevent similar future incidents. Our risk management processes also address cybersecurity threat risks associated with our use of third-party service providers. Our Chief Technology Officer ("CTO") collaborates with our information security and legal teams to conduct periodic table-top exercises and testing of our data security and incident response procedures. Periodically, we engage specialized third parties to conduct exercises that stress test our data security systems and practice company-wide response tactics. We also conduct third-party HIPAA risk assessments to identify and catalog potential risks to health data.


text: In the last three fiscal years, we have not experienced a material information security breach incident and the expenses we have incurred from information security breach incidents have been immaterial, and we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business, including our business strategy, results of operations, or financial condition. However, as discussed under "Item 1A. Risk Factors – We rely heavily on our information technology systems, as well as those of our vendors, for our business to effectively operate and to safeguard confidential information; any significant failure, inadequacy, interruption or security breach could adversely affect our business, financial condition and operations," the sophistication of cyber threats continues to increase, and the actions we take to reduce the risk of cyber incidents and protect our systems and information may be insufficient. As such, no matter how well our controls are designed or implemented, we cannot assure that we will be able to anticipate all security breaches, and we may not be able to implement effective preventive measures against such security breaches in a timely manner.


text: Our CTO oversees our approach to cybersecurity and is responsible for assessing and managing our material risks from cybersecurity threats. Our CTO has served in this role at the Company since 2020, and has more than 25 years of experience in the aggregate in various senior roles involving managing global information technology and security teams spanning strategy, implementation, operations and compliance. The Vice President of Information Technology Infrastructure collaborates with the CTO and a supporting team to maintain and update the Company's technology infrastructure and corresponding safety measures. Our VP of Information Technology Infrastructure has served in this role at the Company for over seven years, has over 25 years of experience in information technology systems and holds a bachelor of science degree in computer information systems.


text: The audit committee of our Board, pursuant to its charter, oversees our enterprise risk management process, which includes risks from cybersecurity threats. The audit committee regularly receives reports from management with respect to risks from cybersecurity threats and quarterly reviews cybersecurity and data security risks and mitigation strategies, along with program assessments, planned improvements and the status of information technology initiatives with the CTO. These risks and mitigation strategies are also periodically reviewed by the entire Board.


text: Risk Management and Strategy CONSOL Energy has a cybersecurity risk program that is based on industry standards and best practices managed by a dedicated staff and specialists that support this program. We have implemented a set of system, network and application-level controls to protect our corporate data and systems. These controls are monitored for cybersecurity risk events and incidents on a continuous basis by a dedicated staff of cybersecurity professionals and various third-party providers. These controls are updated as necessary to protect the Company. In addition, the Company also takes a proactive approach by monitoring cyber threat intelligence to stay informed regarding emerging risks. The cybersecurity risk program also utilizes third-party assessors, consultants and auditors to perform various services, such as tabletop exercises and network penetration tests. The Company provides awareness training to its employees to help identify, avoid and mitigate cybersecurity threats. Employees with network access participate quarterly in required training, including spear phishing and other awareness training. The program also has a policy in place to address vendor and third-party risk. Cybersecurity risk is also evaluated during the acquisition process for new products and services.

companyName: Core Natural Resources, Inc.

ticker: CNR


text: CONSOL Energy accounts for cybersecurity risk as a part of the Company's overall business strategy and planning. The Board's Audit Committee, which oversees all matters related to risk management and, in particular, the security of and risks related to the Company's information technology systems, receives regular reports on the Company's cybersecurity risk management efforts from various senior officers of the Company. The Company also has a corporate cybersecurity risk Steering Committee, which is a cross-functional group comprised of both senior management and other key business unit leaders that provides input to senior management on the Company's cybersecurity risk program.


text: CONSOL Energy has not experienced any operational or financial impact as the result of a cybersecurity risk or incident and, at this time, the risks from cybersecurity threats are not reasonably likely to materially affect the Company's business strategy, results of operations or financial condition. However, it is prepared to mitigate and respond to such an event should it occur. CONSOL Energy has prepared a comprehensive Cybersecurity Incident Response Plan, as well as an Information Technology Disaster Recovery Plan. These plans are reviewed, updated and tested on a regular basis. Specifically, CONSOL Energy conducts cybersecurity tabletop exercises that include participation by Audit Committee members, senior management and third-party cybersecurity consultants.


text: The Company faces a range of cybersecurity threats including threats common to many industries, such as ransomware and denial of service, as well as more advanced threats specific to critical infrastructure industries such as mining. CONSOL Energy's customers, equipment suppliers, transportation facility providers and joint venture partners face similar cybersecurity threats, and a cybersecurity incident affecting the Company or any of these entities could materially affect our operations, performance and results of operations. The Company continues to invest in the cybersecurity and resiliency of its networks and to enhance its internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain. For more information regarding the risks we face from cybersecurity, please see the section titled "Risk Factors - Terrorist attacks or cyber incidents could result in information theft, data corruption, operational disruption and/or financial loss."


text: The CONSOL Energy Board of Directors has assigned oversight of cybersecurity risk to the Audit Committee, as outlined in the Committee's charter. Updates on the cybersecurity risk program are provided at each Audit Committee meeting. Additionally, CONSOL Energy's senior management engages with the Audit Committee on a regular basis to provide updates on our cybersecurity risk program.


text: The Company has a Cybersecurity Manager who reports directly to the Director of Information Technology. CONSOL Energy's Cybersecurity Manager has 25 years of industry experience and holds many relevant industry certifications. The Cybersecurity Manager has direct oversight of the cybersecurity risk program. Cybersecurity risk briefings are provided to the Audit Committee by the Director of Information Technology at all regular meetings. Additionally, the Director of Information Technology and Cybersecurity Manager communicate directly with the Audit Committee chair as needed to ensure adequate oversight of the program.


text: Risk Management and Strategy The Company has a cybersecurity risk program that is based on industry standards and best practices managed by a dedicated staff and specialists that support this program. We have implemented a set of system, network and application-level controls to protect our corporate data and systems. These controls are monitored for cybersecurity risk events and incidents on a continuous basis by a dedicated staff of cybersecurity professionals and various third-party providers. These controls are updated as necessary to protect the Company. In addition, the Company also takes a proactive approach by monitoring cyber threat intelligence to stay informed regarding emerging risks. The cybersecurity risk program also utilizes third-party assessors, consultants and auditors to perform various services, such as tabletop exercises and network penetration tests. The Company provides awareness training to its employees to help identify, avoid and mitigate cybersecurity threats. Employees with network access participate quarterly in required training, including spear phishing and other awareness training. The program also has a policy in place to address vendor and third-party risk. Cybersecurity risk is also evaluated during the acquisition process for new products and services.


text: The Company accounts for cybersecurity risk as a part of the Company's overall business strategy and planning. The Board's Audit Committee, which oversees all matters related to risk management and, in particular, the security of and risks related to the Company's information technology systems, receives regular reports on the Company's cybersecurity risk management efforts from various senior officers of the Company. The Company also has a corporate cybersecurity risk Steering Committee, which is a cross-functional group comprised of both senior management and other key business unit leaders that provides input to senior management on the Company's cybersecurity risk program.


text: The Company has not experienced any material operational or financial impact as the result of a cybersecurity risk or incident and, at this time, the risks from cybersecurity threats are not reasonably likely to materially affect the Company's business strategy, results of operations or financial condition. However, it is prepared to mitigate and respond to such an event should it occur. The Company has prepared a comprehensive Cybersecurity Incident Response Plan, as well as an Information Technology Disaster Recovery Plan. These plans are reviewed, updated and tested on a regular basis. Specifically, the Company conducts cybersecurity tabletop exercises that include participation by Audit Committee members, senior management and third-party cybersecurity consultants.


