text: It is our organization's aim to comply with all cybersecurity and data privacy laws and regulations in applicable jurisdictions. Additionally, we are committed to meeting national and international standards and best practices for our industry for effective cybersecurity risk management of the organization's confidential information and critical IT infrastructure. Our cybersecurity and data protection policies, standards, processes and practices are based on recognized frameworks established by the National Institute of Standards and Technology, or "NIST", and other applicable industry standards and frameworks such as HITRUST and SOC 2. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, integrity, and availability of the data that we collect and store, and information systems and technologies through which that data is processed, by identifying, preventing and mitigating cybersecurity threats, and effectively responding to cybersecurity incidents when they occur. Our organization's internal administrative, technical, and physical security measures (controls) are tested for compliance to these frameworks and reviewed annually. The domains and controls associated with these frameworks are tested and reviewed annually. Certifications of compliance, and/or Auditor's 'Letters of Opinion' Attestation of Compliance from the applicable auditors are provided once the audits are completed each year.


text: The status of our cybersecurity program is regularly reported to our organization's board of directors. Our board of directors is actively involved in oversight of our cybersecurity risk management activities, and cybersecurity represents an important element of our organization's overall approach to risk management in the pursuit of its business goals and objectives.

companyName: Hyperfine, Inc.

ticker: HYPR

secItem: Item 1C


text: Cybersecurity Risk Management and Strategy; Effect of Risk We face risks related to cybersecurity such as unauthorized access, cybersecurity attacks and other security incidents, including as perpetrated by hackers and unintentional damage or disruption to hardware and software systems, loss of data, and misappropriation of confidential information. To identify and assess material risks from cybersecurity threats, we maintain a comprehensive cybersecurity program to ensure our data and information systems are effectively secured and prepared for information security risks by internal and external threat actors. Our program involves regular monitoring of our internal IT assets, data inventories, and potential security exploits and/or threats to those assets' confidentiality, integrity, and availability. We employ a range of technical security tools and external security services, including regular network and endpoint monitoring, compliance audits, vulnerability assessments, penetration testing, threat modeling and tabletop exercises to inform our risk posture, remediation plans and cybersecurity investments.


text: We consider risks from cybersecurity threats alongside other company risks as part of our overall risk assessment process. As discussed in more detail under "Cybersecurity Governance" below, our board of directors and our audit committee provide oversight of our cybersecurity risk management and strategy processes, which are led by our Chief Compliance Officer, Chief Administrative Officer, Chief Operating Officer, Security Officer, Data Protection Officer, Senior Director of Cybersecurity and IT, and Governance Risk and Compliance Manager.


text: We also identify our cybersecurity threat risks by comparing our processes to standards established by the HITRUST and SOC2 frameworks and any findings resulting from penetration testing and threat modeling conducted by third party service providers. To provide for the confidentiality, integrity, and availability of critical data and information systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and protect against and respond to cybersecurity incidents, we undertake the following internal security measures: • maintain a cybersecurity program through formally-defined documented policies, standards, processes, and procedures to ensure internal security measures are implemented to protect against cybersecurity threats, to assess emerging cybersecurity and data privacy laws, and to implement changes to our processes that are designed to comply with laws applicable to our organization; • implement policies and procedures to identity organizational assets, data and critical IT systems, assess (and periodically re-assess) those assets, data, and systems for cybersecurity risks, and to develop management plans for identifying and remediating identified risks; • through our policies, practices and contracts (as applicable), require employees, as well as third parties that provide services on our behalf, to handle confidential data and systems in a legally compliant and acceptable manner; • employ technical security tools that are designed to protect our critical data and information systems from cybersecurity threats, including network firewalls and access controls, vulnerability scanners, intrusion prevention and detection systems, anti-malware/endpoint protection systems, and identity and access management systems which are evaluated for effectiveness and improved through vulnerability assessments and cybersecurity threat intelligence; • provide quarterly, mandatory training for our employees regarding cybersecurity threats to equip them with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices; • implement administrative processes and procedures to define acceptable security parameters and baselines of IT assets and information systems, and utilize access controls to prevent unauthorized alterations to system parameters and to maintain oversight over configuration changes and modifications to those systems; • conduct third party security reviews of critical and high-risk third-party suppliers and vendors; • conduct quarterly phishing email simulations for all employees with access to our email systems to enhance awareness and responsiveness to possible threats; • conduct cybersecurity management and incident training for employees involved in our systems and processes that handle sensitive data; • run annual tabletop exercises to simulate a response to a cybersecurity incident and use the findings to improve our processes and technologies; • implement a formal Incident Response Plan, based upon NIST, HITRUST, and SOC2 frameworks, to help us identify, protect, detect, respond and recover when there is an actual or potential cybersecurity incident, which Incident Response Plan includes processes to triage, assess severity for, escalate, contain, investigate and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate damage to our business and reputation; and • carry information security risk insurance to insure against potential losses arising from a cybersecurity incident.


text: As part of the above processes, we regularly engage with consultants, auditors and other third parties, including annually having a third-party independent Risk Assessor review our cybersecurity program to help identify areas for continued focus, improvement, and compliance.


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including our suppliers, manufacturers and other third parties who have access to patient and employee data or our IT systems. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and we continually monitor cybersecurity threat risks identified through such diligence. Additionally, we generally require those third parties that could introduce significant cybersecurity risk to us to agree by contract to manage their cybersecurity risks in specified ways, and to agree to be subject to cybersecurity audits, which we conduct as appropriate.


text: We describe whether and how risks from identified cybersecurity threats have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading under Risk Factors titled "Security breaches, loss of data and other disruptions could compromise sensitive information related to our business or prevent us from accessing critical information and expose us to liability, which could adversely affect our business and our reputation", which disclosures are incorporated by reference herein.


text: In the last two fiscal years, we have not experienced any material cybersecurity incidents and any expenses we have incurred from cybersecurity incidents were immaterial. This includes penalties and settlements, of which there were none. As needed, we will contract a professional cybersecurity investigation firm to conduct a full forensic analysis of any suspected material incident. To date, we have concluded that there has not been any evidence of material concern involving malware, persistence mechanisms or other compromised exchange of on-premises accounts within the Company's environment.


text: At least quarterly, our audit committee receives an update from management of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. Our audit committee generally receives materials that include a cybersecurity scorecard and other materials discussing current and emerging material cybersecurity threat risks, and describing our ability to mitigate those risks, as well as recent developments, evolving standards, technological developments and information security considerations arising with respect to our peers and third parties, and discusses such matters with our Chief Compliance Officer, Chief Administrative Officer, Chief Operating Officer, Security Officer, Data Protection Officer, Senior Director of Cybersecurity and IT, and Governance Risk and Compliance Manager. Our audit committee also receives prompt and timely information regarding any material cybersecurity incident that meets reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.


text: Members of our audit committee are also encouraged to regularly engage in conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs. Material cybersecurity threat risks are also considered during separate board meeting discussions of important matters like enterprise risk management, operational budgeting, business continuity planning, mergers and acquisitions, brand management, and other relevant matters.


text: Fidelity and its Enterprise Cybersecurity organization, on behalf of the Fund, have established a comprehensive risk management program, which includes processes to identify, assess, and manage cybersecurity risks, including material risks from cybersecurity threats, and to put in place appropriate controls to mitigate these risks and reduce the potential impact to the Fund and its shareholders. The Fund does not currently have any employees and relies upon Fidelity and its Enterprise Cybersecurity organization for the Fund's day-to-day operations and to establish strategies, policies, and standards for the security of, and operations in, cyberspace.

companyName: Fidelity Private Credit Co LLC


text: The Fund depends on and engages various third parties, including suppliers, vendors, and service providers, to operate its business. Through its vendor management program, and on behalf of the Fund, Fidelity oversees and identifies risks from cybersecurity threats associated with the use of third-party service providers. This vendor oversight program includes periodic reviews of the cybersecurity controls of third-party service providers, The frequency of such reviews is generally based on the nature of the Fund's information processed by the vendor and the vendor's criticality to business operations.


