text: Our management team, including specifically our Chief Financial Officer, working closely with our Vice President of Information Technologies and our Director of Cybersecurity and Compliance (our Cybersecurity Oversight Team), is responsible for assessing and managing our material risks from cybersecurity threats. Our Cybersecurity Oversight Team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Cybersecurity Oversight Team's experience includes a combined 50+ years in the pharmaceutical industry and information technology. This includes software and systems development, cybersecurity program oversight and overall IT management. The team has over two decades of experience dedicated to supporting enterprise architecture and a decade of experience specializing in cybersecurity, implementing cybersecurity frameworks, assessing and managing cybersecurity risks and executing incident response plans.


text: Our Cybersecurity Oversight Team supervises efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, which include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment. Pursuant to our Incident Response Plan (IRP), all of our employees are trained to report a suspected cybersecurity incident or breach to our information technology team. Reporting guidelines under the IRP describe how to report an incident and what details to include. As a first step under the IRP, our information technology team assesses the reported risk or breach and escalates it to our Incident Response Team (IRT), as appropriate. The IRT is comprised of the members of our Cybersecurity Oversight Team and other critical business function leaders, including members of our legal and communications teams. Following notification from our information technology team, the IRT is responsible for continuing to assess the suspected risk or breach to determine its potential impact on our organization, systems and data. Based on that assessment, the IRT may raise the incident or breach to other members of management or the audit committee for further review and triage.

companyName: Nuvalent, Inc.

ticker: NUVL

secItem: Item 1C


text: We have processes in place to assess, identify, and manage material risks from cybersecurity threats. Our business is dependent on the communications and information systems of the Investment Advisor and other third-party service providers. The Investment Advisor manages our day-to-day operations and has implemented a cybersecurity program that applies to us and our business.

companyName: Palmer Square Capital BDC Inc.

ticker: PSBD


text: Cybersecurity Program Overview The Investment Advisor has instituted a cybersecurity program designed to identify, assess, and mitigate cyber risks applicable to us and to protect the systems, data and other digital assets of the Company. The cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which we rely. The Investment Advisor actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by us.


text: We rely on the Investment Advisor to engage external experts, including cybersecurity assessors, consultants, and auditors to evaluate cybersecurity measures and risk management processes, including those applicable to us. We rely on the Investment Advisor's risk management program and processes, which include cyber risk assessments.


text: We depend on and engage various third parties, including suppliers, vendors, and service providers, to operate our business. We rely on the expertise of risk management, legal, information technology, and compliance personnel of the Investment Advisor when identifying and overseeing risks from cybersecurity threats associated with our use of such entities.


text: Board Oversight of Cybersecurity Risks The Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from our Investment Advisor's Chief Operating Officer ("COO") and Chief Compliance Officer ("CCO") regarding the overall state of the Investment Advisor's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting us.


text: Management's Role in Cybersecurity Risk Management Our management, including the COO and CCO, is responsible for assessing and managing material risks from cybersecurity threats. Members of our management possess relevant expertise in various disciplines that are key to effectively managing such risks, such as operations management, IT management, oversight of third-party service providers and managing relationships with outside cybersecurity experts. Our management team is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting us, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, information technology, and/or compliance personnel of the Investment Advisor.


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on us are assessed on an ongoing basis, and how such risks could materially affect our business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, we have not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that we believe have materially affected, or are reasonably likely to materially affect, us, including our business strategy, operational results, and financial condition.


text: The audit committee of the Board oversees the Company's risk management program, including the management of risks arising from cybersecurity threats. The audit committee receives regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, the threat environment, technological trends, and information security considerations arising with respect to the Company's peers and third parties. When necessary, the Board receives prompt and timely information regarding any material cybersecurity incident, as well as ongoing updates regarding any such incident until it has been addressed. On a periodic basis, the audit committee of the Board discusses the Company's approach to cybersecurity risk management with the Company's Head of Information Technology.

companyName: Cullinan Therapeutics, Inc.

ticker: CGEM


text: Cybersecurity Risk Management and Strategy In an effort to protect our business from cybersecurity threats, we maintain and utilize various tools and processes that are designed to identify, assess, and manage cybersecurity risks. Our cybersecurity risk management program, which has been integrated into our enterprise risk management program, is based on the National Institute of Standards and Technology (NIST) Cybersecurity Framework. Our cybersecurity risk management program focuses on monitoring the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents.

companyName: Tango Therapeutics, Inc.

ticker: TNGX


text: There are a number of components of our risk management program. We leverage external third parties for security testing on an annual basis, including penetration testing. We consistently monitor critical risks from cybersecurity threats using automated tools and have a process to implement mitigation plans. Our Security Committee, headed by the Vice President of IT and the Chief Legal Counsel, assesses and monitors any identified security incidents that impact us or our external partners. Furthermore, we assess and review the cybersecurity practices of third parties who have access to our systems and/or process our sensitive information. This assessment may involve requesting Systems and Organization Controls Type 2 reports (SOC2 reports), conversations with our Vice President of IT, and the inclusion of contractual requirements to maintain data protection safeguards and timely notification if the third party experiences a security incident which may have a critical impact on our business or our data. Additionally, we conduct cybersecurity awareness training for employees during onboarding and throughout the year, and we conduct regular phishing simulations in an effort to raise awareness of spoofed or manipulated electronic communications and other cybersecurity threats.