text: The Company faces a range of cybersecurity threats including threats common to many industries, such as ransomware and denial of service, as well as more advanced threats specific to critical infrastructure industries such as mining. The Company's customers, equipment suppliers, transportation facility providers and joint venture partners face similar cybersecurity threats, and a cybersecurity incident affecting the Company or any of these entities could materially affect our operations, performance and results of operations. The Company continues to invest in the cybersecurity and resiliency of its networks and to enhance its internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain. For more information regarding the risks we face from cybersecurity, please see the section titled "Risk Factors - Terrorist attacks or cyber incidents could result in information theft, data corruption, operational disruption and/or financial loss."


text: The Company's Board of Directors has assigned oversight of cybersecurity risk to the Audit Committee, as outlined in the Committee's charter. Updates on the cybersecurity risk program are provided at each Audit Committee meeting. Additionally, the Company's senior management engages with the Audit Committee on a regular basis to provide updates on our cybersecurity risk program.


text: The Company has a Cybersecurity Manager who reports directly to the Director of Information Technology. The Company's Cybersecurity Manager has 25 years of industry experience and holds many relevant industry certifications. The Cybersecurity Manager has direct oversight of the cybersecurity risk program. Cybersecurity risk briefings are provided to the Audit Committee by the Director of Information Technology at all regular meetings. Additionally, the Director of Information Technology and Cybersecurity Manager communicate directly with the Audit Committee chair as needed to ensure adequate oversight of the program.


text: The Evergy Companies utilize an enterprise risk management framework to identify, evaluate and minimize risks. Risk management personnel meet annually with subject matter experts and each board member to identify and assess enterprise risk and also confer with each board member about the Evergy Companies' risk management profile. Evergy's Board of Directors (Evergy Board) has assigned primary oversight of enterprise risk management practices to the Audit Committee of the Evergy Board. At least annually, the Audit Committee reviews and discusses with management the Evergy Companies' enterprise risk management policies, processes, and frameworks, including conclusions reached regarding risk assessment and risk management.

companyName: Evergy, Inc.

ticker: EVRG


text: Certain significant risks identified by the enterprise risk management process, such as cybersecurity, have a cross-functional team assigned to assess and manage the specific risk and may have oversight by a committee other than the Audit Committee. The Senior Vice President, Chief Technology Officer (CTO) and Vice President, Chief Nuclear Officer (CNO), have overall accountability for the assessment, identification and management of cybersecurity risks on behalf of the Evergy Companies and Wolf Creek, respectively, subject to review by the Evergy Board and its committees. The CTO and CNO leverage the input and operations of the security management and operations team within each organizational structure. The security teams, comprised of cybersecurity professionals, lead the daily cyber risk mitigation efforts including cyber training of the workforce, threat monitoring, identification of potential cyber events and applicable compliance obligations. See Part I, Item 1, Business – Information about Evergy's Executive Officers for a description of the CTO's experience. The CNO has management responsibility of Wolf Creek where he has served in executive capacities since joining Wolf Creek in 2014. Prior to joining Wolf Creek, he served as vice president of engineering and site vice president of another nuclear power plant from 2009 until 2014.


text: The Evergy Board has assigned primary oversight of cybersecurity risk to the Safety and Power Delivery Committee of the Evergy Board. At each Safety and Power Delivery Committee meeting, the CTO discusses the Evergy Companies' cybersecurity metrics and scorecard performance; global, industry and Evergy-specific cybersecurity news; third-party assessments of the Evergy Companies' cybersecurity program; and industry benchmarking results. The Safety and Power Delivery Committee meets regularly throughout the year and may meet more frequently or otherwise be informed of cybersecurity risk and incident information as needed. The Nuclear, Power Supply and Environmental Committee of the Evergy Board supports the Safety and Power Delivery Committee's review of cybersecurity risk limited to power supply resources. The CNO discusses with the Nuclear, Power Supply and Environmental Committee risks specific to Wolf Creek, including cybersecurity risk, at least twice per year. The CNO may inform the Nuclear, Power Supply and Environmental Committee of cybersecurity matters more frequently as needed. At least once each year, the Evergy Board receives a report from management on key business and compliance risks and related mitigation plans, and management discusses cybersecurity matters with the Evergy Board in connection with this report. The Evergy Companies also have a Security and Business Continuity Committee made up of internal security experts and several Evergy corporate officers. This committee meets bi-monthly to discuss relevant security and business continuity issues.


text: The Evergy Companies' risk mitigation function utilizes the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF), the United States Department of Energy Cyber Capability Maturity Model (C2M2) standard and components of National Institute of Standards and Technology Risk Management Framework (NIST RMF) for a comprehensive, flexible and risk-based approach to managing risk from cybersecurity threats that integrates, security, privacy and cyber supply chain risk management activities. The NIST RMF considers effectiveness, efficiency and constraints due to applicable laws and regulations.


text: The Evergy Companies' cybersecurity organization use the NIST CSF to model the security program. The Evergy Companies have implemented a layered defense model to protect against cyber intrusions and attacks. The Evergy Companies employ security practitioners with cybersecurity and information technology degrees and certifications and with extensive experience, with several holding top secret and secret federal government clearances. The Evergy Companies have a 24-hour Security Operations Center that monitors for security events and the Evergy Companies frequently engage with multiple third parties to analyze network traffic. Further, the Evergy Companies regularly and as needed engage cybersecurity consultants and third parties to assist with the identification, assessment and mitigation of cybersecurity risks and assessment of the Evergy Companies' risk mitigation practices.


text: Cybersecurity threats are identified and mitigated by cybersecurity incident response plans that detail the actions to be taken when a cybersecurity incident occurs. The cybersecurity incident response plans define the organization, roles and responsibilities of the teams tasked with mitigating the impact of the cybersecurity incident. They define repeatable processes for responding to cybersecurity incidents; ensure communication to the CTO and CNO, as appropriate; minimize the impact to customer and business operations; coordinate response activities with external organizations; decrease the likelihood of reoccurrence and ensure regulatory reporting occurs, among other objectives. In addition, the Evergy Companies share network traffic with federal and state agencies to assist with the identification and mitigation of cybersecurity incidents. The Evergy Companies participate in federal and industry information sharing programs, such as the Cybersecurity and Infrastructure Security Agency to assist in the exchange of cybersecurity-related information, analysis and incident mitigation techniques. On at least an annual basis, cross-functional teams and executive management participate in a simulated cybersecurity incident exercise and the Evergy Companies regularly simulate cybersecurity incidents, including phishing attacks, to assess organizational readiness. In addition to a bi-annual internal assessment, the NRC inspects Wolf Creek's processes to validate the effectiveness of the program to protect Wolf Creek from cybersecurity threats.


text: In addition, the Evergy Companies review many third parties with whom the Evergy Companies do business to understand and evaluate potential cybersecurity risks of engaging the third party and work with the third party to appropriately mitigate identified risks, as needed. Among other measures, certain third parties are required to have processes in place to mitigate risk that data would be compromised, to become aware of cybersecurity incidents and/or to promptly notify the Evergy Companies of any cybersecurity incidents. Generally, the Evergy Companies retain the right to perform an assessment, audit, examination or review of all controls in the third parties' environment to monitor compliance with applicable cybersecurity agreements. The Evergy Companies may decide not to move forward with a third party that does not meet security requirements.


text: While the Evergy Companies have a cybersecurity program designed to protect and preserve the integrity of their information systems, the Evergy Companies also maintain cybersecurity insurance to manage financial statement risk resulting from specific cyber attacks. Although the Evergy Companies maintain cybersecurity insurance, there can be no guarantee that the Evergy Companies' insurance coverage limits will protect against any future claims or that such insurance proceeds will be paid in a timely manner.


text: The Evergy Companies have been subjected to attempted cyber attacks from time to time, and will likely continue to be subject to such attempted attacks, but these prior attacks have not had a material impact on the Evergy Companies' operations or financial results to date. However, because technology is increasingly complex and cyber attacks are increasingly sophisticated and more frequent, there can be no assurance that such incidents will not have a material adverse effect on the Evergy Companies in the future. See Item 1A. Risk Factors – Operational Risks for additional information.


