text: Risk Management and Strategy We regularly assess risks from cybersecurity threats, monitor our information systems for potential vulnerabilities, and test those systems pursuant to our information and cybersecurity policies, processes, and practices. We maintain a Cybersecurity Incident Response Plan that establishes an incident response team led by our Head of Information Technology and describes our response protocol for cybersecurity incidents. To help protect our information systems from cybersecurity threats, we use various security tools that are designed to help identify, escalate, investigate, resolve, and recover from security incidents in a timely manner. Assessment of cybersecurity threats is included as part of our overall risk management processes.

companyName: IO Biotech, Inc.

ticker: IOBT


text: We have engaged consultants and other third parties to assist in our assessment of risks from cybersecurity threats and to evaluate our cybersecurity prevention and response systems and processes. At times, we may engage third parties to assist in the management and mitigation of a particular threat.

secItem: Item 1C


text: We are requiring each of our significant third-party service providers to agree that it will implement and maintain appropriate security measures that are consistent with applicable law, implement and maintain reasonable security measures in connection with their work with us, and promptly report any suspected breach of its security measures that may affect our company.


text: Our board of directors, as a whole and through the Audit Committee, is responsible for the oversight of risk management, including oversight of risks from cybersecurity threats, and discusses with management our major risk exposures, including from cybersecurity threats, their potential impact on us, and the steps we take to manage them.


text: Our Head of Information Technology, reporting to our Chief Financial Officer, has day-to-day responsibility for preventing, detecting, mitigating and remediating cybersecurity risks. The individual currently serving in this role has over twenty years of experience in information technology and cybersecurity. Our Head of Information Technology leads an incident response team that includes members of executive management, including members of our legal team, and is charged with assessing and managing material cybersecurity risks, and with notifying our executive management committee and disclosure committee of potential material cybersecurity incidents. Executive management provides updates on our cybersecurity risk profile to our Audit Committee on at least a quarterly basis.


text: Cybersecurity Threats As of the date of this report, we have not identified cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected us, including our business strategy, results of operations or financial condition. We and our third-party service providers have, however, been the target of cybersecurity threats and we expect these threats to continue. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K.


text: Cybersecurity Program Overview As part of our overall risk management processes and procedures, we have instituted a cybersecurity program designed to identify, assess and manage material risks from cybersecurity threats, including by engaging a third-party cybersecurity service provider, which communicates directly with our management and compliance personnel. The cyber risk management program involves risk assessments, implementation of security measures and ongoing monitoring of systems and networks, including networks on which we rely. Through our cybersecurity program, the current threat landscape is actively monitored in an effort to identify material risks arising from new and evolving cybersecurity threats. We may engage external experts, including cybersecurity assessors, consultants and auditors to evaluate cybersecurity measures and risk management processes as needed. We also depend on and engage various third parties, including suppliers, vendors and service providers in connection with our operations. Our risk management, legal, and compliance personnel oversee and identify, including through a third-party cybersecurity service provider, material risks from cybersecurity threats associated with our use of such entities.

companyName: Trinity Capital Inc.

ticker: TRIN


text: Board Oversight of Cybersecurity Risks Our Board provides strategic oversight on cybersecurity matters, including material risks associated with cybersecurity threats. Our Board receives periodic updates from our Chief Compliance Officer and Chief Operating Officer, and more frequently as needed, regarding the overall state of our cybersecurity program, information on the current threat landscape, and material risks from cybersecurity threats and cybersecurity incidents.


text: Management's Role in Cybersecurity Risk Management Our management team, including our Chief Compliance Officer and Chief Operating Officer, is responsible for assessing and managing material risks from cybersecurity threats, including by engaging third-party service providers, as described above. Members of our management team possess relevant expertise in various disciplines that are key to effectively managing such risks, such as technology systems, technology leadership, technological development, cybersecurity, regulatory compliance and corporate governance. Our management team is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents, including through the receipt of notifications from third-party service providers and reliance on communications with our risk management, legal, and/or compliance personnel.


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats are assessed on an ongoing basis, and how such risks could materially affect our business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, we have not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that we believe have materially affected, or are reasonably likely to materially affect, us, including our business strategy, operational results, and financial condition.


text: We and our third-party service providers, such as CROs, collect, process, transmit, and store sensitive data on our networks and systems, including intellectual property, proprietary or confidential business information, and a variety of personal data.

companyName: iTeos Therapeutics, Inc.


text: We have adopted processes designed to identify, assess and manage material risks from cybersecurity threats. Those processes include response to and an assessment of internal and external threats to the security, confidentiality, integrity and availability of our data and information systems, along with other material risks to our operations.


text: Our risk management team collaborates with our Chief Information Security Officer, or CISO and our Head of Legal to evaluate and address cybersecurity risks in alignment with our business objectives and operational needs. We have processes to detect potential vulnerabilities and anomalies through technical safeguards and have adopted policies and procedures around internal and external notification of cybersecurity incidents.


text: Our CISO and Cybersecurity Manager implement processes around security monitoring and vulnerability testing. We also have in place an incident response plan, which incorporates four overarching and interconnected stages: (1) preparation for a cybersecurity incident, (2) detection and analysis of a security incident, (3) containment, eradication and recovery, and (4) post-incident analysis. The plan specifies that security events and data incidents should be evaluated, ranked by severity and prioritized for response and remediation. Our procedures include an evaluation of incidents to determine materiality as well as operational, business and privacy impact. Our team of cybersecurity and information security professionals then collaborate with technical and business stakeholders across our business units to further analyze the risk to the Company, and form detection, mitigation and remediation strategies.


text: As part of our risk management process, we engage external auditors and consultants to assess our internal cybersecurity programs and compliance with applicable practices and standards. In addition, we engage outside providers to conduct annual internal and external penetration testing.


text: We rely on third parties, including cloud vendors, for various business functions. We select key third-party service providers based on several factors, including the type of data processed and the nature of services offered, and we oversee such key third-party service providers by conducting vendor diligence upon onboarding and ongoing monitoring. Governance.


text: Our board of directors has established oversight mechanisms to manage risks from cybersecurity threats. The audit committee of our board of directors, or audit committee, has primary responsibility for oversight of cybersecurity and is briefed on cybersecurity risks at least once a year and following any material cybersecurity incidents. Our board of directors receives periodic updates from our audit committee regarding matters of cybersecurity. Our board members also engage in ad hoc conversations with management on cybersecurity-related news events and discuss any significant updates to our cybersecurity risk management and initiatives.


text: Our cybersecurity program is overseen by our Chief Information Officer, or CIO, and is managed by our CISO and other leaders from our information technology, or IT, and legal departments. Our CIO, CISO and Cybersecurity Manager have an average of over 20 years of prior work experience in various roles involving IT, including security, auditing, compliance, systems and programming. These individuals are informed about, and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan, and report to senior management and the Audit Committee on any appropriate items.


text: Our senior management reports at least annually to the audit committee and such reporting includes an overall assessment of the Company's compliance with our cybersecurity policies and procedures as well as topics including existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any) and status on key information security initiatives.


text: A cybersecurity incident may materially affect our business, results of operations or financial condition, including where such an incident results in reputational, competitive, or business harm, loss of intellectual property rights, significant costs, or the Company being subject to government investigations, litigation, fines, or damages. As of the date of this Annual Report on Form 10-K, we have not experienced a cybersecurity incident that resulted in a material effect on our business strategy, results of operations, or financial condition. For more information, see "Risk factors - Risks related to our business operations, employee matters, taxes, litigation, and managing growth - Information system failures or unauthorized or inappropriate use of or access to our information systems risk disclosure of confidential or proprietary information, including personal data, and could damage our reputation, and subject us to significant financial and legal exposure."


text: Risk Management and Strategy We recognize the importance of safeguarding the security of our computer systems, software, networks, and other technology assets. We have implemented processes for identifying, assessing, and mitigating cybersecurity risks and we have implemented a cybersecurity risk management program that is informed by recognized industry standards and frameworks and incorporates elements of the same, including elements of the National Institute of Standards and Technology (NIST) Cybersecurity Framework.

companyName: TScan Therapeutics, Inc.

