text: We have established a Security Committee (the "SC"), comprised of senior departmental leadership including our Chief Financial Officer, Senior Vice President and General Counsel, Vice President – IT, Vice President – Internal Audit, and Vice President – Corporate Operations, each of whom has between 10 to 20 years of experience managing risks at the Company and at similar companies, including risks arising from cybersecurity threats. The SC meets quarterly to discuss and review cybersecurity concerns that arise during the year. The SC also identifies areas that should be addressed and reviews and updates security policies, as necessary. The SC has primary management oversight responsibility for assessing and managing risks from cybersecurity threats.


text: Our senior IT leadership is responsible for the day-to-day management and development of appropriate cybersecurity programs, including as may be required by applicable law or regulation. Our senior IT leadership monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents as part of the cybersecurity programs described above, works closely with the SC, and reports regular updates to the Audit Committee. Our IT team is led by our Vice President – IT, who has over 12 years of experience managing global IT operations, including strategy, applications, infrastructure, information security, support, and execution.

companyName: Nine Energy Service, Inc.

secItem: Item 1C


text: Risk Management and Strategy Identifying, assessing, and managing cybersecurity risk s is an important component of our overall enterprise risk management program. Our cybersecurity programs have been developed based on the National Institute of Standards and Technology Cybersecurity Framework and seek to protect us against cybersecurity risks. Among other things, these programs generally involve maturity evaluations and assessments by third parties, vulnerability scanning, employee testing and training, technical and business team-focused tabletop exercises, business continuity planning, incident response planning, and d ata security assessments of third-party service providers as a part of vendor management.


text: Board Oversight and Management's Role Our Board of Directors (the "Board") considers cybersecurity risk as part of its risk oversight function and has assigned oversight of cybersecurity risk management to the Audit Committee. The Audit Committee regularly receives reports from our management, including the SC (defined below) and our senior IT leadership and third parties on cybersecurity matters. The Audit Committee reports to the Board regarding its activities, including those related to cybersecurity. In addition, the Board receives reports addressing cybersecurity as part of our overall enterprise risk management program and to the extent cybersecurity matters are addressed therein, in regular business updates.


text: We have established a Security Committee (the "SC"), comprised of senior departmental leadership including our Chief Financial Officer, Executive Vice President and General Counsel, Senior Vice President – Strategic Development and Investor Relations, Vice President – IT, Vice President – Internal Audit, and Vice President – Corporate Operations, each of whom has between 10 to 20 years of experience managing risks at the Company and at similar companies, including risks arising from cybersecurity threats. The SC meets quarterly to discuss and review cybersecurity concerns that arise during the year. The SC also identifies areas that should be addressed and reviews and updates security policies, as necessary. The SC has primary management oversight responsibility for assessing and managing risks from cybersecurity threats.


text: Our senior IT leadership is responsible for the day-to-day management and development of appropriate cybersecurity programs, including as may be required by applicable law or regulation. Our senior IT leadership monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents as part of the cybersecurity programs described above, works closely with the SC, and reports regular updates to the Audit Committee. Our IT team is led by our Vice President – IT, who has over 13 years of experience managing global IT operations, including strategy, applications, infrastructure, information security, support, and execution.


text: We recognize the importance of assessing, identifying, reviewing and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational and legal risks including intellectual property theft or loss, fraud, extortion, harm to employees or customers and violation of data privacy or security laws. Our framework is informed in part by the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF), although this does not imply that we meet all technical standards, specifications or requirements under NIST CSF.

companyName: Hughes Satellite Systems Corp


text: We have an enterprise-wide information security program designed to identify, protect against, detect, respond to, and recover from cybersecurity risks, threats, and events. Our cyber risk management system contributes significantly to the overall resilience and integrity of our business by, among other things, integrating the risk identification process in all major company initiatives and deployment processes, implementing a unified approach to managing both digital and traditional business risks, making continuous improvements and regularly reporting to management and the Board of Directors as a whole to ensure accountability.


text: We regularly assess risks from cybersecurity and technology threats and monitor our information systems for potential vulnerabilities. We and certain third parties conduct regular reviews and tests of our information security program and also leverage, among other things, audits, tabletop exercises, penetration and vulnerability testing, red team exercises, simulations and other exercises to evaluate the effectiveness of our information security program and improve our security measures and planning. In addition, we evaluate third-party risks and perform third-party risk management to assess, identify and mitigate risks from third parties such as vendors, suppliers and other business partners.


text: We have not experienced cyber-attacks or other malicious activities that materially disrupted our business. Any future failure or disruption of our information technology infrastructure and communications systems or those of third parties that we use in our operations, could harm our business. We describe whether and how risks from identified cybersecurity threats, including, but not limited to, as a result of any previous cyber-security incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K.


text: Our Senior Director of Cybersecurity Infrastructure and Threat Hunting, Corporate Cybersecurity leads our information security organization responsible for overseeing our information security program. This individual has over 20 years of experience in various roles involving security, including risk management and security leadership. Team members who support our information security program have relevant educational and industry experience, including, but not limited to, holding similar positions at large technology companies. The team provides regular reports to senior management and other relevant teams, including, but not limited to, the Chief Executive Officer ("CEO"), Chief Operating Officer ("COO"), and Chief Legal Officer ("CLO").


text: Preparation for and, where possible prevention of cybersecurity incidents involves regular and structured briefings to key management on risk remediation measures that should be taken to decrease, among other things, the likelihood and severity of incidents and to mitigate and manage their effects. The CEO, COO, CLO and other members of management receive detailed updates on cybersecurity risks on a regular basis, no less frequently than monthly, or when significant risks or incidents are identified. These briefings enable the management team to, among other things, stay informed of the latest threats, assess the effectiveness of current security measures and make timely decisions on strategic security initiatives. In addition, the Board of Directors is regularly briefed, no less frequently than quarterly, on cybersecurity risks as part of its oversight functions and to ensure that cybersecurity practices align with the company's overall risk management framework and business objectives. In connection with the Integration, we anticipate that we will continue to evaluate and address as needed our cyber security risk management, policies, structure, strategies and governance to meet our needs.


text: Cybersecurity risk management and strategy Our cybersecurity risk management program is managed by our Chief Information Officer ("CIO") who reports to our Chief Financial Officer and provides regular updates to the Board. Our CIO establishes our overall Information Technology ("IT") security strategy, oversees our information, cyber, and technology security and manages our IT department, which includes our Cybersecurity team. His responsibilities include developing, implementing, and enforcing security policies to protect critical data. The head of our Cybersecurity team, our Director of Information Security, who reports to our CIO, runs the day-to-day management of our cybersecurity risks. Our IT department overall assists in implementing cybersecurity strategies and policies under the direction of the Cybersecurity team, as applicable.

companyName: PBF Energy Inc.

ticker: PBF


text: Our cybersecurity risk management program aligns with the National Institute of Standards and Technology Cyber Security Framework, which establishes five areas of focus: identify, protect, detect, respond and recover. Our cybersecurity risk management program is designed to manage industry-specific threats, as well as threats arising from the overall evolving cybersecurity landscape and consists of two principal areas of focus: (i) enterprise systems, which consists of all business systems used in our daily operations and (ii) operational technology, which consists of all process control, supervisory control and data acquisition systems. Key elements of our cybersecurity management program include: • identifying, monitoring and mitigating the cybersecurity risks to our systems, assets, data and capabilities; • a critical response process for cybersecurity incidents, including the process for detection, investigation, containment and remediation of any such incidents; • establishment of disaster recovery plans; • testing, at least bi-annually, of select critical systems for disaster recovery and periodic walk-throughs of procedures for disaster recovery; • identity access policies that aim to identify and monitor for potential cyber intrusions; • periodic security tests, including monthly internal vulnerability scans, weekly external vulnerability scans, monthly phishing campaigns and recurring penetration testing by third-party cybersecurity firms; • table-top exercises, at least quarterly, for incident response preparedness for the Cybersecurity team and Information Technology department; and • annual drills for potential threats on various aspects of our technology assets based on the then-existing IT threat landscape for our industry. Pursuant to our incident response plan, the Cybersecurity team has defined roles in responding to all cybersecurity incidents to provide an efficient and organized approach to handling cybersecurity threats, with the CIO receiving all reports and status updates regarding cybersecurity threats. The incident response plan provides a documented framework for when and how the CIO informs and updates our Board, the executive officers and other internal parties and when external parties are notified or consulted about a cybersecurity threat and the status thereof.