text: The Evergy Board has assigned primary oversight of cybersecurity risk to the Operations Committee of the Evergy Board. At each Operations Committee meeting, the CTO discusses the Evergy Companies' cybersecurity metrics and scorecard performance; global, industry and Evergy-specific cybersecurity news; third-party assessments of the Evergy Companies' cybersecurity program; and industry benchmarking results. The Operations Committee meets regularly throughout the year and may meet more frequently or otherwise be informed of cybersecurity risk and incident information as needed. The CNO discusses with the Operations Committee risks specific to Wolf Creek, including cybersecurity risk. At least once each year, the Evergy Board receives a report from management on key business and compliance risks and related mitigation plans, and management discusses cybersecurity matters with the Evergy Board in connection with this report. The Evergy Companies also have a Security and Business Continuity Committee made up of internal security experts and several Evergy corporate officers. This committee meets bi-monthly to discuss relevant security and business continuity issues.


text: The Evergy Companies' cybersecurity organization uses the NIST CSF to model the security program. The Evergy Companies have implemented a layered defense model to protect against cyber intrusions and attacks. One layer of defense is Evergy's employees and their abilities to detect and respond to phishing attempts. Evergy conducts annual security awareness training and monthly phishing simulations. Employees that perform poorly in the phishing simulations are subject to additional training and disciplinary action. Other defense layers include firewalls at both the network and application layers, network segmentation, email scanning, multi-factor authentications, cloud security monitoring, in addition to other defensive layers. Several of the Evergy Companies' security tools employ AI and machine learning to enhance their respective capabilities. The Evergy Companies employ security practitioners with cybersecurity and information technology degrees and certifications and with extensive experience, with several holding federal government clearances. The Evergy Companies have a 24-hour Security Operations Center that monitors for security events and the Evergy Companies frequently engage with multiple third parties to analyze network traffic. Further, the Evergy Companies regularly and as needed engage cybersecurity consultants and third parties to assist with the identification, assessment and mitigation of cybersecurity risks and assessment of the Evergy Companies' risk mitigation practices. These services include, but are not limited to, the identification of vulnerabilities, penetration testing and assessment of the cybersecurity program to both validate effectiveness and also identify any areas for improvement.


text: Cybersecurity incidents are identified and mitigated by cybersecurity incident response plans that detail any actions to be taken when a cybersecurity incident occurs. The cybersecurity incident response plans define the organization, roles and responsibilities of the teams tasked with mitigating the impact of the cybersecurity incident. They define repeatable processes for responding to cybersecurity incidents; ensure communication to the CTO and CNO, as appropriate; minimize the impact to customer and business operations; coordinate response activities with external organizations; decrease the likelihood of reoccurrence and ensure regulatory reporting occurs, among other objectives. If warranted, the incident response plan may trigger the activation of the Crisis Management Team, a subset of officers who lead corporate functions and would collectively perform impact assessment and provide decision-making guidance as a component of the Crisis Management Plan within the Evergy Companies' business continuity and disaster recovery plans. Both the incident response plan and crisis management plan are practiced on an annual basis. In addition, the Evergy Companies share network traffic with federal and state agencies to assist with the identification and mitigation of cybersecurity incidents. The Evergy Companies participate in federal and industry information sharing programs, such as the Cybersecurity and Infrastructure Security Agency to assist in the exchange of cybersecurity-related information, analysis and incident mitigation techniques. On at least an annual basis, cross-functional teams and executive management participate in a simulated cybersecurity incident exercise and the Evergy Companies regularly simulate cybersecurity incidents, including phishing attacks, to assess organizational readiness. In addition to a bi-annual internal assessment, the NRC inspects Wolf Creek's processes to validate the effectiveness of the program to protect Wolf Creek from cybersecurity threats.


text: While the Evergy Companies have a cybersecurity program designed to protect and preserve the integrity of their information systems, the Evergy Companies also maintain cybersecurity insurance to manage financial statement risk resulting from specific cyber-attacks. Although the Evergy Companies maintain cybersecurity insurance, there can be no guarantee that the Evergy Companies' insurance coverage limits will protect against any future claims or that such insurance proceeds will be paid in a timely manner.


text: The Evergy Companies have been subjected to attempted cyber-attacks from time to time, and will likely continue to be subject to such attempted attacks, but these prior attacks have not had a material impact on the Evergy Companies' operations or financial results to date. However, because technology is increasingly complex and cyber-attacks are increasingly sophisticated and more frequent through the use of such tools as AI, there can be no assurance that such incidents will not have a material adverse effect on the Evergy Companies in the future. See Item 1A. Risk Factors – Operational Risks for additional information.


text: Cybersecurity represents a critical component of our overall approach to risk management. Our cybersecurity policies, standards, and practices are integrated into our enterprise risk management approach, and cybersecurity risks are among the core enterprise risks that are subject to oversight by our Board of Directors (the "Board"). We generally approach cybersecurity threats through a cross-functional, multilayered approach, with specific goals of: (i) identifying, preventing and mitigating cybersecurity threats to the Company; (ii) preserving the confidentiality, security and availability of the information that we collect and store; (iii) protecting the Company's intellectual property; (iv) maintaining the confidence of our customers, suppliers and other third parties; and (v) providing appropriate public disclosure of cybersecurity risks and incidents when required.

companyName: Krystal Biotech, Inc.

ticker: KRYS


text: Cyber Security Risk Management and Strategy Our cybersecurity program focuses on the following areas: • Vigilance: Our cybersecurity threat operations function 24/7 with the specific goal of identifying, preventing and mitigating cybersecurity threats and responding to cybersecurity incidents in accordance with our established incident response and recovery plans. • Systems Safeguards: We deploy systems safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through ongoing vulnerability assessments and cybersecurity threat intelligence. • Third-Party Risk Management: We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Training: We provide periodic mandatory training for personnel regarding cybersecurity threats, which reinforces the Company's information security policies, standards and practices. • Incident Response and Recovery Planning: We have established and maintain incident response and recovery plans that address the Company's response to a cybersecurity incident and the recovery from a cybersecurity incident, and such plans are tested and evaluated on an regular basis. • Communication, Coordination and Disclosure: We utilize a cross-functional approach to address the risk from cybersecurity threats, involving management personnel from the Company's technology, operations, legal, financial, and other key business functions, as well as the members of the Board in an ongoing dialogue regarding cybersecurity threats and incidents, while also implementing controls and procedures so that decisions regarding the disclosure and reporting of such incidents can be made by management in a timely manner.


text: A part of our strategy for managing risks from cybersecurity threats is assessment and testing of the effectiveness of our cybersecurity measures. We engage third parties to perform assessments on our cybersecurity measures, and we adjust our cybersecurity measures as necessary based on the information provided by the assessments.


text: The Board oversees the management of risks from cybersecurity threats. The Board receives regular presentations and reports on cybersecurity, which address a wide range of topics and also receives prompt and timely information regarding any cybersecurity incident that is or may become material, as well as ongoing updates regarding such incident until it has been addressed. At least once each year, the Board discusses the Company's approach to cybersecurity risk management with the Company's Vice President of Information Technology, who is the member of management that is principally responsible for overseeing cybersecurity at the Company, in partnership with other business leaders across the Company, including our Chief Executive Officer, Chief Accounting Officer, General Counsel, and Human Resources leader. Our Vice President of Information Technology has served in various roles in information technology and information security for over 28 years, including serving as Chief Information Security Officer of several public companies. He holds undergraduate and graduate degrees in electrical engineering and computer science and has attained numerous professional certifications in Information Security throughout his career.