text: On behalf of the Fund, Fidelity engages third-party consultants to assess, identify, and/or manage material risks from cybersecurity threats. For example, Fidelity engages third-party consultants to perform audits of its cybersecurity measures and risk management processes, including those applicable to the Fund. Fidelity has also hired qualified independent assessors to review applicable security controls in accordance with the AICPA's System and Organization Controls assurance programs. Additionally, Fidelity utilizes third-party consultants with specific areas of cybersecurity expertise to review and report on various aspects of its cybersecurity program, including those applicable to the Fund. The results of these consulting engagements are shared with the Fund's Board of Directors as part of periodic reports.


text: The potential impact of risks from cybersecurity threats on the Fund are assessed on an ongoing basis, and how such risks could materially affect the Fund's business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, the Fund did not identify any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Fund, including its day-to-day operations, financial condition, and business strategies. In conjunction with Fidelity's Enterprise Cybersecurity, the Fund participates in regular testing of applicable incident response processes to ensure appropriate escalation, mitigation, communication and reporting processes are in place.


text: The Board provides strategic oversight regarding cybersecurity risks and threats. The Board receives and reviews periodic reports from senior executives in Fidelity's Enterprise Cybersecurity organization and the Fund's management, including Fidelity's Chief Information Security Officer ("CISO"), members of the CISO's staff and the Fund's CCO. These reports contain information about risks from cybersecurity threats, including the results of recent independent reviews of the cybersecurity program, summaries of recent cybersecurity threat intelligence assessments, progress on key initiatives and strategies, and updates on recent regulatory activities, including new regulations and examinations.


text: The Fund's management, including the CCO of the Fund, is responsible for assessing and managing material risks from cybersecurity threats. In connection with the Fund's reliance on Fidelity and its Enterprise Cybersecurity organization, the CCO relies on the cybersecurity expertise of Fidelity's CISO and members of the CISO's staff to assist in assessing and managing the Fund's material risks from cybersecurity threats. The CISO has over twenty years of experience in technology and information security and has served as Fidelity's CISO since May 2021. The CCO has been responsible for this oversight function as CCO to the Fund since the Fund's inception and has worked in the financial services industry for sixteen years, during which the CCO has gained expertise in assessing and managing risks applicable to the company.


text: Management of the Fund is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Fund, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, information technology, and/or compliance personnel of Fidelity. The Board is also made aware of material cybersecurity incidents which impacted the Fund.


text: On behalf of the Fund, Fidelity engages third-party consultants to assess, identify, and/or manage material risks from cybersecurity threats. For example, Fidelity engages third-party consultants to perform audits of its cybersecurity measures and risk management processes, including those applicable to the Fund. Fidelity has also hired qualified independent assessors to review applicable security controls in accordance with the AICPA's System and Organization Controls assurance programs. Additionally, Fidelity utilizes third-party consultants with specific areas of cybersecurity expertise to review and report on various aspects of its cybersecurity program, including those applicable to the Fund. The results of these consulting engagements are shared with the Fund's Board of Trustees as part of periodic reports.

companyName: Fidelity Private Credit Fund


text: The Company recognizes the security of our operations is critical to protecting our customers and maintaining the reputation of the Company. Management is committed to managing Information Security Risk, which includes cybersecurity, that may impact the Company. The Enterprise Risk Committee (ERC) of the Board of Directors provides oversight of the Company's written Information Security Management and Information Technology Governance Programs (the "Programs"). Through the Programs, the Company has established polices, processes, controls, and systems designed to identify, assess, measure, manage, monitor, and report risks related to cybersecurity and help prevent or limit the effect of possible cybersecurity threats and attacks. As cybersecurity threats continue to evolve, the Company expects to continue to monitor and enhance the current controls and systems in place to detect and prevent cybersecurity attacks and to remediate discovered vulnerabilities.

companyName: LAKE SHORE BANCORP, INC.


text: The Company's Information Security Officer (ISO) is responsible for the design and execution of the Information Security Management Program and the information and cyber security aspects of the Information Technology Governance Program. The ISO provides the ERC with regular reports on the status and effectiveness of the Programs and risk management activities, as well as cyber and information security issues that may affect the Company. In addition, the ISO regularly reports the status to Executive Management.


text: The Company utilizes the following guidelines and frameworks to develop and maintain the Information Security Management Program: Federal Financial Institutions Examination Council (FFIEC) Information IT Examination Handbooks, FFIEC Cybersecurity Assessment Tool (CAT), Center for Internet Security Critical Security Controls, National Institute of Standards and Technology Special Publication 800 Series, National Institute of Standards and Technology Cybersecurity Framework (CSF), 12 CFR Appendix B to Part 30 - Interagency Guidelines Establishing Standards for Safety and Soundness Gramm-Leach-Bliley Act (GLBA) 501(b).


text: The Information Security Management Program features layered controls of network and endpoint intrusion detection and prevention, enterprise malware protection, threat-monitoring, and a Security Operations Center that provides full time support and additional operational measures to monitor and respond to data breaches and cyberattacks. The Company leverages regular assessments to identify current and potential threats and vulnerabilities within the Company's environment. Technical vulnerabilities are identified through regular automated vulnerability scanning tools and periodic vulnerability and penetration testing performed by independent third parties. Non-technical vulnerabilities are identified through the Information Technology and Information Security Assurance Program by conducting regular process and procedural reviews as well as risk assessments. The Company uses the FFIEC CAT to help identify cybersecurity risks and determine our cybersecurity preparedness. The Company's information security and cybersecurity risk appetite statements define the levels of risk the Company is willing to accept and guide the risk management decisions of the Company. The risk appetite statements are approved by the Board of Directors annually.


text: The Company has an Incident Response Plan to help reduce the risks related to security incidents by providing guidelines on responding to incidents; focusing on a roadmap for coordinating personnel, policies, and procedures to ensure incidents are detected, analyzed, and handled appropriately.


text: The Company also recognizes the risks associated with the use of third party providers and maintains a Third Party Risk Management Program that is responsible for the oversight of outsourced services. This enables the Company to identify risks related to third parties through an inherent risk assessment and a due diligence review process designed to ensure third parties are in compliance with the Company's risk and information security expectations.


text: The Company's Security Awareness Program provides annual, mandatory training for personnel on information security to prepare personnel with the knowledge of how to properly use and protect Company resources from internal and external threats. The Program also conducts regular phishing assessments and targets new hires and other groups with specific training related to their job activities or risk levels. The Program also communicates information security policies, standards, and practices to personnel and requires annual review and acknowledgement of the policies.


text: The ISO has served various roles in audit, information risk, information technology, and information security in multiple industries for over 12 years. The ISO holds an undergraduate degree in Management Information Systems and has attained the ISACA Certification in Certified Information Systems Auditor (CISA). The ISO reports to the Chief Financial Officer (CFO) as well as the Chairperson of the ERC.


text: For the year ended December 31, 2023, the Company has not identified any specific risk from a cybersecurity threat that has materially affected, or is reasonable likely to affect, the Company's business strategy, results of operation, or financial condition, other than those described in Item 1A. Risk Factors - Risks Related to Technology.


text: Cybersecurity Risk Management and Strategy We rely on information systems and the data stored on them to conduct our operations. As such, we have implemented processes designed to mitigate risks posed by cybersecurity threats.

companyName: Societal CDMO, Inc.


text: Our approach to cybersecurity risk management is multi-faceted and includes, but is not limited to, engaging third-party information technology and cybersecurity providers and consultants for support as appropriate, including to conduct annual penetration testing and cybersecurity risk assessments, as well as other vulnerability analyses on a periodic basis. We also utilize a third-party to implement and manage automated tools designed to conduct ongoing monitoring for potential critical risks from cybersecurity threats. Additionally, we have implemented an employee education and training program, offered during onboarding and on an ongoing, periodic basis thereafter, that is designed to raise awareness of cybersecurity threats. As part of this employee training, we engage in periodic phishing simulations designed to raise employee awareness of such risks.