ticker: TCRX


text: Our cybersecurity risk management program incorporates a number of components, including, but not limited to, information security policies and operating procedures, periodic information security risk assessments and other vulnerability analyses, and ongoing monitoring of critical risks from cybersecurity threats using automated tools. Additionally, we have implemented a process to conduct cybersecurity awareness training for employees during onboarding and thereafter.


text: We maintain a Cybersecurity Incident Response Plan, or CIRP, which is designed to guide our response to cyber incidents, including to mitigate and contain any potential cybersecurity incidents that could affect our systems, network, or data. The CIRP identifies the individuals responsible for developing, maintaining, and following procedures related to cybersecurity incident response, including escalation protocols. We also engage external third-party consultants to provide services, such as penetration testing, which is conducted on an annual basis, and periodic vulnerability assessments. These consultants also perform annual assessments of our cybersecurity program, which involve, among other things, review of our IT security measures and processes for alignment with the NIST Cybersecurity Framework and provision of threat intelligence regarding emerging risks to our information systems.


text: As part of our cybersecurity risk management program, we maintain processes around third-party vendor risk management, including a framework for managing third-party information security risks. This framework, which applies to select third parties who have access to our systems and/or process our information, includes processes for assessing and reviewing the cybersecurity practices of such third-parties, including a review of available security audit reporting and certifications and inclusion of security requirements in contracts, as appropriate.


text: We have not been materially affected by cybersecurity threats. We may, from time to time, experience threats to and security incidents related to our data systems but we do not believe they are reasonably likely to materially affect our business strategy, results of operations or financial condition. For more information, please see the risk factors entitled "Our internal computer systems, or those used by our third-party CROs or other contractors or consultants, may fail or suffer security breaches or other unauthorized or improper access, which could result in a material disruption of the development programs of our product candidates" and "Security incidents, loss of data or modification of information, and other disruptions could compromise information related to our business or prevent us from accessing critical information, result in a significant disruption of our activities and expose us to liability, which could adversely affect our business and our reputation" in Item 1A- Risk Factors in this Annual Report.


text: Our Head of Information Technology and Security, or Head of IT, has primary responsibility for day-to-day management of our cybersecurity risk management program, including leading a dedicated team of information technology professionals to monitor cybersecurity risks on behalf of TScan. Our Head of IT has over 15 years' experience with information technology and cybersecurity risk management programs.


text: This team is responsible for assessing potential vulnerabilities and exposures to cybersecurity threats, implementing controls and measures designed to mitigate these risks, and regularly monitoring and updating these policies, to adapt to evolving threats. If an incident arises, the Head of IT notifies our Chief Legal and Compliance Officer, and Chief Financial Officer, who will raise issues to those charged with governance, as appropriate.


text: Our audit committee, a subcommittee of our board of directors, has been delegated responsibility for oversight of cybersecurity risk management, which includes reviewing our cybersecurity and other information, technology risks, controls and procedures, including our plans to mitigate and respond to cybersecurity risks. The Head of IT, alongside the Chief Legal and Compliance Officer, and Chief Financial Officer, provide quarterly reports to the audit committee covering cybersecurity and other information technology risks affecting us. These reports may include reviewing our current infrastructure and the status of key cybersecurity initiatives, including the status of ongoing mitigation efforts, providing insights into the latest cybersecurity threats, and discussing any recent security incidents impacting our peer companies. Periodically, or in the event of a critical cybersecurity incident, the Chief Legal and Compliance Officer, and Chief Financial Officer will provide our full board of directors with findings and recommendations from these reports.


text: We recognize the importance of maintaining the trust and confidence of the patients we serve, our business partners, employees and our shareholders and are committed to protecting the confidentiality, integrity and reliance of our business operations and systems. Effective data protection practices, including responsible stewardship of our intellectual property and the secure processing, storage, maintenance and transmission of critical information by us and other third parties with whom we do business is vital to our operations.

companyName: Wave Life Sciences Ltd.

ticker: WVE


text: Our cybersecurity practices, policies, and standards are based on recognized frameworks established by the National Institute of Standards and Technology ("NIST") (NIST SP 800-53), the Center for Internet Security ("CIS"), along with adopting best practices from Control Objectives for Information and Related Technologies ("COBIT") and other applicable industry standards. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents if they occur.


text: Cybersecurity Risk Management and Strategy We may face risks related to cybersecurity, such as unauthorized access, cybersecurity attacks and other security incidents, which could adversely affect our business and operations. To identify and assess material risks from cybersecurity threats, we maintain a robust cybersecurity program to ensure our systems are effective and prepared for information security risks and have integrated these processes into our overall risk management systems and processes. We also identify our cybersecurity threat risks by comparing our processes to standards set by NIST, CIS, and COBIT, as well as by engaging experts to attempt to infiltrate our information systems. We consider risks from cybersecurity threats alongside other company risks as part of our overall risk assessment process. We employ a range of tools, services and capabilities, including regular network and endpoint monitoring, audits, vulnerability assessments, penetration testing, threat modeling, disaster recovery and business continuity planning activities, red team testing, mandatory training for our employees, and tabletop exercises to inform our risk identification and assessment.


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including our vendors, CROs, suppliers and/or manufacturers who may have access to patient and employee data or our systems. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and continually monitor cybersecurity threat risks identified through such diligence. Additionally, we generally require those third parties that could introduce significant cybersecurity risk to us to agree by contract to manage their cybersecurity risks in specified ways, and to agree to be subject to cybersecurity audits, which we conduct continuously through third-party risk management tools.


text: As part of the above processes, we regularly engage with consultants and other third parties, including a bi-annual review of our cybersecurity program by an independent Qualified Security Assessor.


text: In the last three fiscal years, we have not experienced any material cybersecurity incidents and the expenses we have incurred from cybersecurity incidents were immaterial. We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Security breaches, cybersecurity threats, loss of data and other disruptions could compromise sensitive information related to our business, prevent us from accessing critical information or expose us to liability, which could adversely affect our business and our reputation," in Item 1A. Risk Factors, which disclosures are incorporated by reference herein.


text: Cybersecurity Governance Our Board of Directors (our "Board") is actively involved in oversight of our risk management activities, and cybersecurity represents an important element of our overall approach to risk management. Our Board delegates to the Audit Committee oversight of certain aspects of our risk management process, including risks related to information technology, data privacy and cybersecurity.


text: At least quarterly, our Audit Committee receives an update from management of our cybersecurity threat risk management and strategy processes, including recent cybersecurity incidents and related responses, cybersecurity testing, activities of third parties, and other similar matters. Our cybersecurity risk management and strategy processes are led by our Data Security Officer, Data Privacy Officer, Chief Financial Officer and General Counsel. Such individuals have collectively over 50 years of prior work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs, as well as several relevant degrees and certifications.


text: Our Audit Committee is encouraged to regularly engage in conversations with management on cybersecurity-related news and events and discuss any updates to our cybersecurity risk management and strategy programs. Management is informed about and monitors the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. We have processes in place to ensure that our Audit Committee shall receive prompt and timely information regarding any cybersecurity incident that meets establishing reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.


text: Our Board of Directors (the "Board") recognizes the critical importance of maintaining the trust and confidence of our guests, business partners, associates and other stakeholders, and the processes implemented to address the risks related to cybersecurity threats are an important part of our overall risk management efforts. More specifically, we seek to address cybersecurity risks by focusing on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. Our cybersecurity program focuses on the following key areas: • Governance/Board-Level Oversight: Our Audit Committee is briefed on cybersecurity risks as a standing agenda item at each regularly-scheduled quarterly meeting. The Chief Information Officer ("CIO") reports quarterly to the Audit Committee and such report typically addresses an overall assessment of our compliance with our cybersecurity policies and includes topics such as risk management and control decisions, updates on our cybersecurity roadmap and self-assessment, training results, security threats, incidents (if any) and responses, and recommendations for changes and updates to our policies and procedures. • Technical Safeguards: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, 24x7 monitoring by a third party security operations center, and antimalware functionality and access controls, which are periodically evaluated through vulnerability assessments and cybersecurity threat intelligence. • Business Continuity and Disaster Recovery: We have established and maintain comprehensive business continuity, incident response and recovery plans that address our response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis. • Third-Party Risk Management: We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Education and Awareness: We provide regular, mandatory training for our associates regarding cybersecurity threats as a means to equip our personnel with effective tools to address cybersecurity threats, and to communicate our information security policies, standards, processes and practices.