text: We also utilize third-party cybersecurity vendors to assist us with various aspects of our cybersecurity risk management program. For example, in order to support our cybersecurity incident response procedures, we have retained several third-party cybersecurity firms to monitor the IT threat landscape for our industry. As part of our efforts to manage the risk of cybersecurity threats associated with the use of third parties, we monitor and evaluate the cybersecurity risk profiles of third-party technology providers and consider such risk profiles when selecting third-party technology providers. Any third-party service provider that is granted access to our network is required to comply with our policies regarding information technology and cybersecurity. We also engage several third-party cybersecurity firms to perform independent assessments of the effectiveness of our cybersecurity risk management program and assist us in the continued review of our cybersecurity risk management program in order to reflect the evolving landscape of cybersecurity.


text: To date, there have been no significant risks from cybersecurity threats, including as a result of any significant cybersecurity breaches or attacks that have materially affected our business, results of operations or financial condition. However, if we were to be subject to a material successful cyber intrusion, it could result in remediation or service restoration costs, increased cybersecurity protection costs, lost revenues, litigation or regulatory actions by governmental authorities, increased insurance premiums, reputational damage and damage to our competitiveness, financial condition, results of operations and cash flows. See "Item 1A. Risk Factors-Risks Relating to Our Business and Industry-A cyber-attack on, or other failure of, our technology infrastructure could affect our business and assets, and have a material adverse effect on our financial condition, results of operations and cash flows."


text: Cybersecurity governance Our CIO has 30 years of experience in highly regulated industries managing information security in complex, matrixed environments, seven of which are in his current role with the Company. He has created and maintained enterprise-level information security programs for our Company and other US and international companies in the refining industry.


text: The CIO, along with the head of our Cybersecurity team, periodically reports, no less than quarterly, to our Board and our executive officers regarding the state of our cybersecurity risk management program, including information on the status of ongoing efforts to manage and mitigate cybersecurity risks, as well as recent cybersecurity trends and events and any updates to cybersecurity matters.


text: The Audit Committee reviews our disclosures with respect to cybersecurity and information technology risks. The Audit Committee also reviews with management guidelines and policies to govern the process by which risk assessment and risk management is undertaken, including but not limited to cybersecurity and information technology risks. As part of the Company's enterprise-wide risk management program, our Internal Audit team also reports to our Audit Committee regarding assessments of our cybersecurity and information technology risks, at least annually, based on regular updates by our CIO regarding such risks. Our Internal Audit team periodically reports to our executive officers and the Audit Committee regarding such risks.


text: Cybersecurity risk management and strategy Our cybersecurity risk management program is managed by our current Chief Information Officer ("CIO") who reports to our Chief Financial Officer and provides regular updates to the Board. Our CIO establishes our overall Information Technology ("IT") security strategy, oversees our information, cyber, and technology security and manages our IT department, which includes our Cybersecurity team. His responsibilities include developing, implementing, and enforcing security policies to protect critical data. The head of our Cybersecurity team, our Director of Information Security, who reports to our CIO, runs the day-to-day management of our cybersecurity risks. Our IT department overall assists in implementing cybersecurity strategies and policies under the direction of the Cybersecurity team, as applicable.


text: To date, there have been no significant threats, including as a result of any significant cybersecurity breaches or attacks, that have materially affected our business, results of operations or financial condition. However, if we were to be subject to a material successful cyber intrusion, it could result in remediation or service restoration costs, increased cybersecurity protection costs, lost revenues, litigation or regulatory actions by governmental authorities, increased insurance premiums, reputational damage and damage to our competitiveness, financial condition, results of operations and cash flows. See "Item 1A. Risk Factors-Risks Relating to Our Business and Industry-A cyber-attack on, or other failure of, our technology infrastructure could affect our business and assets, and have a material adverse effect on our financial condition, results of operations and cash flows."


text: Cybersecurity governance Our CIO assumed his position effective June 1, 2024, following the retirement of his predecessor. He previously served as the head of our Cybersecurity team. Our CIO has 28 years of experience in highly regulated industries managing information security in complex, matrixed environments. He has created and maintained enterprise-level information security programs for our Company and other US and international companies in the refining industry.


text: Our CIO, along with the head of our Cybersecurity team, periodically reports, no less than quarterly, to our Board and our executive officers regarding the state of our cybersecurity risk management program, including information on the status of ongoing efforts to manage and mitigate cybersecurity risks, as well as recent cybersecurity trends and events and any updates to cybersecurity matters.


text: Management has implemented a comprehensive cybersecurity program that is designed to protect our information, and that of our customers and suppliers, against cybersecurity threats that may materially and adversely affect the confidentiality, integrity, and availability of our information systems. Our cybersecurity program includes processes and standards that leverage recognized cybersecurity frameworks, industry best practices and guidance from U.S. Government security directives that focus on cybersecurity and critical infrastructure.

companyName: Phillips 66

ticker: PSX


text: Board of Directors The Audit and Finance Committee of the Board of Directors (the Audit and Finance Committee) is responsible for overseeing the company's Enterprise Risk Management (ERM) program, including oversight of the processes management has implemented to assess, identify and manage risks associated with cybersecurity and information technology. In carrying out this responsibility, the Audit and Finance Committee regularly receives written reports from the company's Chief Information Security Officer (CISO) and periodic briefings from the CISO. These presentations may address a wide range of topics, such as the results of recent vulnerability assessments and third-party independent reviews, changes to the threat environment, technological trends and other recent developments, and peer and other third-party benchmarking. The Audit and Finance Committee makes regular reports to the Board of Directors on data protection and cybersecurity matters. The company maintains an Enterprise Cybersecurity Incident Response Plan (ECIRP) which provides the framework for management's response to cyber-related incidents and escalation protocols, including, when appropriate, prompt reporting to the Board of Directors.


text: At the management level, our CISO has extensive cybersecurity knowledge and skills gained from work experience at the company and with a law enforcement agency, as well as from obtaining advanced professional certifications. The CISO is responsible for the assessment and management of risks from cybersecurity threats and leads a team responsible for implementing, monitoring and maintaining cybersecurity and data protection practices across the company. The individuals who report directly to our CISO possess relevant educational and industry experience in the areas of cyber threat hunting and intelligence, digital standards, data privacy, cyber training, and cybersecurity operations center management. In addition to our internal cybersecurity capabilities, we also regularly engage consultants, or other third parties to assist with assessing, identifying, and managing cybersecurity risks. The CISO receives reports on cybersecurity threats on an ongoing basis, and in conjunction with management, regularly reviews risk management measures implemented by the company to identify, assess and mitigate data protection and cybersecurity risks. Our CISO works closely with the company's Senior Counsel, Intellectual Property and Data Protection, to oversee compliance with legal, regulatory and contractual security requirements.


text: Risk Management and Strategy On an annual basis, we conduct an evaluation of our cybersecurity risks as part of the ERM program. Through the ERM program, the CISO and other internal subject matter experts review potential cybersecurity threat scenarios, such as data theft, cash theft, widespread outages and business disruptions, and the potential consequences of such scenarios. The results of the risk assessment are shared with management and the Audit and Finance Committee.


text: We have a continuous monitoring program to detect and respond to potential cybersecurity threats in real-time. Log data from our technical controls are collected, aggregated, and correlated in a Security Information and Event Management (SIEM) system that identifies and categorizes events, as well as analyzes them. If the SIEM system identifies a potential security event, it can direct other controls to stop the activity and also generate alerts for detection and response. These alerts are monitored by a managed security service provider that augments a dedicated internal Security Operations Center team.


text: In addition, we utilize a third-party risk management (TPRM) program to identify, assess, monitor, and mitigate risks associated with third-party relationships, including cybersecurity risks. The TPRM program is designed to help ensure proper controls and measures are in place to manage the potential risks and vulnerabilities associated with third parties. Our policies and procedures aid in the governance from initial due diligence, selection, and contracting to termination.