text: We maintain processes to inform and update management and, as needed, the audit committee, regarding security incidents that may pose a significant risk for the business, as applicable. We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition; however, like other companies in our industry, we and our third-party vendors have experienced threats and security incidents relating to our and our third-party vendors' information systems. For more information, please see "Item 1A, Risk Factors."


text: Our Director of Information Technology, who reports directly to our Chief Financial Officer, is responsible for the day-to-day management of our cybersecurity risk management processes. The Director of Information Technology role is currently held by an individual who has thirty years of information technology and cybersecurity experience.


text: Our audit committee is responsible for overseeing our cybersecurity risk management program. Our Director of Information Technology and/or Chief Financial Officer periodically update the audit committee on cybersecurity risks and mitigation strategies and related cyber matters. In the event of a cybersecurity incident, we have implemented processes for the Director of Information Technology and/or the Chief Financial Officer to discuss incident response strategies with the audit committee. The Director of Information Technology and/or the audit committee update the full board of directors on matters relating to cybersecurity risk management and critical cybersecurity risks as appropriate.


text: Risk Management and Strategy. The General Partner has written plans, procedures and policies that govern the Partnership's general information security program. The General Partner has a Risk and Control Self-Assessment ("RCSA") framework to help identify, measure, monitor and report important operational risks faced by the General Partner. Man Group has a Cyber Incident Response Plan ("CIRP") which dictates how the Partnership reviews and responds to security alerts, events and incidents. Pursuant to the written incident response plan, in the event of a cybersecurity incident, the security team first identifies the incident, triages, and responds. The General Partner's compliance team is also notified of the cybersecurity incident and, in conjunction with the legal team, assists in incident remediation and determining the materiality. As applicable, RCSAs are filed with the General Partner's operational risk team in order to keep the General Partner informed on cyber risks. Ultimately, an aggregate response to a cyber incident is reported to Man Group's risk committees, creating awareness and consideration of the top risks and overall levels of risk exposure.

companyName: MAN AHL DIVERSIFIED I LP

ticker: MADL


text: The operational risk team also has service provider monitoring in place in order to oversee and identify cybersecurity threats associated with the Partnership's use of third-party service providers. Prior to onboarding, the Partnership conducts due diligence for key new third-party services providers. This involves a diligence questionnaire sent by a cybersecurity training company that is then reviewed by the Partnership. The training company also assess the Partnership's security status during onboarding for services providers and, for critical suppliers, at regular intervals throughout the life of the supplier's contract.


text: The Audit and Risk Committee ("ARCom") of the board of directors of the General Partner's parent entity, (the "Board") is responsible for risk governance and management frameworks, determining risk strategy and ensuring that risk is monitored and controlled effectively. The risk management framework requires that the Partnership operates within acceptable risk tolerances, while risk governance provides a foundation for potential oversight in an evolving cyber environment. The ARCom meets quarterly to discuss cybersecurity risks and events and reports its findings to the Board. The chief information security officer presents to the ARCom quarterly, including providing incident reports for potentially material security incidents, and all Board members have the opportunity to ask questions. The full Board also discusses cybersecurity risks and events quarterly.


text: The General Partner uses both internal and external auditors for cybersecurity services. The General Partner maintains an Information Security Steering Committee chaired by Man Group's chief information security officer ("CISO") and which contains, among other members, Man Group's chief technology officer ("CTO"). The CISO is a Certified Information Systems Security Professional ("CISSP") and has over a decade of experience in the fields of technology and security. The General Partner utilizes a Security Operations Center ("SOC") model and annual reports to prevent, detect, and respond to cybersecurity incidents. The General Partner has regular cybersecurity audits conducted by KPMG. Further, the General Partner contracts third parties to perform quarterly phishing testing, annual penetration tests, and a bi-annual red team exercise. These exercises consist of virtual simulations of cybersecurity incidents in order to test the effectiveness of the General Partner's cybersecurity protection program. The exercises also help prepare the General Partner and Partnership to sufficiently respond in the instance of cybersecurity incidents. The General Partner also has a dedicated compliance function that focuses on the General Partner's international operations in order to comply with international cybersecurity laws. The General Partner uses these processes as well as the RCSA and CIRP to stay informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents.


text: Employees are required to complete annual cybersecurity training. The training is updated periodically in order to stay up to date with current laws and was last updated in the fourth quarter of 2023. The General Partner models risks, including security risks, and allocates risk capital accordingly, and does not carry cyber insurance.


text: In the past, the Partnership has experienced actual and attempted cybersecurity events and incidents. While prior incidents have not materially affected the General Partner's or the Partnership's business strategy, results of operations or financial condition, and although the General Partner's processes are designed to help prevent, detect, respond to, and mitigate the impact of such incidents, there is no guarantee that a future cyber incident would not materially affect the General Partner's or the Partnership's business strategy, results of operations or financial condition. To date, the General Partner has not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected the General Partner, the Partnership, the General Partner's business strategy, the Partnership's results of operation or the Partnership's financial conditions.


text: Breaches in Information Technology Security. The General Partner and the Trading Advisor maintain information technology systems, consisting of infrastructure, applications and communications networks to support the Partnership as well as its own business activities. These systems could be subject to security breaches such as 'cyber-crime' resulting in theft, a disruption in the Trading Advisor's ability to close out positions and the disclosure or corruption of sensitive and confidential information. Security breaches may also result in misappropriation of assets and could create significant financial and/or legal exposure for the Partnership. The General Partner and the Trading Advisor seek to mitigate attacks on their own systems but will not be able to control directly the risks to third-party systems to which it may connect. Any breach in security of the General Partner's or the Trading Advisor's systems could have a material adverse effect on the General Partner or the Trading Advisor and may cause the Partnership to suffer, among other things, financial loss, the disruption of its business, liability to third parties, regulatory intervention or reputational damage.


text: Risk Management and Strategy We have developed and implemented cybersecurity risk management processes intended to protect the confidentiality, integrity and availability of our critical systems and information.

companyName: Galaxy Gaming, Inc.

ticker: GLXZ


text: Our cybersecurity risk management program includes: • physical, technological and administrative controls intended to support our cybersecurity and data governance framework, including protections designed to protect the confidentiality, integrity and availability of our key information systems; • risk assessments designed to help identify material cybersecurity risks to our critical systems and information; • designated team members are responsible for managing our cybersecurity risk assessment processes, our security controls, and our response to cybersecurity incidents; and • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls.


text: We have not identified risks from known cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See Item 1A. "Risk Factors – Cyber-attacks or other failures in our telecommunications or information technology systems, or those of our collaborators, third-party logistics providers, distributors or other contractors or consultants, could result in information theft, data corruption and significant disruption of our business operations."


text: Our Board considers cybersecurity risk as part of its risk oversight function. The Board receives periodic reports from management on the integrity of our technology communication infrastructure and any cybersecurity risks. In addition, management updates the Board, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: Our management team, including our Chief Financial Officer, along with third party infrastructure providers are responsible for assessing and managing our material risks from cybersecurity threats. Our Chief Financial Officer has primary responsibility for our overall cybersecurity risk management program. Our Chief Financial Officer has experience supervising and managing company information technology departments.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from external security personnel; threat intelligence and other information obtained from governmental, public or private sources; and alerts and reports produced by security tools deployed in the information technology environment.