companyName: European Wax Center, Inc.

ticker: EWCZ


text: We engage in the periodic assessment and testing of our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We regularly engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are shared with executive management and, as needed, the Audit Committee and the Board. We adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: Operational responsibility for assessing and implementing our processes and procedures related to cybersecurity risk is led by our CIO. The CIO leads a team of internal full-time associates and external consultants and vendors that manage all aspects of our risk management tools. The CIO reports directly to the Chief Administrative Officer and General Counsel ("CAO"), who manages legal and insurance coverage matters related to cybersecurity risks. Additionally, our Chief Financial Officer and relevant associates on her staff are involved in the management of cybersecurity threats in relation to our internal controls environment, and, in the event of an incident, relevant investor relations needs. Our policies and procedures provide that the Chief Executive Officer, the Audit Committee, and the Board are to be informed in a prompt, timely manner in the event of any material cybersecurity event.


text: Our CIO has Bachelor of Science degrees in Information Technology and Business Administration and Science and has served in various roles in information technology for over 30 years, including nearly 20 years in roles directly related to implementing and managing cybersecurity measures.


text: For additional information on cybersecurity risks, see the section titled "Risk Factors" included elsewhere in this Annual Report on Form 10-K.


text: Risk management and strategy The Company's Information Security strategy prioritizes detection, analysis and response to known, anticipated or unexpected threats; effective management of security risks; and resiliency against incidents. The Company's cybersecurity risk management processes include technical security controls, policy enforcement mechanisms, monitoring systems, employee training, contractual arrangements, tools and related services from third-party providers, and management oversight to assess, identify and manage material risks from cybersecurity threats. The Company implements risk-based controls to protect the Company's information, information systems, business operations, products and related services, and the information of the Company's customers. The Company has adopted security-control principles based on the Federal Financial Institutions Examination Council (FFIEC) Cyber Security Assessment Tool (CAT), and other industry-recognized standards, and contractual requirements, as applicable. The Company also leverages industry associations, third-party benchmarking, the results from regular internal and third-party audits, threat intelligence feeds, and other similar resources to inform the Company's cybersecurity processes and allocate resources.

companyName: FIRST MID BANCSHARES, INC.

ticker: FMBH


text: The Company maintains security programs that include physical, administrative and technical safeguards, and the Company maintains plans and procedures whose objective is to help the Company prevent and timely and effectively respond to cybersecurity threats or incidents. Through the Company's cybersecurity risk management process, the Company continuously monitors cybersecurity vulnerabilities and potential attack vectors to Company systems, and the Company evaluates the potential operational and financial effects of any threat and of cybersecurity countermeasures made to defend against such threats. The Company continues to integrate the Company's cyber practice within the Company's Risk Oversight Committee, and Enterprise Risk Management program, both of which are overseen by the Company's Board of Directors and provide frameworks for identifying and tracking cyber-related business and compliance risks across the Organization. The Company periodically engages third-party consultants to assist us in assessing, enhancing, implementing, and monitoring the Company's cybersecurity risk management programs and responding to any incidents.


text: As part of the Company's cybersecurity risk management process, the Company conducts an annual "tabletop" exercise during which the Company simulates cybersecurity incidents to ensure that the Company is prepared to respond to such an incident and to highlight any areas for potential improvement in the Company's cyber incident preparedness. This exercise is conducted at both the technical level and senior management level. In addition, all employees are required to pass mandatory cybersecurity training courses on an annual basis and receive bi-weekly phishing simulations to provide "experiential learning" on how to recognize phishing attempts.


text: The Company has established a cybersecurity vendor risk management program, which is a cross-functional program that forms part of the Company's Enterprise Risk Management program and is supported by the Company's security, compliance, and third-party partners. Through this evolving program, the Company assesses the risks from cybersecurity threats that impact the Company's third-party service providers with whom the Company shares personal identifying and confidential information. The Company continues to evolve the oversight processes to mature how the Company identifies and manages cybersecurity risks associated with the products or services the Company procures from third parties.


text: The Company has experienced, and may in the future experience, whether directly or through the Company's third-party partners, cybersecurity incidents. While prior incidents have not materially affected the Company's business strategy, results of operations or financial condition, and although the Company's processes are designed to help prevent, detect, respond to, and mitigate the impact of such incidents, there is no guarantee that a future cyber incident would not materially affect the Company's business strategy, results of operations or financial condition.


text: The Company's Board of Directors has overall responsibility for risk oversight, with its committees assisting the Board in performing this function. The Company's Board of Directors has delegated oversight of risks related to cybersecurity to two Board committees, the Risk Oversight Committee and Audit Committee, and each committee reports on its activities and findings to the Board on a quarterly cadence. The Audit Committee is charged with reviewing the Company's cybersecurity processes for assessing key strategic, operational, and compliance risks. The Company's Information Security Officer provides presentations to the Risk Oversight Committee and the Board, on cybersecurity risks quarterly. These briefings may include assessments of cyber risks, the threat landscape, updates on incidents, and reports on the Company's investments in cybersecurity risk mitigation and governance. In the event of a potentially material cybersecurity event, the Incident Response Team (IRT) is notified and briefed, and meetings with that team and/or Executive Committee members are held, with the Board of Directors being briefed, as appropriate.


text: The Company's Information Security Officer (ISO), James Hinks, leads our cybersecurity program and oversees the Company's Security Operations Team (SOC), supporting our security functions of identifying, preventing, detecting, responding, and recovering. The SOC team comprises personnel with extensive experience in information technology across the private and public sectors. Mr. Hinks holds multiple security accreditations and 24 years of experience in cybersecurity, software development, systems, networking, and other technology-related roles within public and private industries, with 14 years in IT leadership roles. Mr. Hinks has been employed with the Company since 2019, overseeing information security, disaster recovery, vendor management, and physical security.


text: Cybersecurity Risk Management and Strategy As an externally managed closed-end management investment company that has elected to be regulated as a BDC under the 1940 Act, our day-to-day operations are managed by the Adviser, Administrator and our executive officers under the oversight of our Board of Trustees. Our executive officers are senior professionals of the Adviser and Onex Corp. and each of the Adviser and Administrator is a subsidiary of Onex Corp. As such, we are reliant on Onex Corp. for assessing, identifying and managing material risks to our business from cybersecurity threats. Below are details Onex Corp. has provided to us regarding its cybersecurity program that are relevant to us.

companyName: Onex Direct Lending BDC Fund


text: Onex Corp. has established a dedicated cybersecurity team which maintains a comprehensive firmwide cybersecurity program to protect its systems, operations and the information stored within. Onex Corp.'s Audit, Nominating and Corporate Governance Committee receives at minimum, quarterly cybersecurity updates from the Managing Director – Enterprise Technology, who leads Onex Corp.'s program and who works closely with senior management to develop and advance Onex's cybersecurity strategy.


text: As part of Onex Corp.'s ongoing cybersecurity operations, the cybersecurity team regularly conducts testing to identify vulnerabilities that could be exploited by attackers often using various automated tools as well as a managed service provider. The team examines and validates the cybersecurity program and cyber risk posture annually with third parties, measuring it against industry standards and established frameworks, such as the National Institute of Standards and Technology ("NIST"), Center for Internet Security and the International Organization for Standardization (ISO). Onex maintains a comprehensive Security Incident Response Policy, an Incident Response Plan, and Incident Response Playbooks to ensure that any non-routine events are properly investigated and escalated where necessary. On an annual basis, these plans, policies and processes are validated and practiced with senior executives and representatives from key areas of the firm through a cyber-incident tabletop simulation exercise. Onex Corp. engages with a Managed Security Services Provider (the "MSSP") who conducts vulnerability scanning and cyber threat intelligence on a weekly basis at minimum. Additionally, third-party cybersecurity consultants are engaged to perform penetration testing on a bi-annual basis. The findings are reviewed, prioritized and remediated in alignment with the recommendations from the external consultant. In addition to Onex Corp.'s cybersecurity team's internal exercises to test aspects of its cybersecurity program, Onex Corp. periodically engages independent third parties to assess the risks associated with its information technology resources and information assets. Among other matters, these third parties analyze data on the interactions of users of enterprise information technology resources, including employees, and conduct penetration tests and scanning exercises to assess the performance of the cybersecurity systems and processes.