text: With respect to cybersecurity incident response, our ECIRP provides a standardized framework for responding to cybersecurity incidents. The ECIRP sets out a coordinated approach to investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate.


text: Internal audit performs audits of our cybersecurity program. Each year, we conduct audits across the company's information technology and operation technology infrastructure, networks, systems, applications, and operational processes and procedures to evaluate compliance with our information security policies and standards. Process control network assurance audits are conducted on a rotating schedule that is risk-based and provides coverage across each operational business area no greater than five years. In addition to the internal audits, we also engage external cybersecurity experts and auditors to conduct assessments, penetration testing, and cybersecurity maturity assessments. Although we have experienced actual and attempted cybersecurity events and incidents on our networks and systems in the past, we do not believe that the risks from any of these events or incidents, individually or in the aggregate, have materially affected our business, operations, or financial condition, or are reasonably likely to have such an effect. For more information concerning cybersecurity risks we face, see the discussion in "Item 1A. Risk Factors" in this report.


text: Board of Directors The Audit and Finance Committee of the Board of Directors (the Audit and Finance Committee) is responsible for overseeing the company's Enterprise Risk Management (ERM) program, including oversight of the processes management has implemented to assess, identify and manage risks associated with cybersecurity and information technology.


text: In carrying out this responsibility, the Audit and Finance Committee regularly receives written reports from the company's Chief Information Security Officer (CISO) and periodic briefings from the CISO. These presentations may address a wide range of topics, such as the results of recent vulnerability assessments and third-party independent reviews, changes to the threat environment, technological trends and other recent developments, and peer and other third-party benchmarking.


text: The Audit and Finance Committee makes regular reports to the Board of Directors on data protection and cybersecurity matters. The company maintains an Enterprise Cybersecurity Incident Response Plan (ECIRP) which provides the framework for management's response to cyber-related incidents and escalation protocols, including, when appropriate, prompt reporting to the Board of Directors.


text: At the management level, our CISO has extensive cybersecurity knowledge and skills gained from work experience at the company and with a law enforcement agency, as well as from obtaining advanced professional certifications. The CISO is responsible for the assessment and management of risks from cybersecurity threats and leads a team responsible for implementing, monitoring, and maintaining cybersecurity and data protection practices across the company. The individuals who report directly to our CISO possess relevant educational and industry experience in the areas of cyber threat hunting and intelligence, digital standards, data privacy, cyber training, and cybersecurity operations center management. In addition to our internal cybersecurity capabilities, we also regularly engage consultants, or other third parties to assist with assessing, identifying, and managing cybersecurity risks. The CISO receives reports on cybersecurity threats on an ongoing basis, and in conjunction with management, regularly reviews risk management measures implemented by the company to identify, assess and mitigate data protection and cybersecurity risks. Our CISO works closely with the company's Senior Counsel, Intellectual Property and Data Protection, to oversee compliance with legal, regulatory and contractual security requirements.


text: We have a continuous monitoring program to detect and respond to potential cybersecurity threats in real-time. Log data from our technical controls are collected, aggregated, and correlated in a Security Information and Event Management (SIEM) system that identifies and categorizes events, as well as analyzes them. If the SIEM system identifies a potential security event, it can direct other controls to stop the activity and also generate alerts for detection and response. These alerts are monitored by a managed security service provider that augments our dedicated internal Security Operations Center team.


text: With respect to cybersecurity incident response, our ECIRP provides a documented framework for responding to cybersecurity incidents. The ECIRP sets out a coordinated approach to investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate.


text: Our Internal Audit organization performs audits of our cybersecurity program. Each year, we conduct audits across the company's information technology and operation technology infrastructure, networks, systems, applications, and operational processes and procedures to evaluate compliance with our information security policies and standards. Process control network assurance audits are conducted on a rotating schedule that is risk-based and provides coverage across each major operational business area no greater than five years. In addition to the internal audits, we also engage external cybersecurity experts and auditors to conduct assessments, penetration testing, and cybersecurity maturity assessments. Although we have experienced actual and attempted cybersecurity events and incidents on our networks and systems in the past, we do not believe that the risks from any of these events or incidents, individually or in the aggregate, have materially affected our business, operations, or financial condition, or are reasonably likely to have such an effect. For more information concerning cybersecurity risks we face, see the discussion in "Item 1A. Risk Factors" in this report.


text: We recognize the critical importance of maintaining the trust and confidence of stakeholders toward our business and are committed to protecting the confidentiality, integrity, and availability of our business operations and systems. Our board of directors is actively involved in oversight of our risk management activities, and cybersecurity represents an important element of our overall approach to risk management. Our cybersecurity policies, standards, processes, and practices are based on recognized frameworks established by the National Institute of Standards and Technology, or NIST, and other applicable industry standards. In general, we seek to address cybersecurity risks through a comprehensive approach that is focused on preserving the confidentiality, security, and availability of the information that we collect and store by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: SERA PROGNOSTICS, INC.

ticker: SERA


text: Cybersecurity Risk Management and Strategy; Effect of Risk We face risks related to cybersecurity such as unauthorized access, cybersecurity attacks and other security incidents, loss of data, and misappropriation of confidential information. To identify and assess material risks from cybersecurity threats, we maintain a comprehensive cybersecurity program to ensure our systems are effective and prepared for information security risks, including regular oversight of our programs for security monitoring for internal and external threats to ensure the confidentiality and integrity of our information assets. We consider risks from cybersecurity threats alongside other company risks as part of our overall risk assessment process. We employ a range of tools and services, including third-party real-time risk assessments of cyber assets and mitigation of security risks, data loss prevention, regular air-gapped backups, continuous monitoring and threat response, advanced firewall systems, and security information and event management. As discussed in more detail under "Cybersecurity Governance" below, our audit committee provides oversight of our cybersecurity risk management and strategy processes, which are led by our Chief Information Officer.


text: We also identify our cybersecurity threat risks by comparing our processes to standards set by NIST. To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and protect against and respond to cybersecurity incidents, we undertake the following activities: • monitor emerging data protection best practices and laws and implement changes to our processes that are designed to comply with such; • annual HIPAA security and privacy risk assessments performed with third party provider, as well as annual HIPAA compliance audits; • through our policies, practices and contracts (as applicable), require employees, as well as third parties that provide services on our behalf, to treat confidential information and data with care; • employ technical safeguards that are designed to protect our information systems from cybersecurity threats, including advanced firewall systems, endpoint detection and response, data loss prevention, regular air-gapped backups, and security information and event management, which are evaluated and improved through third-party real-time risk assessments and mitigation of security risks; • provide regular, mandatory training for our employees and contractors regarding cybersecurity threats as a means to equip them with effective tools, information and education to recognize and address cybersecurity threats; • conduct regular phishing email simulations for all employees and contractors with access to our email systems to enhance awareness and responsiveness to possible threats; • leverage the NIST incident handling framework to help us identify, protect, detect, respond and recover when there is an actual or potential cybersecurity incident; • carry and maintain information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident; and • document internal policies and procedures for cybersecurity incident response and recovery.


text: Our incident response plan coordinates the activities we take to prepare for, detect, respond to, and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate damage to our business and reputation.


text: Our policies and processes also address cybersecurity threat risks associated with our use of third-party service providers. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our data to ensure they have adequate cybersecurity safeguards in place and continually monitor cybersecurity threat risks identified through such diligence.


text: Cybersecurity Risk Management and Strategy As a provider of cybersecurity solutions, we are passionate about cybersecurity risk management. At CrowdStrike, cybersecurity risk management is an integral part of our overall enterprise risk management program.

companyName: CrowdStrike Holdings, Inc.

ticker: CRWD


text: Our cybersecurity risk management program, which includes data privacy, product security, and information security, is designed to align with our industry's best practices. Our program provides a framework for identifying, monitoring, evaluating, and responding to cybersecurity threats and incidents, including those associated with our use of software, applications, services, and cloud infrastructure developed or provided by third-party vendors and service providers. This framework includes steps for identifying the source of a cybersecurity threat or incident, including whether such cybersecurity threat or incident is associated with a third-party vendor or service provider, assessing the severity and risk of a cybersecurity threat or incident, implementing cybersecurity countermeasures and mitigation or remediation strategies, and informing management and the audit committee of our Board of Directors (the "Audit Committee") of material cybersecurity threats and incidents.