text: Risk Management and Strategy We rely on the cybersecurity policies and procedures implemented by BDT & MSD. BDT & MSD have processes in place for assessing, identifying, and managing material risks from potential unauthorized occurrences on or through our electronic information systems that could adversely affect the confidentiality, integrity, or availability of our information systems or the information residing on those systems. These include a wide variety of controls, processes, systems, and tools that are designed to prevent, detect, or mitigate data loss, theft, misuse, unauthorized access, or other security incidents or vulnerabilities affecting our data. Pursuant to BDT & MSD's Information Security Policy, the BDT &MSD Chief Technology Officer ("CTO") is responsible for the oversight and implementation of the Information Security Policy. At times BDT & MSD may also engage assessors, consultants, auditors, or other third parties to assist with assessing, identifying, and managing cybersecurity risks.

companyName: MSD Investment Corp.


text: BDT & MSD use processes to oversee and identify material risks from cybersecurity threats, including those associated with the use of third-party service providers. Additionally, BDT & MSD use systems and processes designed to reduce the impact of a security incident at a third-party service provider. As part of its risk management process, BDT & MSD also maintain an incident response plan that is utilized when cybersecurity incidents impacting us are detected. BDT & MSD also require that all employees, including employees of BDT & MSD complete interactive security awareness training on an annual basis.


text: Material Impact of Cybersecurity Risks As of the date of this report, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. However, future incidents could have a material impact on our business.


text: Our cybersecurity risks and associated mitigations are evaluated by our management and BDT & MSD as needed, but no less frequently than annually. The BDT & MSD CTO periodically reports to our board of directors on developments to the information security and cybersecurity risks we face. Reports include, among other things, an overview of BDT & MSD's controls and procedures related to assessing, identifying, and managing risks related to cybersecurity threats, oversight of third-party service providers and related cybersecurity threats, and management's evaluation of cybersecurity risks material to us.


text: Security Program Overview The Company's cybersecurity program is framework-based, and risk and metrics-focused. The program uses and is measured against National Institute of Standards and Technology Standards ("NIST") 800-53(r5) and supporting standards. The Company utilizes a risk-based security program that strives for an effective balance of controls and processes across the Identify, Protect, Detect, Respond and Recover areas of the framework. As a service provider and technology partner, we have on-going initiatives that address the areas below to achieve a comprehensive security program.

companyName: CINCINNATI BELL INC


text: Security Governance – The Company's Board of Directors has designated a subcommittee of the Board that meets quarterly to provide oversight of risks from cybersecurity threats. The Company's Vice President and Chief Security Officer ("CSO") reports to this subcommittee to inform them on the Company's threat and risk landscape, and the management of cybersecurity incidents. This subcommittee consists of board members and the Company's executive leadership team. The CSO also leads a cross-functional, executive-level Security Council that meets quarterly and governs all aspects of the Company's security program. The Company maintains a risk-based security program that is supported by a comprehensive set of policies, procedures, and standards based on the NIST cybersecurity framework, which includes administrative, physical, and technical safeguards.


text: The CSO joined altafiber in 2023 with over 20 years of cybersecurity experience in highly regulated industries and the government in identifying, managing, and mitigating cybersecurity risk. Previously, the CSO held an officer role at a large Fortune 500 financial services firm developing cybersecurity strategy and leading teams focused on risk management, security architecture and engineering, incident response, and threat intelligence. The CSO also serves on multiple advisory boards related to cybersecurity and is the current board chair for Miami University's Center for Cybersecurity.


text: Risk Management – The Company established an Enterprise Risk Management (ERM) Committee that employs the International Organization for Standardization (ISO) risk management standards. Members of the ERM Committee include the Company's CSO, Chief Financial Officer, Chief Network Officer, Director of Safety and Risk Management and the Director of Internal Audit. The committee leverages a proprietary internal risk management tool to maintain a risk register, which systematically identifies, assesses, prioritizes, and manages risks within the enterprise. This structured approach enables us to conduct a formal, periodic risk assessment, ensuring the continuous enhancement of our security posture. In addition to threats, vulnerabilities, impacts and costs, the risk assessment process also identifies the costs and effectiveness of countermeasures and action plans to reduce risk.


text: Security Awareness and Training – The Company established a security awareness program that focuses on individual employees' impact to the overall security strength of the company. Via the use of web-based and in person training, surveys and published literature, the Company is constantly making the employees aware of the vital role they play in protecting both the Company and customers' data. Phishing exercises are also periodically conducted to improve employee knowledge of and response to security threats. Specialized web-based training covering Payment Card Industry ("PCI"), Health Insurance Portability and Accountability Act ("HIPAA") and Federal Tax Information is also required and tracked for employees who have access to that data.


text: Identity and Access Management – The Company requires authorization of all personnel, including contractors, before being granted access to facilities, systems, and data. The Company's identity and access management systems are integrated with human resource applications and processes to facilitate provisioning and de-provisioning of badges and logical system access.


text: Cybersecurity – The Company employs a "defense in depth" approach to providing security around our networks, servers, and data. Most of our critical networks leverage redundant components and connections to ensure high levels of availability, reliability, and performance. The Company employs a security architecture that identifies rules for segmentation and access control based on risk and impact to the business. This includes infrastructure, applications, and data in the cloud.


text: Endpoint and Device Protection & Anti-Malware – The Company has hardening policies and processes and uses a "gold image" approach to deploying new clients and servers. Configurations that go into gold images are reviewed with security staff. Advanced anti-malware controls are in place and patching cadence and performance of endpoint devices are watched closely. Cincinnati Bell Inc.


text: Protection of Customer and Other Sensitive Data – The Company complies with regulations for Customer Proprietary Network Information protection (Title 47 section 222) and has taken measures over the past several years to limit or remove Personal Identifiable Information ("PII") and other sensitive information from databases and internal systems. Access to sensitive information from third party partners is managed through secure virtual terminal environments, and movement of PII is monitored on premise and in key cloud applications.


text: Application and Product Security – The Company's application security program is based on the Open Web Application Security Standard ("OWASP") and critical systems have been benchmarked for compliance with our security polices and standards. Security work is jointly prioritized with security staff and product/application/development organizations and third parties with responsibility for application development and maintenance. Security checklists have also been developed and are used in new product development lifecycle processes.


text: Third Party Risk Management – Third parties with access to data or infrastructure must go through a vetting process to ensure they comply with reasonable and industry accepted security practices. The vetting process includes assessments, review of third-party attestation and inclusion of standard security language in contracts. Security staff work closely with legal, procurement/sourcing personnel and other stakeholders within the Company on third party compliance practices.


text: Threat and Vulnerability Management – Vulnerability scanning and attack and penetration testing, quarterly and annually, is conducted on perimeter networks and E-commerce platforms by third parties and qualified internal personnel. The testing covers network, host, application, and data security. The Company uses the Common Vulnerability Scoring System ("CVSS") standard for vulnerability management. Various open source, third party and internally developed threat intelligence platforms are used to stay abreast of threats facing the Company and our industry.


text: Security Assessments – Various company environments are regularly audited by a third-party AICPA- and PCAOB-registered certified public accounting firm and has consistently obtained PCI DSS 3.2, SSAE18 SOC1, SOC2, CSAE34-16 SOC1 and SOC2 certifications and HIPAA compliance. The Company currently holds 20 such certifications.


text: Change Management and ITSM – The Company employs robust change, incident and problem management practices across core network, managed services, and information technology environments. Security team members are an active part of these processes.


text: Emergency Management, Incident Response and Cyber Insurance – The Company has invested in technology and processes for timely incident response to security and crisis events. Physical and cybersecurity staff, health and safety, legal, operational and human resources personnel are part of the overall emergency and incident response team. The Company has partnerships with third parties for forensics, and incident response consulting. The Company also maintains effective levels of cyber insurance against large data breaches or cybersecurity events.


text: Service and Business Continuity – The Company conducts service continuity exercises and monitors network fault and performance 24 hours a day, 365 days a year to quickly detect and respond to service degradation or impairment. A set of business continuity plans and scenarios are also in place to address catastrophic events to personnel, critical infrastructure, and applications. The Company conducts periodic internal tabletop exercises and joint exercises with customers. Business continuity efforts are overseen by the Company's Business Continuity Committee following policy set by the Company's Security Council.