text: Onex Corp. maintains a formal cybersecurity risk management process and cybersecurity risk register, designed to track cybersecurity risks at the firm, and integrates these processes into the firm's overall risk management practices described above. Onex Corp.'s cybersecurity management team periodically discusses and reviews cybersecurity risks and related mitigants at its Cybersecurity Excellence Quarterly Forum.


text: Onex Corp. employs a process designed to assess, typically prior to onboarding, the cybersecurity risks associated with the engagement of third-party vendors, including those of its externally managed companies such as us. This assessment is conducted on the basis of, among other factors, the types of services provided and the extent and type of data accessed or processed by a third-party vendor. On the basis of its preliminary risk assessment of a third-party vendor, Onex Corp. may conduct further cybersecurity reviews or request remediation of, or contractual protections related to, any actual or potential identified cybersecurity risks. In addition, where appropriate, Onex Corp. seeks to include in its contractual arrangements with certain of its third-party vendors provisions addressing best practices with respect to data and cybersecurity, as well as the right to assess, monitor, audit and test such vendors' cybersecurity programs and practices. Onex Corp. also utilizes a number of digital controls, which are reviewed at least annually, to monitor and manage third-party access to its internal systems and data.


text: For a discussion of how risks from cybersecurity threats affect our business, and our reliance on Onex Corp. and its affiliates in managing these risks, see "Item 1A. Risk Factors— Risks Related to Our Business and Structure—We may face a breach of our cyber security, which could result in adverse consequences to our operations and exposure of confidential information" for a discussion of risks from cybersecurity threats." in this Annual Report on Form 10-K.


text: Cybersecurity Governance Onex Corp. has a dedicated cybersecurity team, led by the Managing Director – Enterprise Technology Services, who works closely with senior management, including Onex Corp.'s Chief Financial Officer, to develop and advance the firm's cybersecurity strategy, which applies to us.


text: The Managing Director – Enterprise Technology and Manager, Cybersecurity have extensive experience in technology and cybersecurity, respectively. The cybersecurity team of Onex Corp. is responsible for all aspects of cyber and physical security across Onex Corp.


text: The cybersecurity team of Onex Corp. is headed by the Managing Director – Enterprise Technology who has 18 years of IT experience across financial services, healthcare and manufacturing industries in Canada including as the VP Financial Crimes and Enterprise Risk Technology at CIBC that provided cybersecurity platforms and services to protect the bank. Reporting to the Managing Director – Enterprise Technology, is the Manager, Cybersecurity who has over 15 years of experience in cybersecurity including Incident Readiness and Response, Strategy, GRC, Vulnerability and Threat Management, Business Continuity, Disaster Recovery. The Manager, Cybersecurity also has a BSc in Business Information Systems, and a Cybersecurity Bootcamp Certification from the University of Toronto. Reporting to the Manager, Cybersecurity is an IT Security Analyst who has over 5 years of experience in cybersecurity, including Digital Forensics, Identity and Access Management, Third-Party Risk Management. The IT Security Analyst also has a BSc in Forensic Science, an MSc in Information Security and Digital Forensics, and is currently pursuing a PHD in Information Systems and Design.


text: Onex Corp. conducts periodic cybersecurity risk assessments, including assessments or audits of third-party vendors, and assists with the management and mitigation of identified cybersecurity risks. The cybersecurity team of Onex Corp. reviews the cybersecurity framework annually as well as on an event-driven basis as necessary. Onex Corp.'s cybersecurity team and Onex Corp.'s MSSP also review the scope of the cybersecurity measures periodically, including in the event of a change in business practices that may implicate the security or integrity of Onex Corp.'s and its affiliates' information and systems.


text: Our Board is responsible for understanding the primary risks to our business. The Board is responsible for reviewing periodically our and the Adviser's information technology security controls and related compliance matters, with management. Onex Corp.'s cybersecurity team reports to the Board at least annually on cybersecurity matters, including risks facing us and the Adviser and, as applicable, certain incidents. In addition to such periodic reports, the Board or a committee thereof may receive updates from management as to our and the Adviser's cybersecurity risks and Onex Corp.'s cybersecurity program developments.


text: Impact of Cybersecurity Risks In 2023, we did not experience a material cybersecurity incident. While we do not believe that our business strategy, results of operations or financial condition have been materially adversely affected by any cybersecurity incidents, we describe whether and how future incidents could have a material impact on our business strategy, results of operations or financial condition in "Risks Related to Our Business and Structure— We may face a breach of our cyber security, which could result in adverse consequences to our operations and exposure of confidential information."


text: Risk Management and Strategy The Company recognizes the importance of a cybersecurity risk management program designed to assess, identify, and manage risk associated with cybersecurity threats. Our cybersecurity risk management program (the "Program") is consistent with the Federal Financial Institutions Examination Council ("FFIEC") Cybersecurity Assessment Tool, which incorporates bank regulatory guidance and principles from the National Institute of Standards and Technology Cybersecurity Framework and includes the following risk-based principles: • Identification, measurement, mitigation, monitoring and reporting of cybersecurity threats based on internal and external information sharing and resources; • Safeguards designed to protect against identified threats, including documented policies and procedures, controls, and employee education and awareness; • Processes to detect cybersecurity events and improve incident response, including routine testing of incident response, recovery and business continuity plans and processes; and • Third-party risk management process to manage cybersecurity risk with service providers, suppliers, and vendors.

companyName: UWHARRIE CAPITAL CORP

ticker: UWHR


text: Our Program is designed to adapt to an evolving landscape of emerging cybersecurity threats and advancing technology to determine the Company's cybersecurity preparedness. Through routine data gathering, emerging risks, internal incidents, technology investments and internal controls, our Program and overall cybersecurity risk strategy is adjusted as needed.


text: Our Program is supported by regular training of information security employees and awareness training and activities for executives, directors, and employees through which we communicate our cybersecurity policies, standards, processes and practices to foster a culture of cybersecurity risk management across the Company.


text: Integrated Risk Management The Program is integrated into the Company's enterprise risk management framework and functions to identify risk, form a strategy to manage risk, implement the strategy, test the implementation, and monitor our technology environment to control risk. Our information technology team works closely with stakeholders across security, risk, compliance, operations, other business stakeholders, and senior leadership to conduct an annual cybersecurity risk assessment utilizing the FFIEC Cybersecurity Assessment Tool.


text: Engagement of Third Parties in Connection with Risk Management The Company engages various third parties to evaluate the effectiveness and maturity of our Program. The Company engages an independent third party to audit the cybersecurity risk strategy and preparedness. The Company also maintains cybersecurity insurance, however, the costs related to cybersecurity threats or disruptions may not be fully insured. The Company also engages third parties to perform regular penetration tests, vulnerability scans, disaster recovery tests and cyber exercises to simulate threat actor attacks. Our relationships with third parties enable us to leverage their cybersecurity expertise and industry knowledge to assess our Program and make adjustments as needed.


text: Oversight of Third-party Risks Our third-party service providers, suppliers, and vendors face their own risks from cybersecurity threats that could impact the Company in certain circumstances. In response, we have implemented processes for overseeing and managing these risks. The processes include limiting the exposure of our information systems to external systems to the least practical amount, assessing the third parties' information security practices before allowing them to access our information systems or data, requiring third parties to implement appropriate cybersecurity controls in our agreements with them, conducting ongoing monitoring of their compliance with those requirements, and requiring third parties to agree to contractual requirements designed to ensure cybersecurity concepts are appropriately addressed.


text: Risks from Cybersecurity Threats As of the date of this report, we have not encountered any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. Board of Directors Oversight Our Board's Audit Committee oversees cybersecurity risk.