text: Cybersecurity Governance Our Board of Directors has delegated responsibility for overseeing our policies, practices and assessments with respect to cybersecurity and other information technology risks to the Audit Committee. Our Vice President of IT, under the supervision of our Chief Financial Officer, is responsible for the establishment and maintenance of our cybersecurity risk management program, including the day-to-day oversight of the assessment and management of cybersecurity risks. The Vice President of IT will regularly consult with outside security experts and management to evaluate certain aspects of the cybersecurity risk management program. The Vice President of IT has approximately 15 years of experience in information security and cybersecurity risk management. The IT team also institutes and maintains controls for our systems, applications, and databases.


text: The Vice President of IT reports on the status of our cybersecurity risk management program to management and our Audit Committee on a periodic basis, which may include a discussion of the results of our annual third party cybersecurity risk assessments and critical updates to our mitigation and remediation efforts.


text: Although risks from cybersecurity threats have to date not materially affected, and we do not believe they are reasonably likely to materially affect, us, our business strategy, results of operations or financial condition, we could, from time to time, experience threats and communicate security incidents relating to our and our third-party vendors' information systems. For more information, please see Item 1A- Risk Factors.

companyName: Kymera Therapeutics, Inc.

ticker: KYMR


text: The head of information technology and the CSSC have primary responsibility for assessing and managing our cybersecurity program. The head of information technology, who reports to the Chief Financial Officer, has more than 25 years of experience in building and leading information technology and security teams.


text: Based on an assessment using the previously described risk management processes, we do not believe that there are currently any known risks from cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, cybersecurity threats may affect our business. See "Our internal information technology systems, or those of our vendors, collaborators or other contractors or consultants, may fail or suffer security breaches, loss or leakage of data and other disruptions or compromise, which could result in a material disruption of our product development programs, compromise sensitive information related to our business or prevent us from accessing critical information, trigger contractual and legal obligations, potentially exposing us to liability, reputational harm or otherwise adversely affecting our business and financial results." in "Item 1A. Risk Factors" of this Annual Report on Form 10-K.

companyName: Dyne Therapeutics, Inc.

ticker: DYN


text: In an effort to deter and detect cyber threats, we periodically provide all employees with data protection and cybersecurity awareness training, which covers a range of timely and relevant topics. Past topics have included social engineering, phishing, password protection, confidential data protection, and asset use. The training functions to educate employees on the importance of reporting all security and privacy incidents immediately. We send out bi-weekly simulated phishing tests to all employees for ongoing awareness to relevant phishing campaigns. We also use technology-based tools to mitigate cybersecurity risks and to bolster its employee-based cybersecurity programs.


text: Our Information Technology department, under the leadership of our Vice President of Information Technology, or VP of IT, and with cross-functional internal and third-party support, helps identify, assess and manage our cybersecurity threats and risks. The Information Technology department identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and our and our industry's risk profile using various methods, including, for example, regular threat assessments (including through interaction with law enforcement when necessary), internal and external audits, threat environment scans and third-party threat assessments, vulnerability assessments, external intelligence feeds and third-party-conducted tabletop training exercises.

companyName: Vital Farms, Inc.

ticker: VITL


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, our Information Technology department and third-party providers work with our senior leadership team to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business. Our senior leadership team evaluates material risks from cybersecurity threats against our overall business objectives and reports to the audit committee of our Board of Directors, or Audit Committee, which evaluates our overall enterprise risk.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including professional services firms, threat intelligence service providers, penetration testing providers, cybersecurity consultants, forensic investigators, training platforms and managed cybersecurity service providers.


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting services, supply chain resources (including warehousing and cold storage) and contract manufacturing organizations. We have a vendor management program to manage cybersecurity risks associated with our use of certain of these providers. The program includes, for example, internal reviews of vendor security programs and assessments, security assessment calls with vendor personnel and imposition of information security obligations in our vendor contracts. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect our company and how they may do so, see our risk factors listed in Part 1, Item 1A of this Annual Report on Form 10-K, including the section titled "Risks Related to Cybersecurity, Information Technology and Intellectual Property."


text: Our Board of Directors addresses our cybersecurity risk management as part of its general oversight function. The Audit Committee is responsible under its committee charter for overseeing our company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of our management, including our VP of IT, with the oversight of our Chief Financial Officer. Our VP of IT is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy and communicating key priorities to relevant personnel. Our VP of IT, in consultation with our Chief Financial Officer, is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes and reviewing security assessments and other security-related reports. Our VP of IT has over 25 years of relevant experience, including leadership roles in the information technology departments of public and private companies. Prior to joining Vital Farms, he served as VP of IT for another public company in the consumer packaged goods industry.


text: Our cybersecurity incident response plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our internal disclosure committee and our senior leadership team. Senior leadership team members work with our company's incident response team to help Vital Farms mitigate and remediate cybersecurity incidents of which they are notified. In addition, our company's incident response plan provides for reporting of certain cybersecurity incidents to the Audit Committee.