text: Our cybersecurity team is responsible for assessing our cybersecurity risk management program and our incident response plan, which we regularly test through table-top exercises, and testing of our security protocols through additional techniques, such as penetration testing. In addition, we regularly engage independent third-party auditors to evaluate our compliance with various security compliance standards. We also conduct internal annual assessments of our cybersecurity risk management program. We review or update our cybersecurity policies, standards and procedures annually, or more frequently as needed, to account for changes in the threat landscape, as well as in response to legal and regulatory developments. Our cybersecurity efforts also include mandatory training for all employees and contractors on CrowdStrike's security and privacy policies. We also have a clearly defined acceptable use policy, and we require employees to certify to it. We also require employees to certify their adherence to our code of conduct. We also periodically send our employees simulated phishing emails to test their compliance with our policies. Although we have continued to invest in our diligence, onboarding, and monitoring capabilities over our critical third parties, including our third-party vendors and service providers, our control over the security posture of our critical third parties is limited, and there can be no assurance that we can prevent or mitigate the risk of any compromise or failure in the information assets owned or controlled by such third parties.


text: A cross-functional incident response team, comprised of representatives from information technology, information security, product security, engineering, privacy and legal, is responsible for the monitoring and disposition of potential occurrences such as data breaches, intrusions, and other security incidents and implementing our detailed incident response plan. Our incident response plan includes processes and procedures for assessing potential internal and external threats, activation and notification, crisis management, and post-incident recovery designed to safeguard the confidentiality, availability, and integrity of our information assets.


text: In fiscal 2024, we did not identify any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats or incidents or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors— Risks Related to Our Business and Industry" in this annual report on Form 10-K.


text: Cybersecurity Governance Our Board of Directors has oversight responsibility for our overall enterprise risk management, and has delegated cybersecurity risk management oversight to the Audit Committee. The Audit Committee is responsible for ensuring that management (i) has policies, processes, and procedures designed to identify, monitor, evaluate, and respond to cybersecurity risks to which the company is exposed and (ii) takes steps to mitigate or remediate cybersecurity risks, threats and incidents, including monitoring the activities of the cybersecurity team and reviewing and updating our cybersecurity policies, processes and procedures. The Audit Committee also reports material cybersecurity incidents to our full Board of Directors.


text: Management is responsible for day-to-day risk management activities, including identifying and assessing cybersecurity risks, establishing processes to ensure that potential cybersecurity risk exposures are monitored, implementing appropriate mitigation or remediation measures and maintaining cybersecurity programs. Our cybersecurity programs are under the direction of our Chief Information Security Officer ("CISO"). Our CISO and dedicated personnel are certified and experienced information systems security professionals and information security managers with many years of experience across a variety of technology sub-specialties.


text: Our CISO receives reports from our cybersecurity team and monitors the prevention, detection, and mitigation or remediation of cybersecurity risks. Management, including the CISO, regularly updates the Audit Committee and the Board of Directors on the Company's cybersecurity programs, material cybersecurity risks, and mitigation or remediation strategies.


text: In fiscal 2025, we did not identify any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats or incidents or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors— Risks Related to Our Business and Industry" in this annual report on Form 10-K.


text: Main Street and our Adviser maintain, and routinely review and evaluate their and the Company's information technology ("IT") and cybersecurity policies, practices and procedures (the "Cybersecurity Program"). The Cybersecurity Program has various policies and procedures including a Cyber Incident Response Plan as part of Main Street's Crisis Management Plan. The Cybersecurity Program is administered by Main Street's IT Manager, who is managed on a day to day basis by Main Street's General Counsel and Chief Compliance Officer and overseen by Main Street's IT Steering Committee consisting of Main Street's Chief Executive Officer, Main Street's Chief Financial Officer and Chief Operating Officer and Main Street's General Counsel and Chief Compliance Officer. Main Street's General Counsel and Chief Compliance Officer also serves as the crisis response team leader in connection with any material cybersecurity incident under the Cyber Incident Response Plan. Main Street and our Adviser also utilize the services of IT and cybersecurity advisers, consultants and experts in the evaluation and periodic testing of IT and cybersecurity systems, to recommend improvements to the Cybersecurity Program and in connection with any cybersecurity incident. We believe that the individuals involved in the Cybersecurity Program possess the necessary skills, experience and backgrounds that, when combined with the resources of the external IT and cybersecurity advisers, consultants and experts, are sufficient to manage the Cybersecurity Program.

companyName: MSC INCOME FUND, INC.

ticker: MSIF


text: As part of our overall risk management process, our management engages at least annually in an enterprise risk management review and evaluation, during which management reviews the principal risks relating to our business and operations. Included in this process is a review and evaluation of our risks relating to the Cybersecurity Program. Additionally, as part of our Rule 38a-1 compliance program, we review at least annually the compliance policies and procedures of our key service providers, including our Adviser and Main Street, including documentation discussing each service providers' information security and privacy controls. Any failure in our or our key service providers' cybersecurity systems could have a material impact on our operating results. See Item 1A. Risk Factors — General Risk Factors — The failure in cybersecurity systems, as well as the occurrence of events unanticipated in our and our Adviser's disaster recovery systems and management continuity planning could impair our ability to conduct business effectively.


text: Oversight of risks relating to IT and cybersecurity has been delegated by our Board to its Audit Committee. The Audit Committee includes members of the Board who, in addition to each being designated as an "audit committee financial expert," possess backgrounds and experience which we believe enable them to provide effective oversight of our IT and cybersecurity risks. Our management routinely reports to the Audit Committee on the status of the Cybersecurity Program at the Audit Committee's quarterly meetings. Routine reports generally detail any testing, observations or developments concerning the Cybersecurity Program that occurred during the prior quarter. The results of periodic testing related to the Cybersecurity Program are also described in the Chief Compliance Officer's annual report to the Board, provided pursuant to Rule 38a-1 under the 1940 Act. The crisis response team leader also collaborates with the Audit Committee chair to ensure that the Board is apprised of any material cybersecurity incident and consults with the Audit Committee chair in connection with any material decisions or actions related thereto.


text: Main Street and our Adviser maintain, and routinely review and evaluate their and the Company's information technology ("IT") and cybersecurity policies, practices and procedures (the "Cybersecurity Program"), which includes processes for assessing, identifying and managing material risks from cybersecurity threats. The Cybersecurity Program has various policies and procedures including a Cyber Incident Response Plan as part of Main Street's Crisis Management Plan. The Cybersecurity Program is administered by Main Street's IT Manager, who is managed on a day-to-day basis by Main Street's General Counsel and overseen by Main Street's IT Steering Committee consisting of Main Street's Chief Executive Officer, Main Street's Chief Operating Officer and Main Street's General Counsel. Main Street's General Counsel also serves as the crisis response team leader in connection with any material cybersecurity incident under the Cyber Incident Response Plan, with Main Street's Chief Operating Officer and Main Street's IT Manager also included on the crisis response team. Main Street and our Adviser also utilize the services of IT and cybersecurity advisers, consultants and experts in the evaluation and periodic testing of Main Street's IT and cybersecurity systems, to recommend improvements to the Cybersecurity Program and in connection with any cybersecurity incident. Main Street's IT Manager has over 10 years of experience advising on and managing risks from cybersecurity threats as well as developing and implementing cybersecurity systems, policies and procedures. Main Street's General Counsel has served in his oversight function as General Counsel for over 16 years and previously as Main Street's Chief Compliance Officer for over 12 years, during which time he has gained expertise in assessing and managing risk applicable to the Company. Similarly, each of Main Street's Chief Executive Officer and our Main Street's Chief Operating Officer have served in various executive management roles at the Company and, in the case of our Main Street's Chief Operating Officer, other publicly traded organizations, involving extensive oversight and management of risks, including cybersecurity related risks, for over 20 years.