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected or are reasonably likely to affect the Company, including its business strategy, results of operations, or financial condition.


text: The Board oversees the management of risks from cybersecurity threats. The Board receives regular presentations and reports on cybersecurity, which address a wide range of topics and also receives prompt and timely information regarding any cybersecurity incident that is or may become material, as well as ongoing updates regarding such incident until it has been addressed. At least once each year, the Board discusses the Company's approach to cybersecurity risk management with the Company's Senior Director of Cyber Securit y, who is the member of management that is principally responsible for overseeing cybersecurity at the Company, in partnership with other business leaders across the Company, including our Chief Executive Officer, Chief Accounting Officer, General Counsel, and Human Resources leader. Our Senior Director of Cyber Security has served in various roles in information technology and information security for over 20 years, including serving as Information Security Officer for a global medical device manufacturer. He holds degrees in Global Business Management and Computer Science.


text: We have established a cybersecurity program, which we view as a foundational business practice incorporated into our broader risk management framework, as well as into all planning, development, operations and administration objectives. We have benchmarked our cybersecurity program against recognized frameworks established by the NIST, the International Organization for Standardization and other applicable industry standards.

companyName: Liberty Latin America Ltd.

ticker: LILA


text: Governance of Cybersecurity Risks From a governance perspective, our Audit Committee oversee our cybersecurity program, including the management of risks arising from cybersecurity threats. Our Audit Committee receives quarterly reports from both internal (e.g., management) and external sources (e.g., third-arty consultants), which cover topics that include, but are not limited to, recent cyber developments, evolving cyber standards, vulnerability assessments, third-party and independent reviews, the cyber threat environment, technological trends, and other cybersecurity considerations arising with respect to our company and third parties. Our GISO also keeps our executive team and our Audit Committee (if necessary) informed regarding any security incident that meets established reporting thresholds and ongoing updates regarding any such incident until it has been closed out.


text: Management of Cybersecurity Risks From a management perspective, our GISO, led by our Chief Information Security Officer, operates our cybersecurity program. Our program aligns with the NIST cybersecurity standard functions (Identify, Protect, Detect, Respond, Recover) and aims to secure our networks, information systems, information resources, data, services, and products against internal and external threats and mitigate security vulnerabilities while efficiently operating our business. We have integrated our cybersecurity program into our overall enterprise risk management program.


text: Our GISO has processes in place to stay informed of and monitor the prevention, detection, mitigation and remediation of cybersecurity risks, including but not limited to, employing appropriate incident prevention and detection software, employing industry-standard encryption protocols where appropriate, applying patches and implementing identified corrective actions in a timely manner, maintaining an incident response plan and related procedures and regularly conducting internal training, cybersecurity audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning.


text: Engagement of Third-Parties Our GISO partners with third-party cybersecurity service and product vendors to provide protection of our networks, information resources, products, services and data for our customers and employees. Furthermore, our GISO engages third-party cybersecurity and data protection experts to perform assessments on the efficacy of our cybersecurity program and measures, including cybersecurity maturity assessments, audits and independent reviews of our cybersecurity control environment and operating effectiveness. Our Chief Information Security Officer reports the results of such assessments, audits and reviews to our executive team and our Audit Committee.


text: We have implemented policies and practices to manage cybersecurity risks arising from our use of third-party service providers. For example, in general, we contractually require our third-party service providers to maintain cybersecurity controls to protect our confidential information, to share information with our company about their information security programs and to inform us of any security incidents on their systems that could impact our operations or confidential information. Although we rely on our third party service providers to implement security programs commensurate with their risk, we cannot ensure in all circumstances that their efforts will be successful.


text: Our Senior Leadership Team's Qualifications Our current Chief Information Security Officer has served in various roles in information technology and information security for over 15 years, including as the Director of Information Security at the Colombian operations of a telecommunications company operating throughout Latin America and as the Head of Information Security in the Colombian operations of a large retail company operating in South America. Our Chief Information Security Officer holds undergraduate, graduate and master's degrees in risk management, business administration and information technology, as well as professional certification as a Certified Information Security Manager.


text: Our current Chief Technology Officer has extensive experience in running and managing cyber risks at large U.S. telecommunication companies and, prior to joining our company, had led the cybersecurity practice at a business unit at a large telecommunications company and established cyber risk identification, detection and protection practices for enterprise and government customers. Our Chief Technology Officer holds undergraduate and master's degrees in electrical engineering and has served in various roles in information technology at several telecommunications companies for over 30 years, including serving as either the Chief Technology Officer, Chief Information Officer or Chief Product Officer of three public companies.


text: Our Chief Executive Officer previously served as Chief Technology Officer at three other large media and telecommunications companies prior to becoming our Chief Executive Officer, which gave him significant security technology and operational responsibility over large networks. Our Chief Executive Officer had also led the venture arm at another leading telecommunications company which had invested in a number of IT security technology companies. The other members of our senior leadership team hold undergraduate and graduate degrees in their respective fields and have experience managing risks.


text: Material Impact from Cybersecurity Threats At the time of filing of this Annual Report on Form 10-K, to our knowledge, we have not experienced any cybersecurity threats that have materially affected our company (or are reasonably likely to materially affect our company), including our business strategy, operations or financial condition. For more information regarding cybersecurity risks faced by our company, see Item 1A. Risk Factors—Factors Relating to Cybersecurity—Factors Relating to Cybersecurity, which are incorporated by reference into this section.


text: Governance of Cybersecurity Risks From a governance perspective, our Audit Committee oversees our cybersecurity program, including the management of risks arising from cybersecurity threats. Our Audit Committee receives quarterly reports from both internal (e.g., management) and external sources (e.g., third-party consultants), which cover topics that include, but are not limited to, recent cyber devel opments, evolving cyber standards, vulnerability assessments, third-party and independent reviews, the cyber threat environment, technological trends, and other cybersecurity considerations arising with respect to our company and third parties. Our GISO and Chief Legal Officer also keep our executive team and our Audit Committee (if necessary) informed regarding any security incident that meets established reporting thresholds and provide ongoing updates regarding any such incident until it has been closed out.


text: Engagement of Third-Parties Our GISO partners with third-party cybersecurity service and product vendors to provide protection of our networks, information resources, products, services and data of our customers and employees. Furthermore, our GISO engages third-party cybersecurity and data protection experts to perform assessments on the efficacy of our cybersecurity program and measures, including cybersecurity maturity assessments, audits and independent reviews of our cybersecurity control environment and operating effectiveness. Our Chief Information Security Officer reports the results of such assessments, audits and reviews to our executive team and our Audit Committee.


text: Our Senior Leadership Team's Qualifications Our Chief Information Security Officer has served in various roles in information technology and information security for over 15 years, including as the Director of Information Security at the Colombian operations of a telecommunications company operating throughout Latin America and as the Head of Information Security in the Colombian operations of a large retail company operating in South America. Our Chief Information Security Officer holds undergraduate, graduate and master's degrees in risk management, business administration and information technology, as well as professional certification as a Certified Information Security Manager.


text: Our Chief Information Security Officer reports to our Chief Legal Officer, who has served in that position since December 2017. Our Chief Legal Officer manages our cybersecurity function and legal matters affecting our company and risk management within the company. Our Chief Legal Officer's responsibilities also include overseeing legal support for corporate governance, financial reporting, litigation, mergers and acquisitions and commercial contracts, regulatory and general compliance matters at our company and management of our government affairs function.


text: In addition, our Chief Technology Officer has extensive experience in running and managing cyber risks at large U.S. telecommunication companies and, prior to joining our company, had led the cybersecurity practice at a business unit at a large telecommunications company and established cyber risk identification, detection and protection practices for enterprise and government customers. Our Chief Technology Officer holds undergraduate and master's degrees in electrical engineering and has served in various roles in information technology at several telecommunications companies for over 30 years, including serving as either the Chief Technology Officer, Chief Information Officer or Chief Product Officer of three public companies.


text: We have created an Information Security Team, consisting of our Chief Financial Officer and our Chief Compliance Officer, to implement and administer our Cybersecurity Policy. Ensuring that all Equus personnel are aware of the Cybersecurity Policy and agree to adhere to its requirements; Establishing that information concerning the Fund is stored on encrypted cloud-based servers accessible only by authorized Equus personnel;

companyName: EQUUS TOTAL RETURN, INC.