text: The Audit Committee receives regular reports from our Chief Financial Officer and the VP of IT concerning significant cybersecurity threats and risk and the processes our company has implemented to address them. The Audit Committee's training includes participation in tabletop training exercises designed to test and evaluate our company's response to a cybersecurity incident. The Audit Committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: Risk Management and Strategy In the ordinary course of our business, we collect, use, store, and transmit digitally large amounts of confidential, sensitive, proprietary, and personal information. The secure maintenance of this information and our information technology systems is important to our operations and business strategy. To this end, we have implemented processes designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein. These processes are managed and monitored by a dedicated information technology team, which is led by our Chief Financial Officer and include mechanisms, controls, technologies, systems, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data and maintain a stable information technology environment. For example, we conduct vulnerability testing, data recovery testing, security audits, and ongoing risk assessments, including due diligence on and audits of our key technology vendors, and other contractors and suppliers. We also conduct periodic employee training on cyber and information security, among other topics. In addition, we consult with outside advisors and experts, when appropriate to assist with assessing, identifying, and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on the Company's risk environment.

companyName: HERON THERAPEUTICS, INC. /DE/

ticker: HRTX


text: In the last fiscal year, we have not identified risks from known cybersecurity threats, including any prior cybersecurity incidents, that have materially affected us. However, we face certain ongoing cybersecurity threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors."


text: Our Chief Financial Officer, who reports directly to the Chief Executive Officer and has over 15 years of experience managing information technology and cybersecurity matters, is responsible for assessing and managing cybersecurity risks. We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework.


text: The Board, as a whole and at the committee level, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate those risks. The Audit Committee, which is comprised solely of independent directors, has been designated by the Board to oversee cybersecurity risks. The Audit Committee receives regular updates on cybersecurity and information technology matters and related risk exposures from our Chief Financial Officer. The Board also receives updates from management and the Audit Committee on cybersecurity risks on at least an annual basis.


text: Risk Assessment, Identification and Management Processes We have implemented a cybersecurity risk management strategy to assess, identify and manage material risks from cybersecurity threats. This strategy is designed to protect our systems, data and operations from potential cyber threats and to ensure the continuity of our business operations.

companyName: Frontdoor, Inc.

ticker: FTDR


text: We conduct regular risk assessments to identify potential cybersecurity threats. These assessments involve evaluating our systems, networks and data for vulnerabilities that could be exploited by cyber threats through, among other things, vulnerability scanning and penetration testing. Once risks are identified, we implement measures to manage and mitigate these risks. This includes updating and patching our systems, implementing security controls and monitoring our networks for suspicious activity. We have a process in place to respond to any identified threats, which includes containment, eradication and recovery measures. We also monitor and update our cybersecurity risk management strategy to respond to the evolving cyber threat landscape. This includes staying abreast of the latest cybersecurity threats and trends and updating our systems and processes accordingly.


text: Integration with Overall Risk Management. Our cybersecurity processes are integrated into our overall enterprise risk management program and business continuity processes. In this regard, we address cybersecurity risks through a comprehensive, cross-functional approach across our technology, legal, compliance, finance and other teams aimed at preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. This integration helps ensure that the breadth of potential impacts from cybersecurity risks are considered and that our approach to managing these risks is consistent and coordinated across teams within our business. Through our enterprise risk management program, our cybersecurity risk is regularly evaluated, and we regularly report this assessment of our cybersecurity risk to management and to the audit committee of our board of directors. We also periodically review our cybersecurity risk with our entire board of directors.


text: Engaging Third Parties in Risk Management. We use a combination of internal resources and external assessors, consultants and auditors to conduct our cybersecurity risk assessments and identification. We periodically examine our cybersecurity program with these third parties, evaluating its effectiveness in part by considering industry standards and established frameworks, such as the National Institute of Standards and Technology, as guidelines, along with compliance with our internal cybersecurity controls. We also work with third parties to assess our incident response preparedness and to manage and track our risks.


text: Overseeing Risks Associated with Third-Party Service Providers. We have established a third-party risk management program to evaluate new and existing third-party service providers for their security controls and processes; identify cyber risks associated to the third-party service providers requiring remediation tracking; and continuously monitor the cyber risk posture of third-party service providers. Where appropriate, our contracts with third-party service providers require agreement and adherence to security and privacy requirements, including: the proper access, use, retention and deletion of data; security awareness training; security incident response and breach notification; our rights to security assessment, testing and audits; compliance with laws and industry standards; and system and services requirements. For example, we require our business process outsourcers, which are providers that support certain customer services operations and other services, to complete security awareness training and payment card industry data security standards training.


text: Risks from Cybersecurity Threats As of the date of this report, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition; however, see Item IA. Risk Factors in Part I of this Annual Report on Form 10-K for a discussion of effects that a cybersecurity threat or incident could have on our business strategy, results of operations or financial condition. We also maintain an incident response plan to respond to any cybersecurity incident. This plan outlines the steps we will take to respond to an incident, including identifying and containing the incident, eradicating the threat, recovering our systems and communicating with relevant stakeholders.