text: Management's Role in Cybersecurity Risk Management Given the important role of technology in the Company's operations and customer service, the Company has established an Information Technology Steering Committee, which consists of our IT Manager, President and Chief Risk Officer, Chief Operations Officer, Chief Financial Officer, Mortgage Systems Administrator and Enterprise Risk Manager. The Information Technology Steering Committee reviews, monitors, aligns, and prioritizes all significant strategic information technology initiatives and security risks. The Information Technology Steering Committee reports to the Audit Committee and minutes of the committee's meetings are subsequently reported by the Audit Committee to the Company's Board of Directors. Our IT Manager, in collaboration with our Enterprise Risk Manager make monthly/quarterly reports to the Information Technology Steering Committee. Such reports include updates related to key metrics, key risk indicators, key performance indicators, penetration test results, risk assessment results, project updates, incident reports, compliance matters, and operational issues.


text: Risk Management Personnel The IT Manager has the primary responsibility for managing the Program to identify, assess, manage and control cybersecurity risk. The IT Manager reports directly to our Chief Operations Officer. Our IT Manager has approximately 20 years of experience in cybersecurity, information security risk management, identity and access management, security architecture, vulnerability management, threat intelligence, security operations and incident management and response.


text: Monitoring Cybersecurity Incidents The IT Manager is continually informed of and monitors cybersecurity risks and incidents. In the event of a cybersecurity incident, the Company has developed an incident response plan to timely report cybersecurity incidents to our executive management team, the Audit Committee and Board of Directors, as necessary. In addition to facilitating timely evaluation, escalation and reporting of cybersecurity incidents, this plan also sets forth the process for identifying and assessing the severity of cybersecurity incidents, as well as monitoring post-incident mitigation and remediation.


text: Reporting to Board of Directors The Audit Committee receives reports from the Chief Operations Officer, IT Manager or Enterprise Risk Manager and briefings on our information security and enterprise risk management programs at least quarterly, including the results of any external audits, bank regulatory examinations and evaluations, as well as maturity assessments of our information security program.


text: Risk Management and Strategy We recognize the importance of developing, implementing, and maintaining robust cybersecurity measures to maintain the security, confidentiality, integrity, and availability of our business systems and commercially sensitive or confidential information. Our business depends on the proper functioning and availability of our information technology platform, including communications and data processing systems. We are also required to effect electronic transmissions with third parties including clients, vendors and others with whom we do business, and with our Board. We also recognize that, as we continue to increase our dependence on information technologies to conduct our operations the risks associated with cyber security also increase.

companyName: LSB INDUSTRIES, INC.

ticker: LXU


text: LSB utilizes an enterprise-wide risk management process to identify, assess and manage risks faced by our organization. The Company's Enterprise Risk Management Committee ("ERM Committee"), is designated with the responsibility to direct our risk management program and to execute our risk management strategy, including cyber and technology risk. To protect our information systems and operations from risks and to execute our cyber strategy, we use various security processes and technology tools that help identify, investigate, assess, prevent, and resolve potential vulnerabilities and security incidents in a timely manner. These include, but are not limited to, detection, monitoring and reporting tools. Our team uses widely adopted methods and models to identify, prioritize and manage cyber and technology risks and develop related information security controls and safeguards. In partnership with third party advisors and consultants, we conduct regular reviews and tests of our program and leverage audits, penetration and vulnerability testing, cyber risk tabletops and security awareness trainings, and other cyber exercises to evaluate the effectiveness of our program and improve our security measures. Our information security policies are designed to address current applicable legal requirements and to align with recognized frameworks for cyber risk management. These standards cover physical, administrative, and technical controls and address a wide range of current cyber threats. These policies and standards are reviewed and updated on a regular basis in order to respond to the constantly changing threat landscape.


text: Our Board of Directors considers cybersecurity to be a business risk and oversees enterprise-wide risks through the Audit Committee. The Audit Committee is designated by the Board with the responsibility for monitoring and reporting on management's cybersecurity and risk management processes. The ERM Committee is the management-entity designated by the Chief Executive Officer with the responsibility to direct and execute our risk governance and strategy, including cyber risk. This ERM Committee is composed of the Company's Executive Vice Presidents and each of the Company's Senior Vice Presidents. Our Senior Vice President and Treasurer chairs the ERM Committee. The Vice President for Information Technology ("IT") leads the information security program, manages cyber governance and incident management. The Vice President of IT and the Director of Infrastructure and Security have over forty-five years of combined information technology experience and over a decade of cybersecurity experience. The ERM Committee and Vice President for IT assess cyber risk and provide recommendations for management. The Chair of the ERM Committee and the Vice President for IT brief the Audit Committee regularly. These updates include an overview of cyber risk management activities, cyber threats, and key information security processes and mitigation efforts. The Chair of the Audit Committee provides regular reports to the Board of Directors on critical cyber risk and security topics presented to the Committee by management.


text: Incident Management We have implemented security procedures and measures in order to protect our information from being vulnerable to theft, loss, damage or interruption from a number of potential sources or events. LSB maintains and tests an incident response plan that outlines steps for the containment, investigation of, response to and recovery from cyber events. The plan also includes information pertaining to roles, responsibilities, and reporting process. This plan is a part of our formal, enterprise-wide crisis management process, which outlines a communication plan with executive leadership as well as guidelines for communication with the Board of Directors. Although we make efforts to maintain the security and integrity of our information systems and technology operations, these systems are subject to the cyber risk of incident or disruption, and there can be no assurance that our security safeguards, and those of our third-party providers, will prevent incidents to our or our third-party providers' systems that could adversely affect our business. For a discussion of these risks, see "Item 1A. Risk Factors—General Risk Factors."


text: We recognize the critical importance of maintaining the safety and security of our systems and data and have a holistic process for assessing, identifying, and managing material risks from cybersecurity threats. This process is supported by both management and our Board of Directors.

companyName: Zevia PBC

ticker: ZVIA


text: To prevent, detect, mitigate, and remediate information security threats, including a cybersecurity incident and/or threat, we maintain a cyber risk management process managed by our Senior Vice President, Operations ("SVP, Operations") who reports to our CEO. The SVP, Operations works with the Vice President, Deputy General Counsel ("Legal") on cybersecurity strategy, policy, training, standards, architecture, and processes. We have invested, and expect to continue to invest, in resources for the protection and safeguarding of our information technology systems, including, but not limited to, networks, applications, and outsourced technology services in connection with the operation of our business. These resources are designed to detect and respond to cyber incidents that may result in unauthorized access to, ransomware, damages, or destruction of, our information and systems.


text: Risk Management and Strategy Cybersecurity risk is a direct responsibility of management and the Company's information technology ("IT") team. Working cross-functionally with Legal, our SVP, Operations oversees the IT team that regularly monitors and assesses cybersecurity risks, implements measures designed to mitigate such risks and their associated effects on the Company and personal data collected, stored, and processed in our systems, and manages our information security training and cybersecurity awareness program. We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework.


text: Our approach to cybersecurity risk management includes the following: • Multi-Layered Defense and Monitoring – We work to protect our computing environments from cybersecurity threats through multi-layered defenses and monitoring efforts to identify cybersecurity threats, and to help prevent future attacks. We utilize data analytics systems to detect anomalies and identify cyber threats. From time to time, we engage third-party consultants or other advisors to assist in assessing, identifying, and/or managing cybersecurity threats. We also periodically use our internal audit partner to conduct additional reviews and assessments. • Insider Threats – We maintain organizational controls such as limited access, and access removal for terminated employees, designed to minimize insider threats, and address potential risks from within our Company. Our measures and controls are informed by industry practices, and designed to be consistent with applicable law, including privacy and other considerations. • Third Party Risk Assessments – We conduct privacy and information security risk assessments before sharing or allowing the hosting of sensitive data in computing environments managed by third parties. • Training and Awareness – We provide awareness training to our employees to help identify, avoid and mitigate cybersecurity threats. Our employees with network access are required to participate annually in training, including phishing simulations and other awareness training. We also periodically host tabletop exercises with management and other employees to practice rapid cyber incident response. • Supplier Engagement – Our standard terms and conditions contain contractual provisions requiring that our third-party suppliers disclose to us the technical and organizational measures they maintain, the standards and certifications by which they are evaluated for information and cyber security, and their cybersecurity insurance protection level. We seek to mitigate risk by evaluating the foregoing against any potential cyber-related risks depending on the nature of the services being provided.