ticker: EQS


text: Our Board of Directors oversees risks related to cybersecurity, including the security of our corporate, financial, and portfolio investment information and the steps management is taking to monitor and control these risks. Our Chief Compliance Officer conducts regular meetings with our independent directors to discuss various compliance matters, including any cybersecurity issues, and also delivers a comprehensive Annual Compliance Report to the Board, which report also addresses cybersecurity matters.


text: Our operations and other aspects of our business rely heavily on various information technology systems which are largely managed by third parties. We face significant cybersecurity threats, which are continuously increasing in sophistication, including computer viruses, internal and external security breaches, and other cyber-attacks. These threats could disrupt our operations, lead to the loss of confidential information, and hinder our ability to accurately report our financial results in a timely manner. We have adopted a Cybersecurity Policy to create effective administrative, technical, electronic, and physical protections to safeguard the personal information of Company personnel, confidential information concerning our operations and the integrity of the Company's information systems.

companyName: Crucial Innovations, Corp.


text: We have created an Information Security Team to implement and administer our Cybersecurity Policy. Among the duties and responsibility of our Information Security Team are the following: Ensuring that all CINV personnel are aware of the Cybersecurity Policy and agree to adhere to its requirements; Establishing that information concerning the Company is stored on encrypted cloud-based servers accessible only by authorized CINV personnel;


text: Reviewing the security measures in the Company's Cybersecurity Policy annually or when there is a change in applicable laws or regulations or in business activities of Equus; and Conducting training as necessary for all CINV personnel; and Reporting cybersecurity matters to our Board of Directors who provide oversight of our Information Security Team.


text: Our approach to managing cybersecurity risks is part of a continuous improvement process, both in the context of cybersecurity and broader operational risk management.


text: This ongoing process, which includes personnel training, is aimed at routinely reviewing and, as necessary, improving, our oversight processes and tools to ensure they remain effective and resilient in their management of cybersecurity risk.


text: While we have yet to experience a material cybersecurity event, we acknowledge the persistent and evolving nature of these threats, which have the potential to materially impact our business strategy, operations, and financial results adversely. We maintain robust policies and procedures focused on cybersecurity incident management, ensuring timely communication and escalation to all relevant stakeholders. This enables faster response and effective communication, including public disclosure if a material cybersecurity event were to occur.


text: Our Board of Directors oversees risks related to cybersecurity, including the security of our corporate, financial, and operations information and the steps management is taking to monitor and control these risks. In the future, our Information Security Team will conduct regular meetings with our independent directors to discuss various compliance matters, including any cybersecurity issues.


text: We have created an Information Security Team, consisting of our Chief Financial Officer and our Chief Compliance Officer, to implement and administer our Cybersecurity Policy. Our Chief Financial Officer and Chief Compliance Officer have each served in senior management positions for a number of years, have received cybersecurity training from time to time in connection with their professional certifications, and have overseen and supervised the activities of external information technology personnel of the Fund during this period. Among the duties and responsibilities of our Information Security Team are the following: Ensuring that all Equus personnel are aware of the Cybersecurity Policy and agree to adhere to its requirements; Establishing that information concerning the Fund is stored on encrypted cloud-based servers accessible only by authorized Equus personnel;


text: Our operations and other aspects of our bus iness rely heavily on various information technology systems which are largely managed by third parties. We face significant cybersecurity threats, which are continuously increasing in sophistication, including computer viruses, internal and external security breaches, and other cyber-attacks. These threats could disrupt our operations, lead to the loss of confidential information, and hinder our ability to accurately report our financial results in a timely manner. We have adopted a Cybersecurity Policy to create effective administrative, technical, electronic, and physical protections to safeguard the personal information of Company personnel, confidential information concerning our operations and the integrity of the Company's information systems.


text: Management and Strategy is committed to the integrity and security of the sensitive data that it collects, maintains, and transmits across its computer systems.

companyName: ARVANA INC

ticker: AVNI


text: Risk Management and Strategy As an externally advised company, our day-to-day operations are managed by our Adviser and our executive officers under the oversight of our board of directors. We rely on our Adviser's cybersecurity program for assessing, identifying, and managing material risks from cybersecurity threats to us. This cybersecurity program is designed to protect the integrity and availability of our information and technology. This program addresses security governance, security awareness, employee training, relevant access and end-point security, vulnerability management, penetration testing, security monitoring and incident response. Our Adviser's practices align with the National Institute of Standards and Technology (NIST) Cybersecurity Framework.

companyName: BROOKFIELD REAL ESTATE INCOME TRUST INC.


text: Our Adviser's cybersecurity program includes a comprehensive policy framework, reviewed and updated annually; security awareness training for all employees, completed annually; technology risk assessments for critical information systems and applications, performed annually and following all changes to these systems; monthly vulnerability scans; quarterly technology risk assessments and the use of software to protect the confidentiality, integrity and availability of our systems, including the use of anti-malware applications and the use of programs that log, monitor and audit system activities. The effectiveness of our Adviser's cybersecurity programs is evaluated regularly through both internal and third-party audits. We may also engage third parties to conduct risk assessments.


text: Our Adviser's Chief Information Security Officer ("CISO") utilizes a variety of processes and systems to manage cybersecurity risks including third-party risk. This includes operational compliance monitoring processes within our information technology service management program, a security operations center managed by a security services provider; and periodic assessments and tests conducted by external parties or internal audit and compliance functions. We also regularly monitor cybersecurity and data privacy risks of investments in our portfolio. Additionally, our vendor governance framework includes monitoring of vendors' compliance with contractual terms and their cybersecurity risk profile. A risk assessment is conducted for each violation identified, which includes an assessment of the impact from a financial, operational, reputational, regulatory compliance, and client service perspective, to determine its materiality. Regular reporting includes information on material security incidents and policy breaches.


text: No risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected us, our business strategy, results of operations or financial condition. However, we can provide no assurance that we will not experience any material cybersecurity threats or incidents in the future. See "Item 1.A. Risk Factors — Cybersecurity failures and data security incidents could adversely affect our business by causing a disruption to our operations, a compromise or corruption of our confidential, personal or other sensitive information and/or damage to our business relationships or reputation, any of which could negatively impact our business, financial condition and operating results."


text: The audit committee of our board of directors (the "Audit Committee") is responsible for overseeing risk management strategies that are specific to us, including reviewing management's assessment of the current and emerging risks and related mitigation strategies across financial and non-financial risks, including cybersecurity risks. Regular reports and updates on material security incidents and cybersecurity risks are made to senior management and the Audit Committee by the Adviser.


text: The Adviser has a dedicated cybersecurity team, led by the CISO, which manages and monitors our data protection, privacy and cybersecurity program. In addition, our Adviser has established a Security Governance Committee, led by the CISO, that is responsible for, among other things, communicating information security status and needs to all stakeholders; overseeing that appropriate communication channels about cybersecurity risk occur at all levels and to executive management, including our management and the Audit Committee; and overseeing that appropriate action is being taken and monitored where information risks are identified.


text: The CISO and other members of the Security Governance Committee are selected from the Adviser's business groups. The CISO has over 20 years of cybersecurity and technology management experience.


text: Our Adviser's cybersecurity program includes a comprehensive policy framework, reviewed and updated annually; security awareness and data protection training for all employees, completed annually; technology risk assessments for critical information systems and applications, performed annually and following all changes to these systems; monthly vulnerability scans; quarterly technology risk assessments and the use of software to protect the confidentiality, integrity and availability of our systems, including the use of anti-malware applications and the use of programs that log, monitor and audit system activities. The effectiveness of our Adviser's cybersecurity programs is evaluated regularly through both internal and third-party audits. We may also engage third parties to conduct risk assessments.


text: Audits, cybersecurity simulations and employee testing results indicate that the Adviser's program is effective in protecting our information. The policies, standards, and guidance are structured to help us respond effectively to the dynamically changing environment of cybersecurity threats, cybersecurity risks, technologies, laws, and regulations. The Adviser modifies its policies, standards, and guidance as needed to adjust to this changing environment.