text: Board of Directors Oversight of Cybersecurity Risk Our board of directors is responsible for oversight of our enterprise risk management program, which incorporates cybersecurity risk. The audit committee undertakes primary responsibility for assisting the board of directors in overseeing cybersecurity risk, including policies and procedures for assessing, managing and responding to cybersecurity risk. The audit committee meets with appropriate members of our management team at least quarterly—and third-party assessors, consultants and auditors as needed—to review and discuss cybersecurity risk.


text: The full board of directors receives quarterly updates from the audit committee on its oversight of cybersecurity risk and engages in further review for the full board of directors from time to time as appropriate.


text: Management's Role in Assessing and Managing Material Risks Our technology team, and particularly our information security team, is actively involved in the development and implementation of policies and tools to assess risk and identify emergent risks, with cross-functional support from enterprise risk management, legal, compliance and finance, among other teams. We have established governance structures to increase the maturity of our cybersecurity program with a governance, risk and compliance approach. This includes the identification of internal weaknesses and the mitigation of information technology risks through training programs or new policies and internal controls.


text: Management is also responsible for the testing of the overall security posture and the documentation of risk management and security for regulatory examinations and for regular review of security and privacy requirements. In addition to our internal cybersecurity team, our company has retained a third-party security firm to aid in the identification, containment, eradication and recovery of systems, data or both in the event of a material security incident.


text: Risk Management Personnel. Among management, our Chief Information Security Officer ("CISO"), together with our Chief Operating Officer ("COO"), is responsible for leading efforts to assess and manage cybersecurity risks. Our CISO has over 20 years of experience assessing and managing cybersecurity risk, including leading information security teams at complex web-based businesses, and has a Master's degree in Computer Information Systems and multiple professional and cybersecurity certifications, including CISM, CDPSE, CIPM, CIPT, and PMP. Our COO oversees, among other things, our company's technology strategy and architecture and the integration and delivery of technology into our operations and service offerings. Our COO has over 10 years of experience supervising teams in implementations of key internal- and external-facing technology systems. Prior to joining the Company, our COO worked at a multinational public technology company and led teams in solving operations problems with technology. Our COO has a Bachelor's degree in Chemical Engineering, a Master's degree in Business Administration and a Juris Doctorate.


text: Monitoring Cybersecurity Incidents. On a daily basis, our information security team monitors, identifies and classifies potential cybersecurity events and is responsible for notifying the COO and CISO of such events as appropriate based on risk to our organization. Our COO and CISO are responsible for notifying executive leadership, other functional teams and our audit committee, as appropriate.


text: Reporting to the Board of Directors. Our COO and CISO report to the audit committee at least quarterly about the detection, prevention, mitigation and remediation of cybersecurity events, including information about the latest cybersecurity threats, the status of our prevention and detection measures and the effectiveness of our mitigation and remediation efforts, as well as any other cybersecurity risk management activities and the progress of related projects. These briefings include updates on the formalized incident response plan, communications and escalation procedures. Management will apprise the board of directors of cybersecurity incidents deemed to have a moderate or higher business impact, even if immaterial to us.


text: We have certain processes for assessing, identifying and managing cybersecurity risks, which are built into our overall information technology function and are designed to help protect employee and third party, including patient, information from unauthorized access or attack, as well as secure our networks and systems. Such processes include physical, procedural and technical safeguards and routine review of our policies and procedures to identify risks and enhance our practices. We have developed an incident response policy which is designed to help coordinate our response to, and recovery from, cybersecurity incidents, and includes processes to triage, assess the severity of, escalate, contain, investigate, and remediate incidents, as well as to comply with applicable legal obligations. Internally and through a third-party service provider, we regularly conduct tests on our systems and incident simulations to help discover potential vulnerabilities, which enable improved decision-making and prioritization and promote monitoring and reporting across compliance functions. As part of our overall risk mitigation strategy, we also maintain cyber insurance coverage; however, such insurance coverage may not be sufficient in type or amount to cover us against claims related to security breaches, cyber-attacks and other related breaches.

companyName: Verve Therapeutics, Inc.


text: Our Information Technology department is led by the Head of Information Technology, who oversees a team that includes the Director of Infrastructure and Security. This team is responsible for developing and executing our cybersecurity strategy, policies, standards, and processes. They collaborate closely with cross-functional departments to assess, mitigate, and manage cybersecurity risks, enhancing the security of our systems and the preparedness of our employees. The Head of Information Technology holds a Master of Science in Information Technology and has 20 years of experience in the biotechnology sector. The Director of Infrastructure and Security is a Certified Information Systems Security Professional (CISSP) and brings extensive expertise in securing enterprise infrastructure.


text: We annually provide all employees, including part-time and temporary employees, with a data protection, cybersecurity and incident response and prevention training and compliance program, which covers timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, asset use and mobile security, and educates employees on the importance of reporting all incidents immediately. We also use technology-based tools that are designed to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs.