text: Our Board of Directors is responsible for overseeing our enterprise risk management activities in general, and each of our Board committees assists the Board in the role of risk oversight. The Nominating and Enterprise Risk Management ("NERM") Committee of the Board of Directors specifically assists the Board in its oversight of risks related to cybersecurity. In accordance with its charter, the NERM Committee receives regular reports at each of its quarterly meetings from management, including the SVP, Operations. Such reporting includes updates on the Company's cybersecurity program, information security matters, the evolving cybersecurity threat environment, applicable privacy law compliance, and the Company's mitigation plans and evolving mitigation strategy. The Chair of the NERM Committee regularly reports to the Board of Directors on cybersecurity risks and other related matters. In addition, both the NERM Committee and the Audit Committee, in a joint meeting, receive an update on the Company's risk management process and the risk trends related to cybersecurity at least annually. Management reports to the NERM Committee and/or the Board of Directors in between meetings as appropriate regarding any significant cyber events.


text: To date we have not identified any cybersecurity threat or incident that has materially affected the Company or our financial position, results of operations and/or cash flows, but we face certain ongoing cybersecurity risk threats that, if realized, are reasonably likely to materially affect us. We continue to invest in the cybersecurity and resiliency of our networks and enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain. For more information regarding the risks we face from cybersecurity threats, please see Part I, Item 1A. "Risk Factors" included in this Annual Report.


text: Cybersecurity Risk Management and Strategy We recognize the need to continually monitor and assess material risks associated with cybersecurity threats as such term is defined in Item 106(a) of Regulation S-K. Additionally, we maintain a comprehensive risk management framework designed to respond quickly to perceived threats and mitigate the impact of a cybersecurity incident. Some of the cybersecurity risks we face include - but are not limited to - unauthorized access of sensitive information, breach of critical systems resulting in loss of constellation control, and denial of service of critical systems.

companyName: Spire Global, Inc.

ticker: SPIR


text: Cybersecurity risk management forms part of our overall risk management framework, which is regularly reviewed by our Chief Technology Officer ("CTO"), our senior management team and our Board of Directors. We retain an ISO 27001:2013 certification related to our information security management system ("ISMS") that supports the assets, technologies, personnel, and processes used by our corporate IT environment, as well as the satellite command and control, data uplink and downlink pipelines, and ground stations utilized by our radio frequency collection and data products. Cybersecurity incident response procedures are enumerated in internal policies and procedures with remediation plans reflective of the scope and severity of the incident. This remediation typically involves incident analysis, incident isolation and eradication, and post-incident response. In the event a cybersecurity incident is detected, the IT Security Team reports the event to our legal and compliance teams. These Legal and Compliance professionals then advise on any additional notification or reporting requirements.


text: We regularly assess risks related to regulatory compliance, technical operations, business operations, and product and contract deliverables. Risks are managed, documented, and tracked as part of operating the ISMS and other processes. Risks are internally assessed and categorized based on perceived likelihood and impact to system confidentiality, integrity, and availability as described by the ISO 27005 Information Security Risk Management international standard. We also engage third party penetration testers, assessors, vendors, and auditors to assist with external network vulnerability scanning, penetration testing, internal audits, external audits, threat intelligence, and employee training activities. Additionally, we utilize a variety of self-hosted and SaaS tools to assist with vulnerability identification, mitigation, and remediation.


text: Identified risks and vulnerabilities are ranked and prioritized for mitigation based upon the aforementioned factors. Some risk mitigation and minimization activities include: regular software patches and updates; permitting only required connections to sensitive and critical systems; reactive response to newly identified and discovered exploitable vulnerabilities; implementation of additional auditing and monitoring controls; and cadence-driven system security assessments for critical systems.


text: We assess the cybersecurity posture of third-party service providers, vendors and suppliers at least annually and whenever the vendor implements significant product or operational changes. We maintain consistent communications via email, chat services, ticketing systems, and regular meetings with these partners to promptly address and remediate any perceived vulnerabilities.


text: Additionally, we also provide mandatory training to our employees to help identify, avoid and mitigate cybersecurity threats. These trainings cover a wide range of cybersecurity topics such as insider threats, phishing, spoofing, and the like.


text: As of the date of this Annual Report on Form 10-K, we have not experienced a cybersecurity threat or incident that materially affected or is reasonably like to materially affect our business or operations, but there can be no guarantee that we will not experience such an incident in the future. We aim to incorporate industry best practices throughout our cybersecurity program and continue to invest in additional controls designed to ensure the resiliency of our networks and prevention of cybersecurity incidents. We describe how cybersecurity threats are likely to materially affect us, including our business strategy, results of operations, and financial condition, in the section titled "Risk Factors" in this Annual Report on Form 10-K.


text: Cybersecurity Governance Our cybersecurity program is overseen by the Company's CTO in close collaboration with the CEO/Chairman of the Board of Directors and our legal and compliance teams. Both our CEO and our CTO have technical backgrounds and are well informed about cybersecurity risk management best practices, as well as our Company's risk management framework. Our legal and compliance teams supporting the Company's cybersecurity efforts bring a wealth of experience from prior positions, as well as participation in ongoing training sessions and industry events.


text: Our CTO regularly briefs the full Board of Directors on our cybersecurity and information security posture and the Board of Directors is apprised of all material cybersecurity incidents and the results of any third-party assessments. Additionally, our Board has designated a single Board member, who has experience in assessing and managing cybersecurity risk, to lead the Board-level oversight of cybersecurity risk matters, including staying abreast of cybersecurity best practices and briefing the full Board when significant industry developments occur.


text: Daily risk management and oversight of the Company's cybersecurity posture is the responsibility of the Director of IT and Security, who directly reports to the CTO, and the cybersecurity professionals on his team. All of these team members have extensive experience in networking, cloud and on-premise infrastructure, software development, corporate IT, intelligence, Linux system administration, and data center operations. These individuals are responsible for approving and implementing security operations, security program development, and governance, risk and compliance related to cyber matters.


text: Cyber Risk Management and Strategy We have processes for assessing, identifying, and managing cybersecurity risks, which are built into our information technology function and are designed to help protect our information assets and operations from internal and external cyber threats, protect employee and clinical trial information from unauthorized access or attack, as well as secure our networks and systems. Such processes include physical, procedural, and technical safeguards, and routine review of our policies and procedures in an effort to identify risks and refine our practices. We engage certain external parties, including a contracted information technology consultant who is dedicated to our organization, to enhance our cybersecurity oversight.

companyName: PepGen Inc.

ticker: PEPG


text: In an effort to deter and detect cyber threats, we perform annual phishing tests with employees. We also require annual cybersecurity and prevention training for employees, which may cover topics such as social engineering, phishing, password protection, confidential data protection, and mobile security, and is designed to educate employees on incident reporting. We also use technology-based tools, including third-party tools and solutions, designed to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs.


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition; however, like other companies in our industry, we and our third-party vendors may, from time to time, experience threats and security incidents relating to our and our third-party vendors' information systems. For more information, see "Risk Factors-Risks Related to Employee Matters, Managing Growth and Other Operational Matters -Our internal information technology systems, or those of our vendors, collaborators or other contractors or consultants, may fail or suffer security breaches, loss or leakage of data and other disruptions or compromise, which could result in a material disruption of our product development programs, compromise sensitive information related to our business or prevent us from accessing critical information, or trigger contractual and legal obligations, potentially exposing us to liability, reputational harm or otherwise adversely affecting our business and financial results."


text: Governance Related to Cybersecurity Risks Our audit committee of the board of directors, or the Audit Committee, is responsible for overseeing cybersecurity risk, pursuant to the Audit Committee charter, and periodically updates our board of directors on such matters. The Audit Committee receives periodic updates from management and our contracted information technology consultant regarding cybersecurity matters. We have a process for the Audit Committee to be notified between such updates in the event of any significant new cybersecurity threats or incidents.


text: Management is responsible for, and is forming a committee tasked with, the operational oversight of company-wide cybersecurity strategy, policy, and standards across relevant departments to assess and help prepare us to address cybersecurity risks. Our contracted information technology consultant, supported by management, oversees the day-to-day implementation and management of our cybersecurity program. Our information technology consultant reports to the Senior Vice President, or SVP, of Chemistry and Manufacturing, who currently operates as our head of information technology. Our information technology consultant has approximately 20 years of experience in information technology, and also leverages the experience of a third-party managed systems provider. Our information technology consultant regularly reports to the SVP of Chemistry and Manufacturing as well as to other executive management on cyber matters, as appropriate.