text: As a leading cybersecurity provider, we understand the importance of robust cybersecurity practices, and safeguarding and certifying our solutions to internationally recognized commercial and government standards. Trust is the foundation of everything we do, and we earn that trust through a comprehensive approach to identifying, managing and mitigating cybersecurity risk to our business and operations.

companyName: Zscaler, Inc.

ticker: ZS


text: Risk Management and Strategy Our platform was built leveraging guidance from leading industry frameworks to effectively manage and mitigate cybersecurity risks. Our rigorous risk management processes, which include data privacy, product security and information security, are overseen by the audit committee of our board of directors and our internal security committee, and are designed to ensure confidentiality, integrity and availability of our platform. These processes have been integrated into our overall enterprise risk management framework, which is overseen by our board of directors.


text: Our internal security committee identifies and prioritizes protective measures across our enterprise and products, continuously driving improvements to our security approach as threats evolve. The committee members are key functional leaders from across the Company who share critical information and use data-driven strategies to manage cyber risks. The committee is led by our chief security officer and includes representatives from our security team, information technology, information security, incident response, engineering, enterprise risk, product management, cloud operations, legal and compliance teams. Our internal security committee has the primary responsibility for assessing, monitoring and managing our cybersecurity risks, including the prevention, detection, mitigation and remediation of cybersecurity incidents. The personnel comprising our internal security committee are certified and experienced cybersecurity professionals and information security managers with many years of experience across a variety of technology sub-specialties.


text: As a provider of cybersecurity products and services, it is critical for us to identify and implement protective measures across our enterprise and products, continuously driving improvements to our security approach. Our in-house global threat research team, Zscaler ThreatLabZ, a team of more than 150 security experts, collectively works to identify and prevent emerging threats, using malware reverse engineering, behavior analytics, data science and AI. We use the threat intelligence generated by ThreatLabz and other sources to implement security checks and reviews throughout our product development lifecycle. Our internal security teams and external cybersecurity auditors continuously evaluate our products, including by performing regular penetration tests and risk assessments to identify potential vulnerabilities.


text: We regularly review our cybersecurity policies, standards and procedures to account for changes in the threat landscape, as well as in response to legal and regulatory developments. Our cybersecurity efforts also include mandatory training for all employees and contractors on our security and privacy policies.


text: Our cybersecurity risk management approach provides a framework for identifying, monitoring, evaluating and responding to risks from cybersecurity threats and incidents. This framework includes steps for identifying the sources of potential cybersecurity threats or incidents, including potential threats and incidents associated with a third-party vendor or service provider, assessing the severity and risk of potential threats and incidents and implementing cybersecurity countermeasures and mitigation strategies. We recognize that our relationships with third parties may pose significant risks, and therefore we have implemented practices for building vendor diligence, onboarding and monitoring capabilities to assess those risks. These efforts can include internal briefings from our security and technical personnel, as well as external reports and threat intelligence from governmental, public and private sources, including external consultants and reports produced by security tools deployed in our technical environment.


text: Our incident response plan includes processes and procedures for assessing potential internal and external threats, activation and notification, crisis management and post-incident analysis designed to safeguard the confidentiality, availability and integrity of our platform and assets. A cross-functional incident response team, comprised of representatives from our internal security committee including information technology, information security, engineering, cloud operations, compliance, privacy, legal and members of our executive leadership team, is responsible for the monitoring and disposition of potential incidents, such as data breaches, intrusions and other security events, and implementing our detailed incident response plan. Our approach includes procedures to appropriately inform management, the audit committee of the board of directors and the full board of directors, as applicable, about cybersecurity threats and incidents. In fiscal 2024, we did not identify any cybersecurity incidents that materially affected, or are reasonably likely to materially affect, our business, results of operations or financial condition. For more information about these risks, please see "Risk Factors – Risks Related to Our Business" in this Annual Report on Form 10-K.


text: Our board of directors has oversight responsibility for our overall enterprise risk management. The audit committee of the board of directors oversees cybersecurity risk, with input from our internal security committee, based on its oversight of our risk management processes. In accordance with our incident response plan, the internal security committee meets at least monthly, provides cybersecurity updates to the audit committee quarterly and apprises the full board of directors as needed.


text: Our internal security committee identifies and prioritizes protective measures across our enterprise and products, continuously driving improvements to our security approach as threats evolve. The committee members are key functional leaders from across the Company who share critical information and use data-driven strategies to manage cyber risks. The committee is led by our chief security officer and includes representatives from our security team, information technology, information security, incident response, engineering, enterprise risk, product management, cloud operations, legal and compliance teams. Our internal security committee has the primary responsibility for assessing, monitoring and managing our cybersecurity risks, including the prevention, detection, mitigation and remediation of cybersecurity incidents. The technical personnel comprising our internal security committee are experienced cybersecurity professionals and information security managers with many years of experience across a variety of technology sub-specialties.


text: Our incident response plan includes processes and procedures for assessing potential internal and external threats, activation and notification, crisis management and post-incident analysis designed to safeguard the confidentiality, availability and integrity of our platform and assets. A cross-functional incident response team, comprised of representatives from our internal security committee including information technology, information security, engineering, cloud operations, compliance, privacy, legal and members of our executive leadership team, is responsible for the monitoring and disposition of potential incidents, such as data breaches, intrusions and other security events, and implementing our detailed incident response plan. Our approach includes procedures to appropriately inform management, the audit committee of the board of directors and the full board of directors, as applicable, about cybersecurity threats and incidents. In fiscal 2025, we did not identify any cybersecurity incidents that materially affected, or are reasonably likely to materially affect, our business, results of operations or financial condition. For more information about these risks, please see "Risk Factors – Risks Related to Our Business" in this Annual Report on Form 10-K.


text: Denali's approach to cybersecurity seeks to defend the confidentiality, integrity and availability of our systems and information for our people and our patients.

companyName: Denali Therapeutics Inc.

ticker: DNLI


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our Head of IT and Cybersecurity, to manage the risk assessment and mitigation process.


text: As part of our overall risk management system, we conduct annual security awareness training for personnel at all levels and functions, issue periodic simulated social engineering tests, and have established protocols to escalate cybersecurity incidents from identification through remediation. These activities are undertaken in collaboration with human resources, IT, and management.


text: We also engage consultants to assist us in monitoring and testing our safeguards. Performance of our cybersecurity controls for certain systems is periodically reviewed by our internal quality functions. We further require third-party service providers who will be handling our company's sensitive information to certify that they implement appropriate security measures, consistent with all applicable laws, to maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company.


text: Additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, are included in this Annual Report on Form 10-K in Item 1A, "Risk Factors".


text: Our Head of IT is primarily responsible to assess and manage our material risks from cybersecurity threats and has prior work experience in cybersecurity, holds relevant degrees, and current industry recognized cybersecurity certifications.


text: Our Head of IT oversees our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The processes by which our Head of Information Technology is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents includes the following the identification and assessment of assets and assessing potential associated risks, implementation of protective measures, continuous monitoring and detection of unusual or suspicious activities, incident response and recovery management, regular security awareness and training, review and alignment of cybersecurity practices with industry recognized cybersecurity practices, compliance and regulation concerns Our Head of IT provides quarterly briefings to the audit committee regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. Our audit committee provides regular updates to the board of directors on such reports; the Head of IT may be called upon to brief the board as well.


text: Our Head of IT is primarily responsible to assess and manage our material risks from cybersecurity threats and has prior work experience in cybersecurity, holds relevant degrees, and has current industry recognized cybersecurity certifications.


text: Our Head of IT oversees our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The processes by which our Head of IT is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents include the following: the identification and assessment of assets and assessing potential associated risks, implementation of protective measures, continuous monitoring and detection of unusual or suspicious activities, incident response and recovery management, regular security awareness and training, and review and alignment of cybersecurity practices with industry recognized cybersecurity practices, compliance, and regulation concerns.


text: Our Head of IT provides quarterly briefings to the audit committee regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. Our audit committee provides regular updates to the board of directors on such reports; the Head of IT may be called upon to brief the board as well.