text: Dominion Energy's Board of Directors, including its operations committee (effective in July 2024, previously its finance and risk oversight committee), provides oversight of the Companies' risks from cybersecurity threats. Dominion Energy's Board of Directors as well as its operations committee (effective in July 2024, previously its finance and risk oversight committee) receive presentations and reports throughout the year on cybersecurity and information security risk from management, including Dominion Energy's chief security officer, director of cybersecurity (CISO) and chief information officer. These presentations and reports address a broad range of topics, including the Companies' cyber risk management program, updates on recent cybersecurity threats and incidents across the industry, policies and practices, industry trends, threat environment and vulnerability assessments and specific and ongoing efforts to prevent, detect and respond to internal and external critical threats, including management's hosting in 2024 of its third practical exercise with external federal, state and local incident response partners. In addition, Dominion Energy's Board of Directors receives briefings from time to time from outside experts for an independent view on cybersecurity risks, including assessments by independent consulting firms and legal counsel of the Companies' readiness and resilience.

companyName: VIRGINIA ELECTRIC & POWER CO


text: The director of cybersecurity (CISO) has over 30 years of experience at Dominion Energy primarily in various roles within the information technology department, including information technology risk management, as well as cybersecurity. The director of cybersecurity (CISO) has been involved in designing and evolving the Companies' cyber risk management policies, practices and procedures. This individual has deep relationships with key external partners and is recognized within the industry and the U.S. as a leading cybersecurity expert.


text: The chief security officer and chief information officer are supported by the senior vice president of administrative services as well as the Companies' operations, compliance, legal, audit, corporate risk, supply chain, human resources and accounting departments in executing its cybersecurity program. In addition, the chief security officer and chief information officer provide periodic updates concerning recent developments affecting cybersecurity and privacy risk to the Companies' executive cyber risk council, which includes executive officers responsible for administrative services, corporate affairs, supply chain, corporate secretary and corporate risk along with legal counsel.


text: The Companies maintain a robust, tested and regularly revised Cyber Security Incident Response Plan and a Vendor Compromise Response Plan. These plans detail roles, responsibilities and actions to be taken in response to a detected event whether internal or associated with a third-party service provider. The plans provide clear direction for escalation of information to leadership, including Dominion Energy's Board of Directors as appropriate, and drive collaboration amongst relevant members of management representing cybersecurity, information technology, operations, supply chain, legal and accounting departments. As necessary, the COO, CFO and chief legal officer will advise the CEO on any incidents which could potentially have a material effect on the Companies' business operations, results of operations or financial condition.


text: As of December 31, 2024, the Company is not aware of any cybersecurity risks that have materially affected or are reasonably likely to materially affect the Company's business strategy, results of operations, or financial condition.

companyName: BlackRock TCP Capital Corp.

ticker: TCPC


text: BlackRock's cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by BlackRock's CISO. As of December 31, 2024, the CISO had over 30 years of experience in information technology with a 25-year concentration in information security, including previously serving as the CISO at several global financial institutions, and held the Certified Information Systems Security Professional certification. The CISO works closely with the leadership team and other subject matter experts in the global cybersecurity group, who collectively have extensive prior work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs and overseeing cybersecurity controls in technology risk and audit functions, as well as having relevant degrees and industry-leading certifications.


text: Our cybersecurity risk management program, which is informed by and incorporates elements of recognized industry standards, is designed to identify, assess, and mitigate critical risks from cybersecurity threats. This program includes, but is not limited to, ongoing monitoring for potential critical risks from cybersecurity threats using automated tools. To support our cybersecurity risk management program, we leverage a managed service provider, or MSP, that provides ongoing support for the protection of our information technology infrastructure as well as a virtual Chief Information Security Officer, or vCISO. Our cybersecurity risk management strategy is informed by periodic conversations with, and risk assessments conducted by, our vCISO.

companyName: Disc Medicine, Inc.

ticker: IRON


text: Governance Related to Cybersecurity Risks Our Head of Information Technology, or IT, under the oversight of our Chief Legal Officer, is responsible for the administration and maintenance of our cybersecurity risk management program, including the day-to-day oversight of the assessment and management of cybersecurity risks. The individual who currently holds the title of Head of IT has more than 20 years of experience in information security and cybersecurity risk management.


text: Our Head of IT directly reports to, and meets periodically with, our Chief Legal Officer to discuss and review our cybersecurity risk management processes, with input from the Company's MSP and vCISO, as appropriate.


text: Our board of directors has delegated oversight of the Company's cybersecurity program to the audit committee of the board of directors. As provided in the audit committee charter, the audit committee is responsible for reviewing and discussing the Company's information security and risk management programs, controls, and procedures, including high-level review of the threat landscape facing the Company and the Company's strategy to mitigate cybersecurity risks and potential breaches. Under the audit committee charter, the audit committee is also responsible for reviewing the recovery and communication plans for any unplanned outage, cybersecurity incident, or data breach.


text: Our Head of IT, twice a year, provides reports to the audit committee on the status of our cybersecurity program, including measures implemented to monitor and address risks from cybersecurity threats, as appropriate. He also reports on a quarterly basis to the executive committee on cybersecurity and information technology matters. The chair of the audit committee provides periodic reports on cybersecurity risk management to the full board of directors. Our Chief Legal Officer, on an annual basis, discusses the results of our enterprise risk assessment processes, including risks related to cybersecurity, with the full board of directors.


text: Dominion Energy's current security posture and regulatory compliance efforts are intended to address the evolving and changing cyber threats. During the past three years, DESC has no t experienced any cybersecurity incidents resulting in a material impact to their business strategy, results of operations or financial condition. DESC has identified the risk that a hostile cyber intrusion could severely impair DESC's operations, lead to disclosure of confidential information, damage Dominion Energy's reputation or otherwise have an adverse effect on DESC's business as disclosed under the Operational Risks header within Item 1A. Risk Factors.