text: Oversight of risks relating to IT and cybersecurity has been delegated by our Board to its Audit Committee. The Audit Committee includes members of the Board who, in addition to each being designated as an "audit committee financial expert," possess backgrounds and experience which we believe enable them to provide effective oversight of our IT and cybersecurity risks. Our management routinely reports to the Audit Committee on the status of the Cybersecurity Program and material risks from cybersecurity threats at the Audit Committee's quarterly meetings. Such reports generally detail any testing, observations or developments concerning the Cybersecurity Program that occurred during the prior quarter. The results of periodic testing related to the Cybersecurity Program are also described in the Chief Compliance Officer's annual report to the Board, provided pursuant to Rule 38a-1 under the 1940 Act. The crisis response team leader also collaborates with the Audit Committee chair to ensure that the Board is apprised of any material cybersecurity incident.


text: Cybersecurity Risk Management and Strategy We maintain an information security program that seeks to comply with applicable regulatory requirements. The information security team, led by the Chief Information Security Officer ("CISO"), implements appropriate measures designed to safeguard sensitive information and protect our operations and systems against cyber threats. The information security team carries out continuous monitoring and evaluation of Voya's technology and digital infrastructure with the goal of identifying and assessing threats and proactively mitigating potential risks. The CISO and the information security team provide regular updates to Voya's senior management, as further described under Cybersecurity Governance below.

companyName: Voya Financial, Inc.

ticker: VOYA


text: In addition, as part of its risk management strategy, Voya has an established and integrated cybersecurity incident response plan that focuses on incident detection, management and response. The information security team periodically reviews and updates the plan and tests playbooks within the plan through tabletop exercises.


text: Voya's information security team is responsible for identifying, assessing, and managing cyber risk, with support from Voya's operational risk management team. Information security control tasks are performed under the direction and guidance of the CISO, who is designated under Voya's risk management principles and policies to oversee the evaluation and mitigation of information security risks. Information security management is integrated into Voya's overall risk management framework, which provides for a coordinated approach to addressing cybersecurity risk.


text: As part of Voya's overall information security program, we may engage and retain external assessors and consultants to help improve our security, stay aligned with industry best practices, evaluate external threats and, on an as-needed basis, perform forensic reviews of cybersecurity-related incidents or independent security assessments.


text: With regard to risks posed by third-party vendors and service providers, Voya has a dedicated team that is responsible for evaluating, assessing, and addressing those risks, with the ultimate goal of protecting sensitive information and the security of our operations and systems supported by those vendors and providers using a risk-based approach. This team conducts due diligence on third-party vendors and service providers, including evaluating their information security controls and related measures, to identify potential risks and implement appropriate controls.


text: Technology risks, including cybersecurity threats, undergo a thorough risk management assessment. We evaluate risks quantitatively and qualitatively to determine both the probability and potential severity of such risks and whether any such risks could materially affect Voya. We have experienced and may continue to experience cybersecurity incidents and threats that could materially affect our business strategy, results of operations or financial condition. There have been no known cybersecurity incidents that have materially affected us in the past three years. For more information about the cybersecurity related risks that we face, see Interruption or other operational failures in telecommunication, cybersecurity, information technology and other operational systems, including as a result of human and process error or a failure to maintain the security, integrity, confidentiality, or privacy of such systems, could harm our business in Risk Factors in Item 1A of this Annual Report on Form 10-K.


text: Cybersecurity Governance As detailed above, the CISO and the information security team regularly assess and manage cybersecurity risks. Voya's information security leadership team has extensive information technology and information security experience, and the full team comprises over 100 employees with over 150 certifications from leading information security certification organizations. Additional management of cybersecurity risks is conducted by Voya's Technology and Operational Risk Committee ("TORC"), which has been delegated authority by Voya's Management Risk Committee to provide oversight of operational risk, including information and technology risk, as well as related legal, compliance and regulatory risks. Members of the TORC include senior management with relevant expertise in operations, technology, information security, legal, compliance, data privacy and operational risk management. The information security team participates in the TORC meetings to discuss cybersecurity risks and mitigation treatment. The TORC provides guidance and direction in assessing, addressing, mitigating and monitoring cybersecurity risks within Voya.


text: Voya's Board committees include the Technology, Innovation and Operations ("TIO") Committee, which provides support to the Board in its oversight of information technology, including cybersecurity risks. In addition, the TIO Committee supports the Audit Committee in reviewing cybersecurity risks and disclosures thereof, and collaborates with both the Audit Committee and the Risk, Investment and Finance ("RIF") Committee of the Board to oversee material risks. Management, including the CISO, regularly updates the TIO Committee on cybersecurity-related matters.


text: Cybersecurity Governance As detailed above, the CISO and the information security team regularly assess and manage cybersecurity risks. Voya's information security leadership team has extensive information technology and information security experience, and the full team comprises over 100 employees with over 150 certifications from leading information security certification organizations. The CISO, who oversees the organization supporting the day-to-day operations of our information security program, brings over 30 years of professional IT experience in financial services. Before assuming his current role, the CISO served as Voya's Chief Technology Officer, where he was responsible for our infrastructure, cloud, and business resiliency office. Additional management of cybersecurity risks is conducted by Voya's Technology and Operational Risk Committee ("TORC"), which has been delegated authority by Voya's Management Risk Committee to provide oversight of operational risk, including information and technology risk, as well as related legal, compliance and regulatory risks. Members of the TORC include senior management with relevant expertise in operations, technology, information security, legal, compliance, data privacy and operational risk management. The information security team participates in the TORC meetings to discuss cybersecurity risks and mitigation treatment. The TORC provides guidance and direction in assessing, addressing, mitigating and monitoring cybersecurity risks within Voya.


text: Voya's Board committees include the Risk Committee, which provides support to the Board in its oversight of information technology, including cybersecurity risk. To assist the Board in fulfilling its oversight function, the Risk Committee is responsible for overseeing cybersecurity risk and collaborates with the Audit Committee on the related disclosures. The Risk Committee receives regular updates from the CISO on cybersecurity-related matters and reports regularly to the full Board.


text: Risk Management and Strategy We understand the importance of preventing, assessing, identifying, and managing material risks associated with cybersecurity threats. Processes designed to assess, identify and manage risks from cybersecurity threats have been incorporated as a part of the Company's overall risk assessment process. On a regular basis we implement into our operations these processes, technologies, and controls to assess, identify, and manage material risks. Specifically, we engage a third-party cybersecurity firm to assist with network and endpoint monitoring, cloud system monitoring and assessment of our incident response procedures. Further, we employ periodic penetration testing and tabletop exercises to inform our risk identification and assessment of material cybersecurity threats.

companyName: Independence Contract Drilling, Inc.


text: To manage our material risks from cybersecurity threats and to protect against, detect, and prepare to respond to cybersecurity incidents, we undertake the below listed activities: a. Monitor emerging data protection laws and implement changes as necessary; b. Conduct periodic customer data handling and use requirement training for our employees;


text: c. Utilize third-party systems and processes that continually monitor our systems to prevent, detect and remediate cyber security threats and events; d. Conduct annual cybersecurity management training for employees with access to our systems and processes that handle sensitive data;


text: e. Conduct regular phishing email simulations for employees; and f. Carry cybersecurity risk insurance that provides protection against the potential losses arising from a cybersecurity incident.


text: Our incident response plan coordinates the activities that we and, as applicable, our third-party cybersecurity providers may take to prepare, respond and recover from cybersecurity incidents, which include processes to triage, assess severity, investigate, escalate, contain, and remediate an incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage.


text: As part of the above processes, we have engaged with consultants to review our cybersecurity program to help identify areas for continued focus, improvement, and compliance.


text: Our processes also include assessing cybersecurity threat risks associated with our use of third-party services providers in normal course of business use, including those in our supply chain or who have access to our customer and employee data or our systems. In addition, we assess cybersecurity considerations in the selection and oversight of our third-party services providers, including due diligence on the third parties that have access to our systems and facilities that house systems and data.


text: We describe whether and how risks from identified cybersecurity threats have or are reasonably likely to materially affect our financial position, results of operations and cash flows, under the heading "Information technology failures and cybersecurity breaches could harm our business" included as part of our Item 1A. Risk Factors of this Annual Report on Form 10-K, which disclosures are incorporated by reference herein.