text: Through its Manager, the Fund maintains a cybersecurity risk management program designed to identify, assess, manage, and mitigate threats, as well as respond to and recover from cybersecurity incidents. This program is coupled with an enterprise risk management program and covers the Fund's key information systems.

companyName: Venture Lending & Leasing IX, Inc.


text: The cybersecurity risk management program includes a comprehensive risk assessment that is applicable to the Fund's operations. This assessment is based on recognized standards for cybersecurity and information technology as set forth in the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF"). It is reviewed and updated at least annually. Internal controls designed to mitigate risks presented in the assessment are tested annually by an independent third party. Additionally, the Manager, on behalf of the Fund, contracts with a qualified third party to perform annual assessments of the Company's cybersecurity risk management program and to perform cybersecurity risk evaluations of selected key vendors. Another third party is engaged to provide day to day IT services which include implementing, monitoring, and maintaining the preventative and detective measures specified as part of the Fund's cybersecurity risk management program.


text: The Manager's Chief Compliance Officer led the development and oversees the implementation of the cybersecurity program, and is the head of the Manager's cybersecurity team, supported by the Director of Compliance. The Chief Compliance Officer is responsible for assessing and managing the Manager's cyber risk management program, informs senior management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervises such efforts. The cybersecurity team, inclusive of all third parties engaged to provide operations, monitoring, detection, and remediation, has extensive experience selecting, deploying, and operating cybersecurity technologies, initiatives, and processes.


text: The Audit Committee of the Board of Directors oversees the Fund's cybersecurity risk exposures and the steps taken by management to monitor and mitigate identified risks. The Chief Compliance Officer briefs the Audit Committee on the effectiveness of the cyber risk management program at least on a quarterly basis. In addition, cybersecurity risks and cyber incidents, if any, are reviewed by the Fund's Board of Directors at least annually as part of the risk mapping exercise, or as warranted in the event of material incidents.


text: The Fund faces risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows or reputation. See "Risk Factors – Risks Related to Cybersecurity" for further information on how our operations are subject to cyber incidents that could have a material adverse effect on our business, financial condition, results of operations, or cash flows.


text: We consider our information technology ("IT") and information systems to be valuable and vital assets and must be protected as such. We maintain a series of policies and supporting procedures designed to help ensure the security and confidentiality of our IT and information systems and to help ensure that they are properly protected from a variety of threats such as error, fraud, embezzlement, sabotage, terrorism, extortion, industrial espionage, service interruption, and natural disaster. Information is protected according to its sensitivity, value, and criticality with particular focus given to protecting confidential information, such as personal identifying information, unpublished financial results and other data deemed proprietary to us. Our cybersecurity network, including management, employees and service providers, prioritizes protecting and otherwise managing our information assets, and recognizes that information security is an important part of our business.

companyName: BrightSpire Capital, Inc.

ticker: BRSP


text: Our cybersecurity risk management program is a key component of our broader enterprise risk management ("ERM") infrastructure. Cybersecurity and information security, administered by our Head of IT and BrightSpire IT Partner (each, as defined below), is a key component of our broader ERM program, which includes diverse internal management, financial reporting, legal, compliance and risk management controls, policies and procedures primarily under the supervision of senior management. The results of our ERM layers of management control, risk control and compliance oversight and independent assurances in any given quarter are reviewed with senior management, our Audit Committee (independent directors, primarily responsible for oversight of our overall risk profile and risk management policies) and Board of Directors. We have focused on the following cybersecurity initiatives.


text: • Responsible Parties: We engaged a global leader in end-to-end IT solutions (the "BrightSpire IT Partner") to advance and maintain a comprehensive cybersecurity program. Our cybersecurity program is designed with the BrightSpire IT Partner's attention to and integration of certain information security standards issued by the SEC, the National Institute of Standards and Technology, and the International Organization for Standardization. We also have a dedicated senior employee to lead IT ("Head of IT") oversight and functions, together with our Chief Financial Officer, General Counsel (together, the "Information Security Group") and aforementioned BrightSpire IT Partner. Benefits provided by the Head of IT and BrightSpire IT Partner include a significant reduction in critical vulnerabilities, cost effective governance and risk services, current expertise/awareness to model, adaptation to and mitigation of new threats, leverage of internal team resources to focus on business priorities, and effectively meeting and managing evolving regulatory requirements in real time. Other members of management and team leaders assist in incident response efforts as well. • Cybersecurity Risk Management ("CRM") Program: The CRM program includes: (i) implementation of hardware and software infrastructure, primarily cloud based; (ii) "security first" approach to policies, processes and procedures (including general IT and security, information security, business continuity and incident response policies and plans); (iii) employee education, training and periodic testing and patching, including four to six sessions each calendar year (addressing spam, phishing, information security protocols, use of social media); and (iv) assessments of internal resources and diligence of external vendors and systems. Business continuity, disaster recovery and incident response procedures prioritize constant communication and follow a multi-step program including identification, preparation, implementation and resolution. • Cloud Services: We migrated and maintain our company data and communication services to a leading cloud-based service provider, security systems and protected environment. Employees working from home may only connect and conduct business activities through a virtual private network (VPN). • Security First Approach: Our cloud-based systems take a security first approach, including: (i) Perimeter Security (firewalls, antivirus, malware); (ii) Network Security (secure remote access, network patch management); (iii) Application Security (patch management, multi-factor authentication); (iv) Endpoint Security (email security/encryption, web filtering & URL defense, mobile device management); and (v) Data Security.


text: Cybersecurity Systems Review. We regularly review our cybersecurity systems, policies and procedures through a series of channels, including but not limited to our Audit Committee and Board of Directors, the BrightSpire IT Partner, our internal Information Security Group, our independent financial auditor, and outside counsel.


text: • Our Audit Committee and Board of Directors play an active role in reviewing our cybersecurity initiatives. The BrightSpire IT Partner provides our Board an annual review of our cybersecurity governance and risk management program, security metrics relevant to the period in review (including findings on phishing campaigns and vulnerability patchwork initiatives) and provides the Audit Committee and Board updates regarding the cybersecurity threat landscape (for example, the impact of artificial intelligence). In coordination with the Information Security Group, the General Counsel provides reports of material cybersecurity incidents and cybersecurity threats (if any) at each quarterly meeting of the Audit Committee and Board. • The BrightSpire IT Partner has established itself as a provider of managed services and technology solutions for over two decades, providing 24/7 oversight and services, including continuous testing and vulnerability scanning. The BrightSpire IT Partner also performs annual due diligence of key vendors on a rotating basis (including System and Organization Controls (SOC) report reviews, or alternatively solicit detailed questionnaires to evaluate such vendors cybersecurity preparedness and protections). • Our Head of IT has over two decades of experience in IT and cybersecurity work and developed and implemented our cybersecurity program with the BrightSpire IT Partner. Together with our Head of IT, the Information Security Group considers current cybersecurity trends and threats, including through discussions with the BrightSpire IT Partner, outside cybersecurity counsel, our independent financial auditor and internal auditor. The Information Security Group undertakes table-top business disruption, disaster recovery and related response strategies and plans on a periodic basis and seeks to review and update applicable policies and procedures at least annually.


text: No Material Incidents. Since inception in January 2018, we have not experienced any material cybersecurity or information security incidents. We have not incurred any expenses due to material information security incident penalties or settlements.


text: Cyber Liability Insurance. Through consultant driven data, analytics and peer benchmarking, we secured and maintain specific coverage to mitigate losses associated with cyber-attacks and other information security incidents, addressing both first-party and third-party losses from incident response, cyber extortion, data loss, business interruption, contingent business interruption, regulatory penalties, media liability, social engineering coverage, system failures and bricking/hardware replacement.