companyName: DOMINION ENERGY SOUTH CAROLINA, INC.


text: Dominion Energy's Board of Directors, including its operations committee (effective in July 2024, previously its finance and risk oversight committee), provides oversight of risks from cybersecurity threats to all Dominion Energy operations, including DESC. Dominion Energy's Board of Directors as well as its operations committee (effective in July 2024, previously its finance and risk oversight committee) receive presentations and reports throughout the year on cybersecurity and information security risk from management, including Dominion Energy's chief security officer, director of cybersecurity (CISO) and chief information officer. These presentations and reports address a broad range of topics, including Dominion Energy's cyber risk management program, updates on recent cybersecurity threats and incidents across the industry, policies and practices, industry trends, threat environment and vulnerability assessments and specific and ongoing efforts to prevent, detect and respond to internal and external critical threats, including management's hosting in 2024 of its third practical exercise with external federal, state and local incident response partners. In addition, Dominion Energy's Board of Directors receives briefings from time to time from outside experts for an independent view on cybersecurity risks, including assessments by independent consulting firms and legal counsel of the Company's readiness and resilience.


text: The director of cybersecurity (CISO) has over 30 years of experience at Dominion Energy primarily in various roles within the information technology department, including information technology risk management, as well as cybersecurity. The director of cybersecurity (CISO) has been involved in designing and evolving Dominion Energy's cyber risk management policies, practices and procedures. This individual has deep relationships with key external partners and is recognized within the industry and the U.S. as a leading cybersecurity expert.


text: The chief security officer and chief information officer are supported by the senior vice president of administrative services as well as Dominion Energy's operations, compliance, legal, audit, corporate risk, supply chain, human resources and accounting departments in executing its cybersecurity program. In addition, the chief security officer and chief information officer provide periodic updates concerning recent developments affecting cybersecurity and privacy risk to Dominion Energy's executive cyber risk council, which includes executive officers responsible for administrative services, corporate affairs, supply chain, corporate secretary and corporate risk along with legal counsel.


text: Cybersecurity Governance Our Board, including the Governing Body, considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee of the Board (the "Audit Committee") oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program.

companyName: Endeavor Group Holdings, Inc.


text: The Audit Committee receives quarterly reports from management on our cybersecurity risks, and also receives, at least annually, a detailed briefing from management on our cyber risk management program's status including all strategic initiatives. In addition, management updates the Audit Committee, as necessary, regarding potentially significant cybersecurity incidents consistent with written escalation protocols, as well as incidents with lesser impact potential. The Audit Committee members also receive presentations on cybersecurity topics from our Chief Compliance Officer, Chief Information Officer, internal security staff or external experts as part of the Board's continuing education on topics that impact public companies. The full Board and the Governing Body receive regular updates regarding the Audit Committee's activities.


text: Integrated Overall Risk Management Assessing, identifying, and managing cybersecurity-related risks is integrated into our overall risk management framework. The Company conducts an annual cybersecurity risk assessment and reports the most significant risks and associated planned mitigation strategies to the Audit Committee of the Board of Directors. The annual risk assessment is carried out under the supervision of the Executive Vice President of Business Services and General Counsel, the President of Nucor Business Technology, the Company's Cybersecurity Director, and the Company's Vice President and Corporate Controller. See "Governance" below. The Board also regularly receives focused presentations regarding cybersecurity risks from the Company's Cybersecurity Director.

companyName: NUCOR CORP

ticker: NUE


text: Management's Role in Cybersecurity Risk Management A division of the Company known as Nucor Business Technology, or NBT, is responsible for the Company's information technology needs, including cybersecurity risk assessment and management. NBT's cybersecurity function is led by the Cybersecurity Director, who reports to the President of NBT, who in turn reports to the Company's Executive Vice President of Business Services and General Counsel and to the Chair, President, and Chief Executive Officer. The current Cybersecurity Director has more than twenty years of experience in the cybersecurity field and has broad expertise in cybersecurity threat assessments and detection, mitigation technologies, cybersecurity training, and incident response.


text: The Company also has a Risk Committee composed of the following members of the Company's management: • Executive Vice President of Business Services & General Counsel • President, Nucor Business Technology • Vice President and Corporate Controller • Vice President and General Manager, Corporate Legal Affairs • General Manager of Internal Audit • Cybersecurity Director • Director of Legal Compliance and Assistant Corporate Secretary • Manager of External Reporting The Risk Committee is responsible for overseeing the Company's response to cybersecurity incidents. The Risk Committee and the Chair, President, and Chief Executive Officer inform the Audit Committee and the Board of Directors on cybersecurity risks.


text: Monitoring of Cybersecurity Incidents The Cybersecurity Director implements and oversees our processes for regularly monitoring our information systems. This includes security measures and regular audits to identify potential issues. In the event of a cybersecurity incident, we have an established incident response plan that requires prompt notification of the Cybersecurity Director or their designee, who in turn oversees our assessment of and response to the incident. The Cybersecurity Director is also responsible for informing the Risk Committee of cybersecurity incidents, which in turn has a detailed process for assessing the impacts of incidents and monitoring the Company's mitigation and remediation efforts. Depending on the nature of the incident, this process also provides for escalating notification to senior executives, including the Chair, President, and Chief Executive Officer, the Executive Vice President of Business Services and General Counsel and to the Board of Directors.