text: Our Audit Committee of the Board of Directors is responsible for oversight of our risk assessment, risk management, disaster recovery procedures and cybersecurity risks. Periodically during each year, the Audit Committee receives an overview from our cybersecurity risk management team, comprised of our Chief Financial Officer, our Chief Accounting Officer and our Director of IT, of our cybersecurity threat risk management and strategy processes, including potential impact on the Company, the efforts of management to manage the risks that are identified and our disaster recovery preparations. Members of the Board of Directors engage in discussions with management on cybersecurity-related news events and discuss certain updates to our cybersecurity risk management and strategy programs.


text: Our cybersecurity risk management and strategy processes are led by our cybersecurity risk management team. Our Director of IT has over 30 years of experience in various roles involving managing information security, developing cybersecurity strategy, and implementing cybersecurity programs. The Director of IT is informed about and monitors the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of the cybersecurity risk management and strategy processes, including our incident response plan.


text: Risk Management Strategy Our business is dependent upon our information technology ("IT") systems, devices and networks to collect, process and store the data necessary to conduct our business and record and report our business and financial information. We recognize the importance of developing, implementing, and maintaining effective cybersecurity measures to safeguard our IT systems and protect the confidentiality, integrity, and availability of our confidential and personal data, including with respect to our customers, suppliers, and employees, as well as our intellectual property. TECOGEN INC.

companyName: TECOGEN INC.

ticker: TGEN


text: We maintain a cybersecurity risk management program to identify, assess, manage, mitigate, and respond to cybersecurity threats. Our cybersecurity risk management program incorporates various mechanisms to detect and monitor unusual network activity, as well as containment and incident response tools. We monitor issues that are internally discovered or externally reported that may affect our business and have processes to assess those issues for potential cybersecurity impact or risk.


text: We have integrated our cybersecurity risk management program into our broader enterprise risk management program. This integration is designed to make cybersecurity considerations an integral part of our decision-making processes at every level and we believe that this integration allows cybersecurity risks to be evaluated and addressed in alignment with our business objectives and operational needs. While we work to maintain our information security program and risk management efforts, there can be no assurance that such actions will be sufficient to prevent cybersecurity incidents or mitigate all potential risks to our systems, networks, and data or those of our third-party providers.


text: We rely on suppliers that are also exposed to ransomware and other malicious attacks that can disrupt business operations. Although we take steps to secure confidential information that is provided to or accessible by third parties, such measures may not always be effective and losses or unauthorized access to, or releases of, confidential information occur. Such incidents and other malicious attacks could materially adversely affect our business, reputation, results of operations and financial condition.


text: We have experienced malicious attacks and other attempts to gain unauthorized access to our systems, including a ransomware attack on our computer network which occurred on April 28, 2023. Following remediation, our network returned to full operation on May 1, 2023.


text: We have engaged a third-party consultant in connection with our risk management and assessment processes. Our consultant assists us in the design and implementation of our cybersecurity policies and procedures, as well as the monitoring and testing of our safeguards. In the event of an incident, our incident response plan outlines the steps to be followed from incident detection to mitigation, recovery and notification, and involves notifying senior management, our legal department, and the board of directors and/or our audit committee, if appropriate, and mitigation and remediation steps by our third-party consultant.


text: Our board of directors has overall responsibility for informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure. Our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors has delegated to our audit committee its cybersecurity risk oversight processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our audit committee receives periodic reports from management regarding our cybersecurity risks and is notified of any significant cybersecurity threat or incident. The audit committee reports to the board of directors regarding its activities, including with respect to cybersecurity matters and the occurrence of any material cybersecurity incident, if appropriate.


text: We have engaged a third-party consultant to manage risks associated with network protection and workstation management. Our consultant performs an annual assessment of our cybersecurity risk policies and procedures.


text: Risk Management Strategy Our business is dependent upon our information technology ("IT") systems, devices and networks to collect, process and store the data necessary to conduct our business and record and report our business and financial information. We recognize the importance of developing, implementing, and maintaining effective cybersecurity measures to safeguard our IT systems and protect the confidentiality, integrity, and availability of our confidential and personal data, including with respect to our customers, suppliers, and employees, as well as our intellectual property.


text: We maintain a cybersecurity risk management program to identify, assess, manage, mitigate, and respond to cybersecurity threats. Our cybersecurity risk management program incorporates various mechanisms to detect and monitor unusual network activity, as well as containment and incident response tools. We monitor issues that are internally discovered or externally reported that may affect our business and have processes to assess those issues for potential cybersecurity impact or risk. TECOGEN INC.


text: We have engaged a third-party consultant in connection with our risk management and assessment processes. Our consultant assists us in the design and implementation of our cybersecurity policies and procedures, as well as the monitoring and testing of our safeguards. In the event of a cybersecurity incident, our incident response plan outlines the steps to be followed from incident detection to mitigation, recovery and notification, and involves notifying senior management, our legal department, and the board of directors and/or our audit committee, if appropriate, and mitigation and remediation steps by our third-party consultant.


text: Our cybersecurity risk management and strategy processes are jointly led by our embedded software engineer and Chief Executive Officer, in conjunction with a third-party consultant we have engaged to assist with cybersecurity risks assessment and monitoring. Our embedded software engineer is informed about and monitors the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of the cybersecurity risk management and strategy processes described above, including our incident response plan. Together with the General Counsel, Chief Executive Officer and outside consultant that comprise our cybersecurity management team, we collectively possess significant experience in evaluating, managing, and mitigating security and other risks, including cybersecurity risks. Our embedded software engineer possesses significant information systems experience.


text: We recognize the critical importance of maintaining the trust and confidence of customers, contractors, commercial partners, vendors, consultants and employees toward our business and are committed to protecting the confidentiality, integrity and availability of our business operations and systems. Our board of directors is actively involved in oversight of our risk management activities, and cybersecurity represents an important element of our overall approach to risk management. Our cybersecurity policies, standards, processes and practices are based on recognized frameworks established by the National Institute of Standards and Technology, or NIST and other applicable industry standards. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: NexImmune, Inc.

ticker: NEXI


text: Cybersecurity Risk Management and Strategy; Effect of Risk We face risks related to cybersecurity such as unauthorized access, cybersecurity attacks and other security incidents, including as perpetrated by hackers and unintentional damage or disruption to hardware and software systems, loss of data, and misappropriation of confidential information. To identify and assess material risks from cybersecurity threats, we maintain a comprehensive cybersecurity program to ensure our systems are effective and prepared for information security risks, including regular oversight of our programs for security monitoring for internal and external threats to ensure the confidentiality and integrity of our information assets. We consider risks from cybersecurity threats alongside other company risks as part of our overall risk assessment process. We employ a range of tools and services, including regular network and endpoint monitoring, audits, vulnerability assessments, penetration testing, threat modeling and tabletop exercises to inform our risk identification and assessment. As discussed in more detail under "Cybersecurity Governance" below, our board of directors provides oversight of our cybersecurity risk management and strategy processes, which are led by our Vice President, Corporate Controller.


text: We also identify our cybersecurity threat risks by comparing our processes to standards set by the NIST, as well as by engaging experts to attempt to infiltrate our information systems. To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and protect against and respond to cybersecurity incidents, we undertake the following activities: • monitor emerging data protection laws and implement changes to our processes that are designed to comply with such laws; • through our policies, practices and contracts (as applicable), require employees, as well as third parties that provide services on our behalf, to treat confidential information and data with care; • employ technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls; • conduct cybersecurity management and incident training for employees involved in our systems and processes that handle sensitive data; • leverage the NIST incident handling framework to help us identify, protect, detect, respond and recover when there is an actual or potential cybersecurity incident; and • carry information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident.


text: Our incident response plan coordinates the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate damage to our business and reputation. As part of the above processes, we rely on internal resources rather than consultants, auditors or other third parties, to review our cybersecurity program.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Our internal computer systems, or those used by our third-party research institution collaborators, CROs or other contractors or consultants, may fail or suffer security breaches," which disclosures are incorporated by reference herein.


text: Cybersecurity Governance; Management Cybersecurity is an important part of our risk management processes and an area of focus for our board of directors and management. In general, our board of directors oversees risk management activities designed and implemented by our management, and considers specific risks, including, for example, risks associated with our strategic plan, business operations, and capital structure. Our board of directors executes its oversight responsibility for risk management both directly and through delegating oversight of certain of these risks to its committees.


text: Upon detection of a material cybersecurity threat, our board of directors receives an update from management of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, our board of directors generally receives materials that include cybersecurity materials discussing current material cybersecurity threat risks, and describing our ability to mitigate those risks, and discusses such matters with our Chief Executive Officer. Our board of directors receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds.