text: At UCT, cybersecurity risk management forms a critical component of UCT's overall enterprise risk management program. Led by our Chief Information Security Officer ("CISO"), and under the oversight of our Board of Directors, we have implemented processes to assess, identify, manage and report cybersecurity risks, which, together with our broader business continuity plans, aim to not only address immediate response to cybersecurity incidents but also ensure swift restoration of critical systems and the maintenance of core business functions in the face of digital threats. Our senior management and information technology ("IT") security teams devote considerable time and resources to conducting regular evaluations of our systems and implementing necessary enhancements to our security infrastructure to better guard against evolving cybersecurity threats.

companyName: Ultra Clean Holdings, Inc.

ticker: UCTT


text: Our CISO, reporting directly to our Chief Information Officer ("CIO"), is responsible for designing, developing and implementing our overall information security program that sets forth a governance structure and processes to ensure regular risks assessments and timely reports regarding cybersecurity risks. We actively scan across our information infrastructure for security vulnerabilities inherent in our business as we rely extensively on information and technology systems for managing transactions, tracking financial performance, and storing sensitive data. We also continuously monitor and assess risks associated with the interconnected nature of many of our information and technology systems, such as ERP platforms, supply chain management systems, and electronic payment gateways. In the normal course of our monitoring process, upon identifying certain vulnerabilities within our business and information systems during a recent security assessment, our information security team, in close collaboration with a third-party expert, promptly began to remediate these vulnerabilities to prevent any potential compromise of our systems or data.


text: Using threat models and intelligence, we regularly assess a range of cyber threats, including hacking attempts, malware attacks, phishing schemes, infrastructure intrusions, and insider threats. In conjunction with our ongoing threat and vulnerability assessments, we evaluate the various ways, and the extent to which, cyberattacks may materially impact our business, including financial loss, regulatory penalties, reputation damage, and litigation risks. In this rapidly evolving cybersecurity environment, we recognize staying informed about emerging cybersecurity threats and industry best practices is an indispensable part of assessing and identifying cybersecurity risks, particularly within the manufacturing sector. Our involvement includes active participation in industry associations, sharing threat intelligence, and collaborating with regulatory bodies and law enforcement. This collaboration strengthens our defenses against potential threats to our financial and information systems.


text: As part of our ongoing commitment to maintain a robust cybersecurity program to protect all stakeholders, including our customers, investors, employees, and vendors, we have allocated significant resources to improve our IT security. We have deployed various protocols as part of a larger preventive framework against cyber threats, including advanced security technologies and services, firewalls outfitted with cutting-edge capabilities, layers of encryption protocols, Identity and Access Management ("IAM") controls, and muti-factor authentication. Our employees are required to complete cybersecurity best practice training on a regular basis (no less than once a year), the results of which are collected and reported to the senior management for further evaluation. We regularly engage third-party experts to assess the effectiveness of our security protocols and infrastructure, to detect potential threats and assist with remediation efforts, and to generally monitor and adapt our cybersecurity protocols to constantly evolving cybersecurity threats. In addition, we have deployed a Third-Party Risk Management ("TPRM") tool that sends questionnaires to our vendors designed to assess their cybersecurity vulnerabilities. These and other cybersecurity risk management protocols at UCT are being governed by our comprehensive cybersecurity policies, plans and incident response playbooks, to manage both our preventive efforts against cyber threats and quick and effective response protocols in the event of cybersecurity breaches. In the event of an incident, we are prepared to follow the steps outlined in these playbooks, from initial detection to mitigation, as well as notification to all appropriate functions, including the senior management and the Board.


text: Our Board of Directors has the overall oversight responsibility for our risk management, and delegates the cybersecurity and other risks relating to our information controls and security to our Audit Committee. Both the Audit Committee and the full Board regularly receive updates from our management on cybersecurity matters and our ongoing risk management efforts, and actively participate in ongoing discussions. In addition, the Board and the Compensation Committee review and approve the key performance indicators applicable to all management personnel responsible for effectively managing cybersecurity risk management programs at UCT, and engage in regular review of the Company's performance against those indicators.


text: We continue to face cybersecurity risks related to our business. While these risks have yet to materially affect us, we cannot guarantee that our ongoing and increasingly robust approach towards cybersecurity will be able to prevent cybersecurity incidents that could have a material adverse effect on us. For additional information about cybersecurity risks we face, see the risk factor item "Our business may be adversely affected by IT disruptions, including by impairing our ability to effectively deliver our products or services, which could cause us to lose customers" in Item 1A-Risk Factors.


text: Risk Management and Strategy We recognize the importance of identifying, assessing, and managing material risks associated with cybersecurity threats, which include, among other things, operational risks, intellectual property theft, fraud, extortion, harm to employees or patients, and violation of data privacy or security laws. We incorporate cybersecurity practices into our Enterprise Risk Management (ERM) approach, which is subject to oversight by our Board of Directors. Our cybersecurity policies and practices are aligned with relevant industry standards and are designed to detect, prevent, contain, and respond to cybersecurity threats and incidents in a prompt and effective manner.

companyName: BrightSpring Health Services, Inc.

ticker: BTSG


text: Our cybersecurity risk management program is informed by prevailing security standards and is designed to provide a framework for evaluating and responding to cybersecurity risks. This includes processes for assessing the severity of a cybersecurity threat, identifying the source of a cybersecurity threat, implementing cybersecurity countermeasures and mitigation strategies, and informing and updating management and, as needed, the Audit Committee and our Board of Directors of cybersecurity incidents that may pose a significant risk for the business. Security events and data incidents are evaluated, ranked by severity, and prioritized for response and remediation. Incidents are evaluated to determine materiality, as well as operational and business impact, and reviewed for privacy impact.


text: We deploy technical safeguards that are designed to protect our information systems, products, operations and sensitive information from cybersecurity threats. These include firewalls, intrusion prevention and detection systems, disaster recovery capabilities, malware and ransomware prevention, access controls, and data protection. We provide periodic training for all personnel regarding cybersecurity threats, with such training appropriate to the roles, responsibilities and access of the relevant Company personnel. Our policies require all workers to report any real or suspected cybersecurity events.


text: Recognizing the complexity and evolving nature of cybersecurity threats, incidents and risks, we engage third-party experts, including cybersecurity consultants, to evaluate and support our risk management systems. We also rely on software support from third-party vendors to assist with evaluating, monitoring, and testing our information technology systems. These relationships enable us to leverage specialized knowledge and insights, to help ensure our cybersecurity strategies and processes remain effective. Our collaboration with these third parties includes regular audits, routine system monitoring, threat assessments, and consultation on potential security enhancements. We require third-party service providers with access to personal, confidential, or proprietary information to implement and maintain comprehensive cybersecurity practices consistent with applicable legal standards and industry best practices.


text: As of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. For further discussion of the risks associated with cybersecurity incidents, as well as a description of an event that occurred in March 2023, see “Risk Factors—Risks Related to Our Business—Security breaches, loss of data, and other disruptions could compromise sensitive business or patient information, cause a loss of confidential patient data, employee data, personal information, or prevent access to critical information, and expose us to liability, litigation, and federal and state governmental inquiries and damage our reputation and brand.”


text: Our Board of Directors has overall oversight responsibility for our risk management, and delegates information security and related risk management oversight to the Audit Committee. The Audit Committee receives regular briefings on cybersecurity risks and risk management practices, including, for example, recent developments in the external cybersecurity threat landscape, evolving standards, vulnerability assessments, third-party and independent reviews, technological trends, as well as how management is addressing or mitigating those risks. The Audit Committee may also promptly receive information regarding any material cybersecurity incident that may occur, including any ongoing updates regarding the same. The Audit Committee periodically discusses our approach to cybersecurity risk management with our Chief Digital & Technology Officer (CDTO).