text: Our cybersecurity risk management program is a key component of our broader enterprise risk management ("ERM") infrastructure. Cybersecurity and information security, administered by our Head of IT and BrightSpire IT Partner (each, as defined below), is a key component of our broader ERM program, which includes diverse internal management, financial reporting, legal, compliance and risk management controls, policies and procedures primarily under the supervision of senior management. The results of our ERM layers of management control, risk control and compliance oversight and independent assurances are reviewed with senior management, our Audit Committee (independent directors, primarily responsible for oversight of our overall risk profile and risk management policies) and Board of Directors quarterly. We have focused on the following cybersecurity initiatives.


text: • Responsible Parties: We engaged a global leader in end-to-end IT solutions (the "BrightSpire IT Partner") to advance and maintain a comprehensive cybersecurity program. Our cybersecurity program is designed to leverage certain information security standards, such as those issued by the National Institute of Standards and Technology, and the International Organization for Standardization. We also have a dedicated senior employee to lead IT ("Head of IT") oversight and functions, together with our Chief Financial Officer, General Counsel (together, the "Information Security Group") and aforementioned BrightSpire IT Partner. Benefits provided by the Head of IT and BrightSpire IT Partner include a significant reduction in critical vulnerabilities, cost effective governance and risk services, current expertise/awareness to model, adapt and mitigate new threats, leverage of internal team resources to focus on business priorities, and addressing evolving regulatory requirements. Our response plans require prompt notification to the Information Security Group in the event of a significant cybersecurity incident and prompt briefings on further developments as appropriate. Other members of management and team leaders assist in incident response efforts as well. • Cybersecurity Risk Management ("CRM") Program: The CRM program includes: (i) implementation of hardware and software infrastructure, primarily cloud based; (ii) "security first" approach to policies, processes and procedures (including general IT and security, information security, business continuity and incident response policies and plans); (iii) employee education, training and periodic testing and patching; and (iv) assessments of internal resources and diligence of external vendors and systems. Business continuity, disaster recovery and incident response procedures prioritize constant communication and follow a multi-step program including identification, preparation, implementation and resolution. • Cloud Services: We maintain our company data and communication services with a leading cloud-based service provider, security systems and protected environment. Employees working from home may only connect and conduct business activities through a virtual private network (VPN). • Security First Approach: Our cloud-based systems take a security first approach, including: (i) Perimeter Security (firewalls, antivirus, malware); (ii) Network Security (secure remote access, network patch management); (iii) Application Security (patch management, multi-factor authentication); (iv) Endpoint Security (email security/encryption, web filtering & URL defense, mobile device management); and (v) Data Security.


text: Cybersecurity Systems Review. We regularly review our cybersecurity systems, policies and procedures through a series of channels, including but not limited to our Audit Committee and Board of Directors, the BrightSpire IT Partner, our internal Information Security Group, our internal financial auditor and outside counsel.


text: • Our Audit Committee and Board of Directors play an active role in reviewing our cybersecurity initiatives. The BrightSpire IT Partner provides our Board an annual review of our cybersecurity governance and risk management program, security metrics relevant to the period in review and provides the Audit Committee and Board updates regarding the cybersecurity threat landscape. In coordination with the Information Security Group, the General Counsel provides reports of significant cybersecurity incidents and cybersecurity threats (if any) at each quarterly meeting of the Audit Committee and Board or ad hoc as appropriate. • The BrightSpire IT Partner has established itself as a provider of managed services and technology solutions for over two decades, providing 24/7 oversight and services, including continuous testing and vulnerability scanning. The BrightSpire IT Partner also performs annual due diligence of key vendors on a rotating basis (including System and Organization Controls (SOC) report reviews, or alternatively solicits detailed questionnaires to evaluate such vendors cybersecurity preparedness and protections). • Our Head of IT has over two decades of experience in IT and cybersecurity work and developed and implemented our cybersecurity program with the BrightSpire IT Partner. Together with our Head of IT, the Information Security Group considers current cybersecurity trends and threats, including through discussions with the BrightSpire IT Partner, outside cybersecurity counsel, our independent financial auditor and internal auditor. The Information Security Group undertakes table-top business disruption, disaster recovery and related response strategies and plans on a periodic basis and seeks to review and update applicable policies and procedures at least annually.


text: No Material Incidents. As of December 31, 2024, we have not experienced any material risks from cybersecurity threats, including as a result of any previous cybersecurity incidents or threats, that have materially affected the business strategy, results of operations or financial condition of the Company or are reasonably likely to have such a material effect. Since inception in January 2018, we are not aware of any cybersecurity or information security incidents that have materially affected us to date. We have not incurred any expenses due to material information security incident penalties or settlements. However, evolving cybersecurity threats make it increasingly challenging to anticipate, detect, and defend against cybersecurity threats and incidents. Refer to the risk factor "We are highly dependent on information systems and third-parties, and system failures or cybersecurity incidents incurred by us or the third-parties that we rely on could significantly disrupt our ability to operate our business." in the section entitled "Risk Factors—Risks Related to Our Company and Our Structure" for more information regarding our cybersecurity risks.


text: Cyber Liability Insurance. Through consultant driven data, analytics and peer benchmarking, we secured and maintain specific coverage to mitigate certain losses associated with cyber-attacks and other information security incidents, addressing both first-party and third-party losses from incident response, including for example, cyber extortion, data loss, business interruption, contingent business interruption, regulatory penalties, media liability, social engineering coverage, system failures and bricking/hardware replacement.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program and shares common methodologies, reporting channels, and governance processes that apply across the enterprise risk management program, including legal, compliance, strategic, operational, and financial risk areas.

companyName: HYCROFT MINING HOLDING CORP

ticker: HYMC


text: The cybersecurity risk management program includes: • Risk assessments designed to help identify material cybersecurity risks to our critical systems, information, and broader enterprise IT environment; • A team principally responsible for managing (i) cybersecurity risk assessment processes, (ii) security controls, and (iii) response to cybersecurity incidents; • The use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of security controls; • Cybersecurity awareness training for users and senior management, including through the use of third-party providers for regular mandatory training; • A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and, • A risk management process for third-party service providers, suppliers and vendors, including a rigorous vetting process and ongoing monitoring mechanisms designed to ensure compliance with cybersecurity standards.


text: As of the date of this Annual Report on Form 10-K, the Company is not aware of any cybersecurity incidents, that have had a materially adverse effect on our operations, business, results of operations, or financial condition.


text: Our Board of Directors considers cybersecurity risk as part of its risk oversight function. It has delegated oversight of cybersecurity and other information technology risks to the Audit Committee (the "Committee"). The Committee oversees the implementation of the cybersecurity risk management program.


text: The Committee receives periodic reports from management on potential cybersecurity risks and threats and receives presentations on cybersecurity topics from Hycroft's Information Systems Manager. The Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity. The full Board of Directors also receives briefings from management on the cybersecurity risk management program as needed.


text: Management is responsible for assessing and managing our material risks from cybersecurity threats. Management has primary responsibility for our overall cybersecurity risk management program and supervises both the internal cybersecurity personnel and external cybersecurity consultants. Hycroft's Information Systems Manager has many years of experience leading cybersecurity oversight and has extensive experience with information technology, including security, auditing, compliance, systems, and programming.


text: The cybersecurity risk management program includes: • Risk assessments designed to help identify material cybersecurity risks to our critical systems, information, and broader enterprise IT environment; • A team principally responsible for managing (i) cybersecurity risk assessment processes, (ii) security controls, and (iii) response to cybersecurity incidents; • The use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of security controls; • Cybersecurity awareness training for users and senior management, including through the use of third-party providers for regular mandatory training; • A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • A risk management process for third-party service providers, suppliers and vendors, including a rigorous vetting process and ongoing monitoring mechanisms designed to ensure compliance with cybersecurity standards.


text: As of the date of this 2024 Form 10-K, the Company is not aware of any cybersecurity incidents, that have had a materially adverse effect on our operations, business, results of operations, or financial condition.


text: The Audit Committee receives periodic reports from management on potential cybersecurity risks and threats and receives presentations on cybersecurity topics from Hycroft's Information Systems Manager. The Audit Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity. The full Board of Directors also receives briefings from management on the cybersecurity risk management program as needed.