text: In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors– Intellectual Property Tax, Regulatory, and Litigation Risks" in this annual report on Form 10-K.


text: Website Access and Other Information The Company was incorporated under the laws of Ohio in 1983 with its headquarters at 221 East Fourth Street, Cincinnati, Ohio 45202 (telephone number (513) 397-9900 and website address http://www.altafiber.com). The Company has ceased to be subject to the reporting requirements of the Securities Exchange Act of 1934, as amended, but continues to voluntarily file annual, quarterly and certain other information with the SEC due to contractual provisions included in certain indentures. The SEC maintains an internet site that contains reports, proxy statements, and other information about issuers which file electronically with the SEC. The address of that site is http://www.sec.gov. Cincinnati Bell Inc.


text: Risk Management and Strategy The Company's cybersecurity program is designed to identify, assess, and manage material risks from cybersecurity threats. The Company also relies on the cybersecurity policies and procedures implemented by Varagon and its affiliates. Varagon has processes in place for assessing, identifying, and managing material risks from potential unauthorized occurrences on or through our electronic information systems that could adversely affect the confidentiality, integrity, or availability of our information systems or the information residing on those systems. These include a wide variety of controls, processes, systems, and tools that are designed to prevent, detect, or mitigate data loss, theft, misuse, unauthorized access, or other security incidents or vulnerabilities affecting our data. Pursuant to Varagon's Information Security (Safeguards) Policy (the "Information Security Policy"), the Chief Financial Officer of Varagon serves as the Information Security Policy Coordinator and is responsible for the ongoing and regular monitoring of the Information Security Policy to ensure that it is operating in a manner reasonably calculated to prevent unauthorized access to, or unauthorized use of, non-public information. Varagon has engaged and may engage, from time to time, assessors, consultants, auditors, or other third parties to assist with assessing, identifying, and managing cybersecurity risks, subject to the continued oversight of Varagon.

companyName: Varagon Capital Corp


text: The Chief Financial Officer of Varagon is responsible for identifying and assessing reasonably foreseeable internal and external risks to the security, confidentiality, and/or integrity of any electronic, paper, or other records containing non-public information, and evaluating and improving, where necessary, the effectiveness of the current safeguards for limiting such risks, including those pertaining to the Company. Additionally, Varagon uses systems and processes designed to reduce the impact of a security incident at a third-party service provider. As part of its risk management process, Varagon also maintains an incident response plan that is utilized when cybersecurity incidents impacting the Company or the Adviser are detected. Varagon also requires that all employees, including employees of the Adviser, complete periodic information security training, including new hire training, regular compliance training, and periodic informal training pertaining on specific areas of concern.


text: Material Impact of Cybersecurity Risks As of the date of this Annual Report on Form 10-K, the Company is not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. However, future incidents could have a material impact on its business. Additional information about cybersecurity risks the Company faces is described in Item 1A of Part I, "Risk Factors," under the heading "Cybersecurity Risks," which should be read in conjunction with the information above.


text: The Company's cybersecurity risks and associated mitigations are evaluated by the Company's management and Varagon periodically, but no less frequently than annually. Management and representatives of Varagon periodically report to the Board on information security and cybersecurity matters. Reports include, among other things, the overall state of the Company's cybersecurity program, information on the current threat landscape, oversight of third-party service providers and related cybersecurity threats, and management's evaluation of material cybersecurity risks to the Company.


text: Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, lab equipment, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data related to our clinical studies and employees, or Information Systems and Data.

companyName: Equillium, Inc.

ticker: EQ


text: We engage an external Head of Information Technology consultant to work with the company, including the Chief Operating Officer, Chief Financial Officer, and Executive Leadership Team, to help identify, assess and manage the company's cybersecurity threats and risks. This group identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example, automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, and evaluating threats reported to us.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident response plan and/or incident response policy, data and information protection plans, network security and access controls for certain systems, encryption of data, systems monitoring, cyber insurance and employee training.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the company's overall risk management processes. For example, the Head of Information Technology works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.


text: We may use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including, for example, professional services firms (including legal counsel) and threat intelligence service providers.


text: To operate our business, we utilize certain third-party service providers to perform a variety of functions, such as outsourced business critical functions, clinical research, professional services, Software-as-a-Service (SaaS) platforms, managed services, cloud-based infrastructure, encryption and authentication technology, corporate productivity services, and other functions. We have certain vendor management processes to help manage cybersecurity risks associated with our use of these providers. Depending on the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, our vendor management process may include reviewing the cybersecurity practices of such provider, contractually imposing obligations on the provider related to the services they provide and/or the information they process, requiring their completion of written questionnaires regarding their services and data handling practices and conducting periodic re-assessments during their engagement.


text: For a description of the risks from cybersecurity threats that may materially affect the company and how they may do so, please see "Risk Factors – Risks Related to Employees, Managing Our Growth and Other Legal Matters."


text: Our board of directors addresses the company's cybersecurity risk management as part of its general oversight function. The audit committee of the board of directors is responsible for reviewing the company's guidelines and policies with respect to risk assessment and risk management, including those related to assessment and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain company management, including our Head of IT, who holds a Microsoft Certification, and our Chief Operating Officer, who earned a Cybersecurity for Directors certificate from the Corporate Governance Institute.


text: Management is also responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the company's overall risk management strategy, and communicating key priorities to relevant personnel. The Head of IT and Chief Operating Officer are responsible for helping prepare the company for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances and designated risk level, including the Chief Financial Officer, Chief Executive Officer and/or full Executive Leadership Team, who participates in our disclosure controls and procedures. The Head of IT and Chief Operating Officer work with the company's incident response team to help the company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the company's incident response processes include reporting to the audit committee of the board of directors for certain cybersecurity incidents.


text: The audit committee receives periodic reports from the Head of IT and Chief Operating Officer concerning the company's significant cybersecurity threats and risk and the processes the company has implemented to address them. The audit committee also receives summaries or presentations related to the company's information systems and data and cybersecurity threats, risk and mitigation.


text: Risk management and strategy Due to the size of our company, we have not yet developed robust policies and processes for assessing, identifying, and managing material risk from cybersecurity threats. We have implemented access controls with respect to our systems, which we monitor regularly and audit annually. We currently rely heavily on products and services provided by third-party suppliers to operate certain critical business systems, including without limitation, cloud-based infrastructure, encryption and authentication technology, email, and other functions. We rely on third party providers and outsourced IT services to monitor and address cybersecurity related risks, including installing software for threat protection and malware. Such third party providers are tasked with notifying management of any material risks or cybersecurity concerns that they identify, which management then assesses and may bring to our board of directors to discuss if deemed necessary or appropriate. Based on the results of our risk assessments, if deemed necessary or appropriate, we take steps to re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards.

companyName: Tivic Health Systems, Inc.

ticker: TIVC


text: We intend to work with outside counsel and third party service providers in the near term to further develop our expertise, processes and procedures with respect to cybersecurity protection and our response plan.


text: To date, we have not (to our knowledge) encountered cybersecurity challenges that have materially impaired our operations or financial standing. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," in this Report.


text: Our management team is primarily responsible for assessing and managing our strategic risk exposures, including material risks from cybersecurity threats, with assistance from third-party service providers. Management oversees our cybersecurity process on a day-to-day basis, including those described in "Risk Management and Strategy" above.


text: Our audit and risk committee is tasked with general oversight of our risk management process, including risks from cybersecurity threats. Members of management provide periodic briefings to the audit and risk committee of our board of directors regarding our cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. In furtherance thereof, the committee is responsible for monitoring and assessing strategic risk exposure. Our audit and risk committee provides regular updates to the board of directors on such reports.