text: Risk Management and Strategy The Company maintains a cyber risk management program to prevent, detect and respond to information security threats. This program is supervised by a dedicated Chief Information Security Officer (CISO) whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture and processes. The CISO manages the program in collaboration with the Company's businesses and functions. To mitigate the risk of cybersecurity threats and data breaches we also have established policies and procedures, including a Cybersecurity & Data Breach Incident Response Policy and identified an Incident Response Team (IRT) with defined roles, responsibilities and means of communication. As part of our broader risk management and control framework we have implemented cybersecurity controls over the information technology and process control systems of the Company and of its third-party service providers. The Company engages third-party organizations to assess the controls around sensitive data, including but not limited to financial, employee, customer and vendor data as well as data affecting our process controls and data used to operate our manufacturing and converting facilities. We work with an independent assessor to conduct interim assessments and track ongoing efforts to continuously improve the Company's cyber risk management program. The most recent assessment was completed at the end of 2022. In addition, the Company utilizes an independent audit firm to perform specific attack and penetration reviews on an annual basis. While we have experienced threats to our data and systems, as of December 31, 2024, we are not aware of any cybersecurity incidents that have materially impacted, or are reasonably likely to materially impact, our operations or financial condition.

companyName: PACKAGING CORP OF AMERICA

ticker: PKG


text: Board Roles and Responsibilities The Audit Committee of the Board of Directors oversees the Company's cyber risk management program. The Chief Information Officer (CIO) presents frequent updates to the Audit Committee and, as necessary, to the full Board of Directors. These regular reports include detailed updates on the Company's performance preparing for, preventing, detecting, responding to and recovering from cyber incidents. In addition, we have established processes to notify the Audit Committee of active incidents, as deemed necessary. The Company's program is periodically evaluated by third-party experts, and the results of those reviews are reported to the Board of Directors.


text: We are committed to implementing all reasonable measures to ensure the confidentiality, integrity and availability of data that is owned and managed by us. We also endeavor to protect confidential information that is shared with us by our business partners. The cybersecurity program at Koppers has been designed based on an industry standard cybersecurity framework and is aligned with local and regional compliance requirements. The cybersecurity program is reviewed periodically by an independent third-party, and the results are shared with the board of directors. Components of the cybersecurity program are guided by the results of the independent third-party assessment. The cybersecurity program is part of the larger Enterprise Risk Management (ERM) program which is reviewed by management and the board of directors on a periodic basis. Compliance with the cybersecurity program is ensured via policies, procedures, training, and systems.

companyName: Koppers Holdings Inc.

ticker: KOP


text: Information security policies at Koppers lay out the guardrails that ensure compliance with the program. Examples of guardrails set within the information security policies at Koppers include, where appropriate, application of the principle of least privilege when granting access (the principle that a user or entity should only have access to the specific data, resources and applications needed to complete a required task), logging and monitoring activity of privileged accounts, authorized physical and logical access to information technology (IT) systems, and requiring maintenance of confidentiality of non-public information. Standard operating procedures (SOPs) help to ensure accuracy and completeness of various IT tasks being performed throughout the organization. SOPs include incorporating data processing agreements in contracts, commissioning and decommissioning of IT systems, granting role-based user access, patch management, and change management. Training is conducted regularly for all employees who interact with Koppers IT systems. Specialized training is also conducted for employees who deal with sensitive data. Security systems have been deployed to manage vulnerabilities within the IT environment, and periodic penetration tests validate the Koppers security posture.


text: IT systems are protected using various tools like multi-factor authentication (MFA), virtual private network (VPN), firewalls, end-point protection, spam and web filters, mobile device management, and privileged access management. A third-party monitoring service aids in detecting any threats or anomalies with the network. A multi-department incident response plan has been developed to facilitate a swift response in the event of a cybersecurity incident, which includes notifying the appropriate regulatory agencies. IT systems critical to the business operations have been identified and plans have been developed for a swift recovery of IT services in the event of a service failure. We conduct annual security reviews of all service providers that provide critical service to the business. A cybersecurity risk assessment is conducted prior to contracting with a new IT cloud service provider providing high-impact services.


text: Identifying, assessing, and mitigating cybersecurity and related risks are disciplines we integrate into our overall enterprise risk management ("ERM") process. Our ERM process and cybersecurity policies are based on the National Institute of Standards and Technology and Consensus Audit Guidelines. As part of our process, we complete continuous vulnerability scanning, end point detection and response, employee cybersecurity awareness training, and security monitoring. To the extent our ERM process identifies any relevant heightened cybersecurity related threat, we assign risk owners to develop mitigation plans, which we then track until full execution aligned with our Incident Response Plan.