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Vice President, Corporate Controller and supported by consultants with experience in managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs as needed. These management team members are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. As discussed above, these management team members report to our board of directors about material cybersecurity threat risks.


text: There continues to be a rise in electronic fraudulent activity, security breaches and cyber-attacks within the financial services industry, especially in the commercial banking sector where our operations rely on the secure processing, storage and transmission of confidential and other information in our computer systems and networks. Although we are not aware that we have experienced any material misappropriation, loss or other unauthorized disclosure of confidential or personally identifiable information as a result of a cybersecurity breach or other act, we are regularly the target of attempted threats such as ransomware and denial-of-service attacks. In addition, our customers, vendors and other third-parties also face the same threats, and a cybersecurity incident impacting any of these parties could also impact our operations. For these reasons, cybersecurity is critical to supporting our business and protecting our customers.

companyName: HomeTrust Bancshares, Inc.

ticker: HTB


text: Our Chief Technology Officer is responsible for monitoring and coordinating the Company's Information Security Program, which is managed on a day-to-day basis by our Information Security Officer. This program has been designed to: • Ensure appropriate security of all information systems data, equipment and processes; • Ensure the security and confidentiality of nonpublic customer information; • Protect against any anticipated threats or hazards; and • Protect against unauthorized access to, or use of, such information.


text: Operationally, the information security team employs numerous security tools such as threat detection, alerting and monitoring, data loss prevention, vulnerability remediation, anti-malware and email security protections. Consistent with our Business Continuity and Security Incident Response Policies, the Company engages in annual disaster recovery and information security tabletop exercises to simulate threats and events, and engages third-parties on an annual basis to conduct and report on penetration testing exercises. We administer mandatory annual security awareness training, routine employee email phishing testing, and provide regular updates across the Company to highlight recent examples of risks as they are identified.


text: Our Board of Directors is responsible for overseeing the Company's cybersecurity strategies and setting the acceptable cybersecurity risk appetite as part of its oversight of the Company's risk management activities. The Board has designated the Executive and Risk Committee to oversee the Company's Enterprise Risk Management Program, which includes the framework for identifying, measuring, monitoring and controlling cybersecurity risk. Between updates provided by the Chief Technology Officer and Chief Risk Officer, who leads the Company's Enterprise Risk Management function, the Committee receives quarterly updates over assessed internal and external risks, cyber threats, industry trends in the cyber area, security operations and incident response, threat and vulnerability management activities, identity and access management controls, and the results of third-party audits and examinations. To ensure this focus is properly disseminated, the Enterprise Risk Management Program includes a Management Risk Committee, made up of executive officers, to ensure proper oversight of risk-related decision making and communication by executive management. In addition to internal monitoring procedures, the Company maintains a vendor risk management program that is designed to identify and manage risks, including cybersecurity risks, posed by our third-party vendors, particularly those with access to, or possession of, sensitive information. Vendor contract negotiations require the inclusion of data protection terms and responsibilities regarding information breach notifications and reporting. The program also includes due diligence and risk assessment procedures occurring prior to and during the life of these contractual relationships, to evaluate the vendor's management of data transmission, storage of information, encryption practices, vulnerability testing and general strength of the vendor's information security policy and practices. Additionally, the Company uses a continuous vendor monitoring solution to monitor third-party cyber risk, delivering risk-prioritized action plans customized to match the Company's risk appetite.


text: The Company's information security team has a defined escalation path for issues and events as outlined in our Security Incident Response Policy. Our Chief Technology Officer, along with teams from information security, IT infrastructure, IT support, and system analysts, will take the lead role in evaluating, escalating, investigating and remediating a potential cybersecurity event, including formulating the initial response and bringing in individuals from other departments as deemed appropriate. Any incident assessed as potentially being or becoming material is further escalated to the Operating Committee which includes all executive officers and may be elevated to the Board of Directors if the incident is deemed material or otherwise appropriate. Outside legal counsel and forensic analysts may also be engaged to assist in evaluating and remediating cybersecurity issues and events.


text: In spite of the Company's investments in systems and processes to address cyber risk, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material effect on the Company. For further discussion, see "Item 1A. Risk Factors – Risks Related to Cybersecurity, Data and Fraud."


text: Risk Management and Strategy Our cybersecurity risk management process is aligned with our enterprise risk management framework and policy. This allows us to assess, identify, and manage material risks arising from cybersecurity threats. As part of our integrated approach to risk management, and to help safeguard the confidentiality, integrity and availability of our data and systems, we maintain a comprehensive cybersecurity program that is comprised of administrative and technical controls, cybersecurity, technology and privacy policies and procedures, management oversight, accountability structures, and technology design processes (collectively, our "Cybersecurity Program").

companyName: Oportun Financial Corp

ticker: OPRT


text: We monitor our environment using tools designed to detect security events on an ongoing basis and we engage with third parties to audit our information security program and to perform regular penetration tests of our applications and infrastructure environments. In addition, our third-party risk management program oversees and identifies service provider risks through pre-onboarding security evaluations, ongoing monitoring, and conducting regular reassessments, with an emphasis on those service providers that have access to our systems or networks or that receive or store non-public information. Any risks identified by or to us through these activities are reported in an internal risk register and actively managed. We work to remain vigilant with respect to new and emerging risks utilizing these tools, and our security team continues to review and make strategic investments in our information security program in support of our efforts to keep our data and systems secure.


text: The Cybersecurity Program includes a cyber incident response plan that provides controls and procedures designed to enable swift response, remediation, and timely and accurate reporting of any material cybersecurity incident.


text: We also maintain an internally staffed cybersecurity operation center, which performs security monitoring and is directly responsible for our efforts to monitor, prevent, and detect cybersecurity incidents, as well as for appropriate and timely escalations concerning cybersecurity incidents that are discovered. Under our Cybersecurity Program, identified cybersecurity events and incidents are reported to our dedicated incident response team, which includes various members of our legal and compliance teams, cybersecurity team, relevant business teams, executive management, and, as warranted, our third-party security, audit, and consulting partners. Our program also retains an external third-party firm to activate as a supplement in the event of a significant security incident.


text: To promote organization-wide attention to cybersecurity issues, we conduct mandatory employee training on cybersecurity and provide ongoing cybersecurity education and awareness, such as mock phishing attacks, incident simulations, and cybersecurity awareness materials.


text: As delegated by our Board, the Audit and Risk Committee of the Board is responsible for oversight of our risk management process and framework which is designed to monitor and manage strategic and operational risks, including cybersecurity risk. Our senior management, including our Chief Information Security Officer (CISO), is responsible for oversight of our Cybersecurity Program, and maintains responsibility for the regular assessment and management of cybersecurity risks, including by direct work implementing the Cybersecurity Program and by supervising our cybersecurity team. Our Cybersecurity Program is further supported by our cybersecurity governance, risk and compliance team, which is led by our CISO, and is composed of experienced and skilled personnel who are responsible for our security assurance, risk and operational management. Our CISO has over 24 years of experience in cybersecurity, business leadership, investigations, compliance, and cyber-risk management, within the high-tech and financial services industries.


text: Our CISO provides the Audit and Risk Committee with no less than quarterly updates on the status of the Cybersecurity Program, information systems and any material security incidents, or more frequently if circumstances warrant, including on topics related to information security, data privacy and cyber risks and mitigation strategies.


text: Like most technology companies, we have suffered cybersecurity incidents in the past, and expect that we may face cybersecurity incidents in the future. As of the date of this report on Form 10-K, however, we have not identified risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. For additional information about the cybersecurity risks that we face, please see the discussion in Item 1A. "Risk Factors" in this annual report on Form 10-K, including the risk factor entitled "Business, Financial and Operational Risks; Security breaches and incidents may harm our reputation, adversely affect our results of operations, and expose us to liability."