text: Our board recognizes the critical importance of maintaining the trust and confidence of our patients, business partners and employees. Our board is actively involved in oversight of our risk management program, and cybersecurity represents an important component of our overall approach to enterprise risk management ("ERM"). Through our ERM program, risks are identified, assessed and managed at the organization level, mission and business process level, and information system level. Our cybersecurity program, policies and procedures are fully integrated into our ERM program and are maintained in accordance with industry good standards. We also have an Information Security program that more specifically addresses cybersecurity risks and is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: SUTRO BIOPHARMA, INC.

ticker: STRO


text: Risk Management and Strategy As one of the critical elements of our overall ERM approach, our cybersecurity program is focused on the following key areas:


text: 1. Governance: Our board's oversight of cybersecurity risk management is supported by our Audit Committee of our board (the "Audit Committee"), which regularly interacts with our executive leadership, including our Chief Executive Officer, Chief Financial Officer and our General Counsel and other key officers.


text: 2. Collaborative Approach: We have implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. We also engage security vendors with credentialed security professionals to bolster our cybersecurity risk management, security event monitoring and detection, and incident and crisis response capability.


text: 3. Technical Safeguards: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including mail flow algorithms, firewalls, intrusion prevention and detection systems, malware and antivirus protection, network security protection, cloud console security and single sign-on multi-factor authentication. We also regularly conduct security and patch vulnerability scanning to help safeguard our security infrastructure.


text: 4. Incident Response and Recovery Planning: We have established and maintain comprehensive incident response and recovery plans that fully address our response to a cybersecurity incident, and such plans are periodically evaluated. We utilize an established internal framework designed to assess promptly the severity and materiality of cybersecurity events and incidents based on various predefined quantitative and qualitative criteria, including the impact to potential personally identifiable information and/or patient health information, and to determine the appropriate level of response. Incidents are escalated based on their severity and materiality for prompt response and mitigation. This systematic approach involves preliminary investigations and detailed assessments to determine the severity and materiality of each incident, and there are established communication channels and engagement processes with those involved in this incident response process.


text: 5. Third-Party Risk Management: We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. We have implemented communication channels with our key third-party vendors to communicate regarding potential cybersecurity risks and incidents, and generally seek to include appropriate security clauses in our contracts with our vendors, including notification requirements.


text: 6. Education and Awareness: We provide regular, mandatory security awareness training for personnel regarding cybersecurity threats as a means to equip our personnel with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices.


text: We engage in a periodic assessment of our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents at least annually. We evaluate our cybersecurity program's capabilities and processes, and we aim to continuously enhance our program according to our internal and external risk assessments. These efforts include a wide range of activities, including audits, assessments, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning.


text: We have previously engaged, and may engage in the future, with third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, vulnerability assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Audit Committee and the board, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: Although we are subject to ongoing and evolving cybersecurity threats, we are not aware of any cybersecurity threats, that have materially affected or are likely to affect us, including our business strategy, results of operations or financial condition. If we were to experience a material cybersecurity incident in the future, such incident may have a material effect, including on our business strategy, operating results, or financial condition. For more information regarding cybersecurity risks that we face and potential impacts on our business related thereto, see the "Risk Factors" disclosures in Item 1A of this Annual Report on Form 10-K.


text: Our board, in coordination with the Audit Committee, oversees our ERM process, including the management of risks arising from cybersecurity threats. Our Audit Committee receives regular presentations and reports on cybersecurity risks, which address a wide range of topics including our information security strategy, ongoing cybersecurity preparedness projects and programs, recent cybersecurity-related developments, changing regulations, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties. Further, our Information Security Team, consisting of Company IT staff, meets biannually with our Information Security Governance Committee to review our policies, incidents, responses and preventative measures. In addition, our Information Security Team presents a summary of information security key performance indicators quarterly to our Audit Committee.


text: Our Chief Executive Officer, Chief Financial Officer, General Counsel and other key officers and our Information Security team work collaboratively across the Company to implement and monitor our Information Security Program, which is designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans. Our Information Security team is deployed to address cybersecurity threats and to respond to cybersecurity incidents, including those stemming from any violation of our cybersecurity policies. Further, our Information Security Team monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and reports such threats and incidents to the Audit Committee when appropriate.


text: Our Information Security team collectively has a combined experience of over 70 years managing and supporting information technology in the biotech industry and oversees our cybersecurity program. They have experience developing and leading cybersecurity programs, including evaluating and implementing tools and technologies that enable defense and response capabilities, and developing critical cybersecurity procedures and training and awareness programs. Our cybersecurity consultant has served in various roles in information technology and information security for approximately 25 years. We also consult with two different service providers who specialize in corporate cybersecurity.


text: In the ordinary course of our business, we and our third-party service providers collect, maintain and transmit sensitive data on our networks and systems, including with respect to our intellectual property and proprietary or confidential business information (such as research data and personal information). The secure maintenance of this information is critical to our business and reputation. In addition, we are dependent on the functioning of our information technology infrastructure to carry out our business processes. While we have adopted administrative, technical and physical safeguards to protect such systems and data, our systems and those of third-party service providers may be vulnerable to a cyber-attack.

companyName: Finch Therapeutics Group, Inc.

ticker: FNCH


text: We have adopted processes designed to identify, assess and manage material risks from cybersecurity threats. Those processes include responding to internal and external threats to the security, confidentiality, integrity and availability of our data and information systems. We may detect potential vulnerabilities and anomalies through our technical safeguards and we have adopted policies relating to the notification of and response to cybersecurity incidents.


text: We rely on third parties, including cloud vendors, for various business functions. Our third-party services providers have access to our information systems and data, and we rely on such third parties for the continuous operation of our business operations. We oversee third-party service providers by conducting diligence when onboarding vendors. Vendors are assessed for risk based on the nature of their service, and access to our data and systems and, based on that assessment, we may conduct additional diligence including security questionnaires and other technical evaluations.


text: Our Board of Directors has established oversight mechanisms to manage risks from cybersecurity threats. Our Audit Committee has primary responsibility for oversight of cybersecurity. Our Audit Committee will report from time to time, as necessary, to the Board on these matters. At the management level, our cybersecurity program is managed by our Chief Executive Officer, who reports to the Board, with the assistance of a third-party vendor.


text: Although we have experienced minor cybersecurity incidents in the past, as of the date of this report, we have not experienced a cybersecurity incident that resulted in a material effect on our business strategy, results of operations, or financial condition. Despite our continuing efforts, we cannot guarantee that our cybersecurity safeguards will prevent breaches or breakdowns of our or our third-party service providers' information technology systems, particularly in the face of continually evolving cybersecurity threats and increasingly sophisticated threat actors. A cybersecurity incident may materially affect our business, results of operations or financial condition, including where such an incident results in reputational, competitive or business harm, loss of intellectual property rights, significant costs or the Company being subject to government investigations, litigation, fines or damages. For more information, see "Our internal computer systems, or those of any of our current or future collaborators and strategic partners or other contractors or consultants, may fail or suffer security breaches, which could result in a significant disruption and our ability to operate our business effectively."


text: The Corporation's risk management program includes focused efforts to identify, assess and manage cybersecurity risks including, but not limited to, the following: • Developing and maintaining a standardized Written Information Security Policy ("WISP"), which provides specific provisions pertaining to employee training, network security, data security, and confidential information for use and adherence by all pertinent operating entities of the Corporation; • Developing and maintaining an Incident Response Plan ("IRP"), which provides specific directives in the event of a cyber-attack including identifying the attack, containing and eradicating the cyber-threat, avoiding and minimizing damages, reducing recovering time, and mitigating future cybersecurity risks; • Aligning the Corporation's risk management program, as outlined in the WISP and the IRP, with the National Institute of Standards and Technology Cybersecurity Framework to prevent, detect and respond to cyber-attacks; • Requiring all employees with access to the Corporation's networks to participate in regular and mandatory training on how to be aware of, and help defend against, cybersecurity risks, combined with periodic testing to measure the efficacy of the training efforts; • Testing vulnerability of the Corporation's key systems to cybersecurity risks, including targeted penetration testing, tabletop incident response exercises, periodic audits by outside industry experts, and regular vulnerability scanning; • Maintaining adequate business continuity plans and critical recovery backup systems; • Engaging external cybersecurity experts in incident response development and management; and • Maintaining adequate cyber insurance for damages caused by a cyber-attack.