text: Our CDTO is a member of our executive management team who is principally responsible for overseeing our cybersecurity risk management program, in partnership with other business leaders across the Company. Our CDTO has over twenty years of extensive experience in information technology and security, and works in coordination with other members of the management team, including, among others, the Chief Financial Officer, the Chief Compliance Officer and the Chief Legal Officer and their designees. We believe our business leaders have the appropriate expertise, background and depth of experience to manage risks arising from cybersecurity threats.


text: Our CDTO, along with leaders from our privacy and corporate compliance functions, collaborate to implement a program designed to manage our exposure to cybersecurity risks and to promptly respond to cybersecurity incidents. Prompt response to incidents is delivered by multi-disciplinary teams in accordance with our incident response plan. Through ongoing communications with these teams during incidents, the CDTO monitors the triage, mitigation and remediation of cybersecurity incidents, and reports such incidents to executive management, the Audit Committee and other colleagues in accordance with our cybersecurity policies and procedures, as is appropriate.


text: The Company is committed to protecting the confidentiality, integrity, and availability of its information systems and the data they contain from cybersecurity threats. The Company recognizes that cybersecurity is a dynamic and evolving area of risk that requires ongoing assessment, management, and oversight. The Company works third party companies to assess, identify, manage, and mitigate material cybersecurity threats, as well as to respond to and recover from cybersecurity incidents.

companyName: GEN Restaurant Group, Inc.

ticker: GENK


text: The Company recognizes the importance of maintaining our technology and data systems. Our cybersecurity policies, standards, processes, and practices are integrated across our operational departments.


text: Cybersecurity Risk Management and Strategy As one of the elements of our overall risk management program, we focus on the following key areas: • Technical Safeguards: We deploy technical safeguards, including by not limited to firewalls, anti-malware functionality and access controls. • Outside Consultants: We utilize outside consultants, including contractors and other third parties, to among other things, conduct regular testing of our networks and systems to identify vulnerabilities through penetration testing, while also measuring and advising on potential improvements to our incident prevention, response, and documentation procedures.


text: We have not encountered cybersecurity threats or experienced previously cybersecurity incidents that have materially affected or that we believe are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition.


text: Board of Directors Oversight Our Board is aware of the critical nature of managing risks associated with cybersecurity threats. Management works with our Board to establish oversight mechanisms to ensure effective governance in managing risks associated with cybersecurity threats because we recognize the significance of these threats to our operational integrity and stakeholder confidence. The Board has delegated to our Audit Committee the primary responsibility for oversight of cybersecurity risks.


text: Management's Role Managing Risk Our Co-CEOs, CFO, and IT Manager play a primary role in informing the Audit Committee on cybersecurity risks. Our IT Manager has 7 years of experience with the Company, which includes managing cybersecurity. These individuals monitor activity and potential risks related to the day-to-day operations of the business, including reviewing results of the work of our outside consultants. They will provide briefings to the Audit Committee on a periodic basis regarding cybersecurity matters, including but not limited to the following: • Current cybersecurity landscape and emerging threats; • Status of ongoing cybersecurity initiatives and strategies; • Incident reporting, if any, and learning from any cybersecurity events; • Risk mitigation efforts and insurance, and • Compliance with regulatory requirements and industry standard.


text: Cybersecurity Risk Management and Strategy While we are in the process of fully implementing a comprehensive cybersecurity risk management program, we have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: AIRGAIN INC

ticker: AIRG


text: Our cybersecurity risk management program not only fortifies our current defense but also serve as the building blocks for adopting an internationally recognized IT standards framework, such as the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) or the International Organization for Standardization (ISO) 27001. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we intend to use the NIST CSF or ISO 27001 as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.] Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: • risk assessments of our risk capacity, conducting pressure and gap analyses, and formalizing our risk tolerance; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; and • a third-party risk management process for service providers, suppliers, and vendors, in which we assess their processes, controls, and monitor cybersecurity enhancements to safeguard our interests and mitigate potential risks.


text: We are building on our current program towards a more comprehensive cybersecurity risk management program. Our roadmap for the future is centered on the maturation of our cybersecurity risk management program to align to international IT frameworks, such as NIST and ISO 27001 that will strengthen our defenses, enhance our threat detection capabilities, and ensure the confidentiality, integrity, and availability of our critical systems and data.


text: Cybersecurity Governance Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to the audit committee of our board of directors (Audit Committee) oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program.


text: Management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: Our management team, including CTO and IT Manager, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team has several years of experience and have been trained for various roles in information technology and cybersecurity at numerous technology companies.


text: Cybersecurity Risk Management and Strategy As an externally managed REIT, our risk management function, including cybersecurity, is governed by the cybersecurity policies and procedures of our Manager, a subsidiary of ACRES Capital Corp. ("ACRES"). As such, our Manager participates in ACRES' processes for assessing, identifying, and managing risks from cybersecurity threats, as detailed below.

companyName: ACRES Commercial Realty Corp.

ticker: ACR


text: ACRES upholds a robust cybersecurity initiative, encompassing policies and protocols aimed at safeguarding its systems, operations, and entrusted data, including ours, from potential threats or risks. ACRES employs a range of protective measures within its cybersecurity framework including physical and digital access controls, identity verification, mobile device management software, employee training programs emphasizing cybersecurity awareness and best practices, tools for identifying abnormal activities, and vigilant monitoring of data usage, hardware, and software.


text: At least annually, ACRES' third-party cybersecurity compliance consultant conducts a cybersecurity risk assessment. We periodically review reporting on these risks and our cybersecurity threats, the status of our security infrastructure, our risk management activities and the status of, and our responses to, any cybersecurity incidents. We also periodically perform simulations and tabletop exercises. All employees are required to complete training that includes various topics on cybersecurity risk management best practices. Additionally, employees are regularly tested with phishing campaigns reinforcing their awareness of email threats.


text: Cybersecurity threat risks have not materially affected our company, including our business strategy, results of operations or financial condition. For further discussion of the risks we face from cybersecurity threats, including those that could materially affect us, see "Item 1A. Risk Factors—Risks Related to Our Operations—Our business is highly dependent on communications and information systems, and systems failures or cybersecurity incidents could significantly disrupt our business, which may, in turn, negatively affect the market price of our common stock and our ability to operate our business" in this report.


text: Cybersecurity Governance As described above, ACRES has engaged a third-party IT firm and cybersecurity compliance consultant to whom we have outsourced primary responsibility to oversee, implement and manage our processes and controls to assess, identify, and manage material risks from cybersecurity threats. ACRES management team oversees the work of the third-party IT and cybersecurity compliance consultant and regularly communicates with members of the team. Through the policies and controls described above, including an incident response policy, representatives of the third-party IT firm as well as members of ACRES management team are informed about cybersecurity threats and incidents affecting our information systems and direct our efforts to prevent, detect, mitigate and remediate cybersecurity threats and incidents.


text: The representatives of our third-party IT firm and cybersecurity compliance consultant who lead our cybersecurity risk management and risk assessment process have experience in managing information systems, developing cybersecurity strategy, implementing information security and cybersecurity programs, identifying and assessing cybersecurity risks and establishing incident response plans.


text: Our Company's Board and the audit committee are jointly responsible for overseeing our overall risk assessment and risk management program as well as our Manager's policies and practices related to our information technology systems, information security and cybersecurity risks. The Company's Board and the audit committee reviews at least annually our enterprise risks and related risk management program. In addition, the Company's Board receives periodic reports from our cybersecurity compliance firm on the primary cybersecurity risks that we and our Manager face and the measures we are taking to mitigate such risks. The chair of the audit committee would be notified following any cybersecurity incident meeting specified severity levels, and the Company's Board would also be expected to review the Manager's materiality assessment regarding any cybersecurity incident requiring disclosure to the SEC.


text: Our board of directors is responsible for overseeing our risk management program and cybersecurity is a critical element of this program. Management is responsible for the day-to-day administration of our risk management program and our cybersecurity policies, processes, and practices. Our cybersecurity policies, standards, processes, and practices are based on recognized frameworks established by the Center for Internet Security (CIS) and other applicable industry standards and are integrated into our overall risk management system and processes. We have not identified any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors - Intrusions into our computer systems could result in compromise of confidential information."

companyName: SOLENO THERAPEUTICS INC

ticker: SLNO