text: Risk Management and Strategy Our cybersecurity risk management process is aligned with our enterprise risk management framework and policy, which supports our efforts to identify, assess, and manage risks arising from cybersecurity threats. As part of our integrated approach to risk management, and to help safeguard the confidentiality, integrity and availability of our data and systems, we maintain a comprehensive cybersecurity program that is comprised of administrative and technical controls, cybersecurity, technology and privacy policies and procedures, management oversight, accountability structures, and technology design processes (collectively, our "Cybersecurity Program").


text: Our Cybersecurity Program includes a cyber incident response plan that provides controls and procedures designed to enable swift response, remediation, and timely and accurate reporting of any material cybersecurity incident.


text: As delegated by our Board, the Audit and Risk Committee of the Board is responsible for oversight of our risk management process and framework which is designed to monitor and manage strategic and operational risks, including cybersecurity risk. Our senior management, including our Chief Technology Officer, is responsible for the oversight of our information systems and Cybersecurity Program. Our Cybersecurity Program is supported by our cybersecurity governance, risk and compliance team, which is led by our Head of Cybersecurity, who reports to our Chief Technology Officer, and is composed of experienced and skilled personnel who are responsible for our security assurance, risk and operational management. Our Head of Cybersecurity maintains responsibility for the regular assessment and management of cybersecurity risks, including by direct work implementing the Cybersecurity Program and by supervising our cybersecurity team. Our Chief Technology Officer has over 20 years of experience in information technology and systems infrastructure and holds an advanced degree in computer engineering, and our Head of Cybersecurity has over 12 years of experience in cybersecurity, investigations, compliance, and cyber-risk management, within the high-tech and financial services industries.


text: Our Chief Technology Officer, Chief Legal Officer and Head of Cybersecurity provide the Audit and Risk Committee with no less than quarterly updates on the status of the Cybersecurity Program, information systems and any material security incidents, or more frequently if circumstances warrant, including on topics related to information security, data privacy and cyber risks and mitigation strategies.


text: Like most technology companies, we have suffered cybersecurity incidents in the past and expect that we may face cybersecurity incidents in the future. As of the date of this report on Form 10-K, however, we have not identified risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. For additional information about the cybersecurity risks that we face, please see the discussion in Item 1A. "Risk Factors" in this annual report on Form 10-K, including the risk factor entitled "Business, Financial and Operational Risks; Security breaches and incidents may harm our reputation, adversely affect our results of operations, and expose us to liability."


text: Cybersecurity risk management is integrated into the Company's enterprise-wide risk management. Our Board has overall oversight responsibility for our risk management and management is responsible for identifying, considering, and assessing material risks to the Company.

companyName: NIOCORP DEVELOPMENTS LTD

ticker: NB


text: Our Chief Financial Officer is responsible for assessing and managing cybersecurity risks; however, as a smaller reporting company, we currently do not have a dedicated cybersecurity team. Our Chief Financial Officer reports to the Board regarding financial and operating risks, including cybersecurity risks. Our Chief Financial Officer has experience in managing public companies and assessing financial and operating risks.


text: cybersecurity risk management is designed to provide a framework for assessing, identifying, and managing material risks from cybersecurity threats and to respond to cybersecurity incidents, including material risks associated with the use of services provided by third-party service providers. We rely on the cybersecurity protections of many of our third-party service providers. Our primary third-party service providers utilize two-factor authentication as well as login and password protections with email verifications.


text: For the year ended June 30, 2024, the Company had no material cybersecurity incidents or cybersecurity threats that have materially affected or were reasonably likely to materially affect our business strategy, results of operations or financial condition. Despite our efforts, we cannot eliminate all risks from cybersecurity threats or provide assurances that we have not experienced an undetected cybersecurity incident.


text: presently do not have any substantial activities that require cybersecurity strategies; however the following will be adopted once we begin operations: recognize that cybersecurity risks pose a significant threat to the confidentiality, integrity and availability of our information systems, and to our ability to execute on our business strategy and protect stakeholder interests. Our approach to cybersecurity is anchored in formal policies, robust controls, ongoing risk assessment and clear governance structures.

companyName: ALEXANDER TECH CORP


text: sole director, who also serves as our Chief Executive Officer and Chief Financial Officer, has ultimate responsibility for cybersecurity oversight. This individual: Reviews our cybersecurity program and risk profile at least quarterly. Approves our cybersecurity policies, standards and incident response procedures; and Monitors management's implementation of recommended improvements.


text: cybersecurity program is designed to align with industry's best practices, including the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). Key elements include: Regular risk assessments and vulnerability scans across our network and cloud environments. Formal policies covering access control, data protection, encryption, system configuration and change management. Tiered security controls (e.g., firewalls, endpoint protection, multi-factor authentication) to guard against unauthorized access.


text: Security awareness training for all personnel, with annual refreshers and real-time phishing simulations; and Third-party vendor assessments to ensure service providers meet our cybersecurity requirements. Response, Monitoring and Detection maintain a documented incident response plan detailing roles, responsibilities, communication protocols and escalation paths. We deployed continuous monitoring tools and log-management platforms to detect anomalous activity;


text: We conducted at least two tabletop exercises simulating a breach scenario and tested our response readiness; and We established notification procedures to comply with applicable laws and to inform affected stakeholders promptly in the event of an incident.


text: Risks and Outlook we have not experienced any material cybersecurity incidents during the fiscal year ended April 30, 2025, we acknowledge that evolving threats such as ransomware, social-engineering attacks and supply-chain vulnerabilities could materially disrupt our operations or expose sensitive information. We continue to: Invest in strengthening endpoint and network defenses;


text: Enhance logging, detection and response capabilities; and Revisit our risk assessments and incident response playbooks to address emerging threat vectors.


text: believe our cybersecurity governance, risk management processes and incident response program provide a strong foundation for managing risks, but no cybersecurity program can eliminate all risks entirely. We will continue to evolve our defenses in line with industry developments and regulatory expectations.


text: risk management is integrated into the Company's enterprise-wide risk management. Our Board has overall oversight responsibility for our risk management and management is responsible for identifying, considering, and assessing material risks to the Company.


text: cybersecurity risk management is designed to provide a framework for assessing, identifying, and managing material risks from cybersecurity threats and to respond to cybersecurity incidents, including material risks associated with the use of services provided by third-party service providers. We rely on the cybersecurity protections of many of our third-party service providers.


text: Our primary third-party service providers utilize two-factor authentication as well as login and password protections with email are in the process of evaluating our cybersecurity needs and developing appropriate measures to enhance our cybersecurity posture.


text: Our goal is to establish a cybersecurity framework that is commensurate with our size, complexity, and nature of our operations.


text: the year ended June 30, 2025, the Company had no material cybersecurity incidents or threats that have materially affected or were reasonably likely to materially affect our business strategy, results of operations or financial condition. Despite our efforts, we cannot eliminate all risks from cybersecurity threats or provide assurances that we have not experienced an undetected cybersecurity incident. As previously disclosed, on February 14, 2025, we became aware of unauthorized third-party access to our information systems, including portions of its email systems, that resulted in misdirected vendor payments. To date, the Cybersecurity Incident has not had a material impact on our business operations or financial condition.


text: Cybersecurity Risk Management Strategy We have implemented and invested in, and will continue to implement and invest in, controls, procedures and protections (including internal and external personnel) that are designed to protect our systems, identify and remediate on a regular basis vulnerabilities in our systems and related infrastructure and monitor and mitigate the risk of data loss and other cybersecurity threats. We have engaged third-party consultants to conduct penetration testing and risk assessments. Our cybersecurity program is informed by the National Institute of Standards and Technology ("NIST") Cybersecurity Framework and measured by the Maturity and Risk Assessment Ratings associated with the NIST Cybersecurity Framework and the Capability Maturity Model Integration.

companyName: Diamondback Energy, Inc.

ticker: FANG


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (i) our cybersecurity risk assessment processes, (ii) our security controls, and (iii) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test, train or otherwise assist with aspects of our security controls; • security tools deployed in the IT environment for protection against and monitoring for suspicious activity; • cybersecurity awareness training of our employees, including incident response personnel and senior management; • cybersecurity tabletop exercises for members of our cybersecurity incident response team and legal department; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.