companyName: AMPCO PITTSBURGH CORP

ticker: AP


text: The Corporation's information security program is managed by its Data Protection Manager ("DPM") and its Information Technology Department (collectively, the "IT Team"). The DPM has extensive experience in cyber and global data protection initiatives with the Corporation and reports directly to the Corporation's Chief Executive Officer. The IT Team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes.


text: In addition, the Corporation has established a Cybersecurity Materiality Assessment Team ("CMAT") for the purpose of evaluating specific cyber incidents or a series of related incidents. It includes certain of the Corporation's senior managers with cross-functional representation from operations, finance/accounting, information technology, risk management and human resources. CMAT is responsible for assessing the potential materiality of a cyber-incident based on the actual and anticipated potential impact to the Corporation's results of operations, financial position and cash flows; operations including disruptions and downtime; strategic plans; confidential information; employee and community health and safety; customers and vendors; investors; regulatory compliance; and reputation.


text: Engage Third Parties As part of the Corporation's cybersecurity risk management process, the Corporation engages a range of third parties, including consultants and advisors, to assist with security assessments and operations, employee training and awareness, compliance, penetration testing, network and endpoint monitoring, threat intelligence, and the Corporation's vulnerability management platform. These relationships enable the Corporation to access specialized knowledge and insights with respect to its cybersecurity strategies and processes.


text: Risks from Cybersecurity Threats From time to time, the Corporation has experienced attempts by unauthorized parties to access or disrupt its information technology systems. To date, it has not experienced any known material breaches or material losses related to cyber-attacks. However, a failure of the Corporation's information systems or a cybersecurity breach could materially and adversely affect its business, results of operations and financial condition. See additional information provided under Item 1A, Risk Factors. The Corporation manages its cybersecurity risk by limiting its threat landscape. For example, the Corporation does not store, transmit or process many of the types of data commonly targeted in cyber-attacks, such as consumer credit card or financial information. The Corporation recognizes cyber-threats are a permanent part of the risk landscape, and new threats are constantly evolving. For these and other reasons, cybersecurity is a top risk management priority.


text: Monitoring Cybersecurity Incidents The Corporation's efforts to prevent and detect cybersecurity incidents include continuous monitoring of the Corporation's networks. Employees throughout the Corporation are trained to report cybersecurity threats as they are identified. If an incident occurs or is suspected, it is reported to the DPM who completes an initial assessment of the incident and assigns a priority level, as outlined in the IRP, to the incident. Simultaneously, the DPM initiates the review process with CMAT and proceeds with the remediation process for recovery and eradication.


text: The CMAT assesses potential materiality of the confirmed or suspected security incident based on the actual or anticipated potential impact to the Corporation's results of operations, financial position and cash flows; operations including disruptions and downtime; strategic plans; confidential information; employee and community health and safety; customers and vendors; investors; regulatory compliance; and reputation.


text: The DPM reviews any material cybersecurity threats or incidents, as defined in the IRP, with the Audit Committee when they occur and non-material threats or incidents on a regular basis. Materiality of a cybersecurity threat or incident gives consideration to the potential and actual impact of the cybersecurity threat or incident.


text: Board of Directors Oversight The Audit Committee of the Board of Directors (the "Audit Committee") oversees and reviews the design and effectiveness of the Corporation's cybersecurity program and its contingency plans and provides regular reports to the Board of Directors of the Corporation. The DPM provides periodic reports to the Audit Committee, the Corporation's Chief Executive Officer, Chief Financial Officer, and other members of senior management at each of the Audit Committee meetings and in the event of a cyber incident deemed material. These reports include updates on the Corporation's cyber risks and threats, the status of projects to strengthen its information security systems, assessments of the information security program, and the emerging threat landscape.


text: Cybersecurity Risk Management Strategy We have developed our cybersecurity risk management program (“cybersecurity framework”), including a cybersecurity incident response plan, based on the National Institute of Standards and Technology Cybersecurity Framework’s (NIST CSF) principles: Identify, Protect, Detect, Respond, and Recover, and our cybersecurity framework is intended to address current vulnerabilities and anticipate future cybersecurity threats and risks to our cyber ecosystem. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: CG Oncology, Inc.

ticker: CGON


text: Our cybersecurity framework is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: • assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response process that includes procedures for responding to cybersecurity incidents; and • a risk evaluation of the service providers, suppliers, and vendors of critical systems during contracting.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. There can be no assurance, however, that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information. For more information, see the section titled “Risk Factors—Risks Related to Our Business Operations and Industry—Our information technology systems, or those of any of our service providers, may fail or suffer security incidents and other disruptions, which could result in a material disruption of our development programs, compromise sensitive information related to our business or prevent us from accessing critical information, potentially exposing us to liability or otherwise adversely affecting our business.”


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Committee oversees management’s implementation of our cybersecurity risk management program.


text: The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. The Audit Committee members receive presentations on cybersecurity topics from our Director of Information Technology, or external experts as part of the Audit Committee’s continuing education on topics that impact public companies.


text: Our management team, including our Director of Information Technology, has a combined 35 years of risk management experience and is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. The experience of our management team encompasses leadership, development, and support of cybersecurity strategies, along with the implementation of policies and procedures. Furthermore, they possess a track record of proactively monitoring cybersecurity threats and promptly responding to and remediating cyber attacks. Their adeptness in executing security controls has consistently yielded clean audit observations, showcasing their effectiveness in safeguarding against potential risks.


text: Cybersecurity Risk Management and Strategy The Company, under the oversight of the audit committee of the board of directors, has implemented and maintains an enterprise risk management program that includes a cybersecurity risk management program designed to identify, assess, and mitigate critical risks from cybersecurity threats.

companyName: Vigil Neuroscience, Inc.


text: Our cybersecurity risk management program is informed by industry standards and includes, but is not limited to, ongoing monitoring for potential critical risks from cybersecurity threats using automated tools. We have a process designed to monitor and address identified cybersecurity risks. To support our cybersecurity risk management program, we leverage a managed security service provider (MSSP) and also engage with other third-party providers and cybersecurity consultants as appropriate, including engagement of third parties to assist with managed detection and response and vulnerability management and to perform periodic penetration testing, and other vulnerability analyses.


text: As part of our cybersecurity risk management program, we have a process to assess and review the cybersecurity practices of certain third-party vendors and service providers that may be critical to the operations of our business and who have access to our information systems or store our confidential data, including, as appropriate, through review of vendor questionnaires and the inclusion of cybersecurity requirements in contracts.


text: We also have an employee education and training program, offered during onboarding and on a periodic basis thereafter, that is designed to raise awareness of cybersecurity threats across functions as well as to encourage consideration of cybersecurity risks across our Company. As part of this employee training program, we periodically conduct phishing simulations designed to raise employee awareness of such risks.


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition; however, like other companies in our industry, we and our third-party vendors have, from time to time, experienced threats and security incidents relating to our and our third-party vendors' information systems. See Item 1A "Risk Factors" in this Annual Report on Form 10 K for more information.


text: Cybersecurity Program Oversight and Governance Our Head of Information Technology serves as our Information Security Officer (ISO) and has primary responsibility for managing our information technology team and external service providers and for generally assessing and managing our cybersecurity risk management program. Currently, the ISO role is held by an individual who has more than 20 years of experience in leading information security teams and who has implemented and managed cybersecurity programs for other publicly-traded biotechnology companies. Our ISO's experience includes developing and maintaining tools and processes designed to protect internal computer and telecommunications networks used to store, process, and transmit personal and confidential data.


text: Our ISO reports directly to, and meets periodically with, our Chief Financial Officer (CFO) to discuss and review our cybersecurity risk management processes, including our cybersecurity metrics, with input from the Company's MSSP and other third-party providers and cybersecurity consultants, as appropriate. Our ISO also works closely with our Chief Compliance Officer (CCO) in the establishment and management of controls and processes that underpin our cybersecurity risk management program and meets periodically with our entire executive management team, including our Chief Executive Officer, regarding cybersecurity threats and our cybersecurity risk management program. We have implemented a process for the ISO to report relevant findings from penetration testing and cybersecurity assessments conducted by third-party consultants to members of our management team, including our CFO and CCO, as appropriate.


text: Our board of directors has delegated oversight of the Company's cybersecurity program to the audit committee of the board of directors. As provided in the audit committee charter, the audit committee is responsible for reviewing and discussing the Company's information security and risk management programs, controls, and procedures, including high-level review of the threat landscape facing the Company and the Company's strategy to mitigate cybersecurity risks and potential breaches. Under the audit committee charter, the audit committee is also responsible for reviewing the recovery and communication plans for any unplanned outage or security breach, where applicable.


text: In connection with its oversight of our broader enterprise risk management program, our ISO, on a periodic basis, provides reports to the audit committee on the status of our cybersecurity program, including measures implemented to monitor and address risks from cybersecurity threats, as appropriate. The chair of the audit committee and the ISO provide periodic reports on cybersecurity risk management to the full board of directors.


text: The Board's Roles and Responsibilities The Board of Directors, as a whole and at the subcommittee level, oversees and monitors cybersecurity risk at the Company, receiving regular updates from management on the status of the Company's current cybersecurity risks, a prioritization of key risk areas to be mitigated, and any significant cyber incidents that have occurred or are reasonably likely to occur.

companyName: Third Harmonic Bio, Inc.


text: In late 2023, the Company began the process of a periodic formal cybersecurity risk assessment conducted by an expert third party. The findings from that formal assessment will inform the ongoing cybersecurity roadmap which is updated at least annually. The Audit Committee plays a key role by ensuring that the prioritization of the roadmap supports the Company's business objectives, and by making decisions, when called upon, of whether specific cybersecurity risks should be mitigated or if that risk is acceptable to the business.


text: Risk Management and Strategy Information Technology and the Digital Transformation of the Company's assets and business processes are critical to our growth strategy. Inherent to Information Technology and Digital Transformation is the commensurate cybersecurity risk, which we manage by maintaining a cybersecurity program that is integrated into our overall risk management process.


text: The cybersecurity program is overseen by the IT Senior Director and utilizes a risk-based methodology to support the confidentiality, integrity and availability of our digital assets. The cybersecurity program is supported at the highest level within the Company, formally reporting to the Audit Committee, a subcommittee of the Board of Directors, at least once every two quarters and more often if required.


text: As a part of the cybersecurity program, we conduct assessments, both internally and by independent third parties, to identify and prioritize the mitigation of cybersecurity risks. We also maintain a formal and mandatory cybersecurity awareness training program for all employees that includes annual training on information security best practices in high risk areas such as phishing and authentication. All employees are also tested periodically for their cybersecurity awareness.


text: We rely on Information Technology systems and infrastructure for many of our business and internal processes. Some of these systems and infrastructure are managed by third-party service providers who are not under our direct control. In order to mitigate material risks from our critical Finance-related third-party service providers, we annually review their SOC1 reports for any noted material incidents and risks.


text: For our non-finance service providers, we are currently implementing cybersecurity controls, including but not limited to requiring all critical vendors to notify the Company should the vendor fall victim to, and become aware of a material cybersecurity incident, and reviewing any available SOC2 or similar compliance reports should they be available. Our vendor selection and management processes are also being enhanced to ensure that vendors' cybersecurity controls are evaluated.


text: While tools and processes are in place to mitigate cybersecurity risks, we are continuing to establish an Incident Response Plan, or IRP, to analyze, contain, and remediate any cybersecurity incidents which may occur despite these mitigations. The IRP, based on the National Institute of Standards and Technology framework, defines a timely, consistent, and compliant response to cybersecurity incidents and includes notifications to the Audit Committee and any relevant governing bodies such as the SEC in the event that the cybersecurity incident is deemed to be material.


text: Although we have implemented a cybersecurity program designed to protect and preserve the confidentiality, integrity and availability of our information systems and assets, the Company also maintains cybersecurity insurance to manage potential liabilities resulting from specific cyber incidents. However, it is important to note that although we maintain cybersecurity insurance, there can be no guarantee that the insurance will cover the Company, wholly or partially, from potential liabilities, or that such insurance proceeds will be paid to us in a timely manner.


text: While we are not aware of any cybersecurity incidents that have occurred to date, we are exposed to, and may in future be adversely impacted by cyberattacks and interruptions to our information technology systems and infrastructure. Despite the security measures we have implemented, certain cyber incidents could materially disrupt our operational systems, and/or result in the loss of trade secrets, proprietary information, or competitively sensitive data.


text: We seek to maintain a robust and continuously improving cybersecurity program however the impact of certain cybersecurity incidents could have a materially adverse impact on our competitive position, reputation, operations and/or financial position. We remain vigilant in continuously improving our cybersecurity program and its controls.


text: Governance and Management's Responsibilities IT management is responsible for the cybersecurity program that assesses and manages cybersecurity risk. Specifically, the Senior Director of IT is responsible for the prevention, mitigation, detection, and remediation of cybersecurity incidents while at the executive level, the Chief Administrative Officer oversees the program and is the executive sponsor.


text: The Senior Director of IT monitors cybersecurity incidents and does so by working closely with expert technology and security partners. The Company and its partners deploy a variety of technologies and processes, including but not limited to intrusion monitoring, detection and response, patch management, threat hunting, identity and access management, assessments, audits and tests.


text: The Senior Director of IT has relevant expertise in cybersecurity having spent the previous five years prior to joining the Company implementing and managing ISO 27001 at a public biotechnology company, where he was responsible for cybersecurity and Sarbanes-Oxley Information Technology compliance, reporting directly to the Audit Committee. ISO 27001 is the International Organization for Standardization's standard for a comprehensive cybersecurity program. The Senior Director of IT also has extensive SOX IT compliance experience, having guided his previous companies through SOX IT compliance since 2004 when SOX first came into effect.


text: Cybersecurity threats, including any previous cybersecurity incidents, have not materially affected or are reasonably likely to affect the Company, including its business strategy, results of operations or financial condition.


text: We design and assess our program based on ISO 27002 standards. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the ISO 27002 as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: eFFECTOR Therapeutics, Inc.

ticker: EFTR


text: We engage external resources that contribute to, and provide independent evaluation of, our existing cybersecurity practices and organizational risk assessment systems. We use established processes designed to identify, assess, and manage third-party service provider risks when third parties handle, possess, process, and store the Company's material information.


text: Our cybersecurity risk management program includes (i) a policy designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment; (ii) the use of external service providers to manage, assess, test and otherwise assist with aspects of our security controls; and (iii) a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. However, there can be no assurance that our cybersecurity prevention and mitigation efforts will always be successful, and it is possible that cybersecurity threats could have a material adverse effect on our business, operations, or financial condition in the future. See "Risk Factors—Risks Related to Our Business Operations and Industry—Our business and operations may suffer in the event of information technology system failures, cyberattacks or deficiencies in our cybersecurity." under the heading "Risk Factors" of this Form 10-K.


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") oversight of cybersecurity and other information technology risks. The Committee oversees implementation of our cybersecurity risk management program by management and out external information technology service provider.


text: The Committee receives regular updates from management on our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.