companyName: ExchangeRight Income Fund


text: Management's Role in Assessing and Managing Cybersecurity Risk ExchangeRight's Senior Information Technology and Enterprise Applications Manager leads our information security team, which is responsible for developing and executing our enterprise-wide cybersecurity strategy. With over 13 years of experience in information technology, security strategy, program management, and internal controls, our information security team brings extensive expertise in evaluating, implementing, and overseeing security initiatives that protect our organization from cyber threats.


text: The information security team's background includes information technology governance, risk management & compliance, security controls, and enterprise application security, ensuring our systems align with best practices and regulatory standards. As a control owner for Information Technology General Controls ("ITGCs"), they oversee security reviews, change management processes, and system integrity for critical applications, such as enterprise resource planning ("ERP") and enterprise software solutions. Additionally, they have played a key role in architecting and managing secure operational workflows, leading ERP implementations, and ensuring compliance with internal controls over financial reporting, pursuant to Section 302 of the Sarbanes-Oxley Act, and audit requirements.


text: Under their leadership, the information security team continuously strengthens our enterprise security posture, mitigating cyber risks while enhancing system resilience to minimize business disruptions. Recognizing that cybersecurity is a shared responsibility, they foster a corporate culture of security awareness and accountability, ensuring that employees beyond the security team remain vigilant against evolving cyber threats.


text: The Senior Information Technology and Enterprise Applications Manager notifies the Key Principals of our cybersecurity and information security posture as appropriate and the Key Principals are apprised of cybersecurity incidents deemed to have any relevant business impact. The Key Principals, Senior Information Technology and Enterprise Applications Manager, our Chief Financial Officer, Chief Accounting Officer, and our Executive Managing Principal maintain an open dialogue regarding emerging or potential cybersecurity risks. The Senior Information Technology and Enterprise Applications Manager keeps them appraised of updates on any significant developments in the cybersecurity domain, ensuring the Key Principals' oversight is both proactive and responsive.


text: The Senior Information Technology and Enterprise Applications Manager is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. The Senior Information Technology and Enterprise Applications Manager oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the information security team is equipped with a well-defined incident response plan. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.


text: Key Management Personnel As disclosed above, the primary responsibility for our overall information security strategy and directive resides with our Senior Information Technology and Enterprise Applications Manager with reliance on our information security team. With over 50 years of cumulative experience in the field, ExchangeRight's information security team brings a wealth of expertise to our organization. The team includes individuals with backgrounds in Information Technology, Data Science, Enterprise Applications, and Business Development. Their in-depth knowledge and expertise are instrumental in developing and executing our cybersecurity strategies.


text: Risks from Cybersecurity Incidents To date, we have not encountered, to our knowledge, a cybersecurity incident that has materially impaired, or is reasonably likely to materially impair, our operations or financial condition. There can be no assurance that such effects may not occur in the future.


text: Cybersecurity Governance, Risk Management and Strategy In the current digital environment, companies like ours may be the target of cyber-attacks or other malicious efforts to cause a cyber incident. These cyber incidents can include, but are not limited to, gaining unauthorized access to digital systems for purposes of misappropriating assets or sensitive information, corrupting data or causing operational disruption. The possible consequences of such an attack include but are not limited to loss of data, damage to our reputation, interruptions to our operations, and/or the need to pay ransom. Historically, we have not experienced cybersecurity incidents that materially impacted our business strategy, operating results and financial condition but we cannot guarantee a future cybersecurity incident would not materially impact us.

companyName: NEXSTAR MEDIA GROUP, INC.

ticker: NXST


text: We recognize the importance of maintaining the confidence and trust of our customers, suppliers, employees, audience, and communities by maintaining our data and information security. In managing our cyber risk, we utilize the National Institute of Standards and Technology Framework for Improving Critical Infrastructure Cybersecurity (the "NIST Framework") issued by the U.S. government as a guideline to manage our cybersecurity-related risk. In addition, we have established security control requirements for our third-party vendors based on global standards.


text: For additional discussion of certain risks associated with cybersecurity, see Item 1A, "Risk Factors" under the heading "Cybersecurity risks could adversely affect our operating effectiveness and operating results."


text: Risk Management and Strategy We are committed to our goal to protect sensitive business-related and personal information, as well as our information systems. We are subject to numerous and evolving cybersecurity risks that could adversely and materially affect our business, financial conditions and results of operations.

companyName: Domtar CORP


text: We believe cybersecurity is critical to advancing our technological developments. As a biopharmaceutical company, we face a multitude of cybersecurity threats common to most industries, such as ransomware and denial of service. Our customers, suppliers, subcontractors, and business partners face similar cybersecurity threats, and a cybersecurity incident impacting us or any of these entities could materially adversely affect our business strategy, performance, and results of operations. These cybersecurity threats and related risks make it imperative that we expend resources on cybersecurity.

companyName: Cardiff Oncology, Inc.

ticker: CRDF


text: We engage third-party services to conduct evaluations of our security controls, whether through penetration testing, independent audits, or consulting on best practices to address new challenges. We have established cybersecurity security awareness training and ongoing monitoring.


text: In the event of an incident, we intend to follow our cybersecurity incident response plan, which outlines the steps to be followed from incident detection to mitigation, and notification. We contract with external firms that have extensive information technology and program management experience. We have implemented a governance structure and processes to assess, identify, manage, and report cybersecurity risks. As a biopharmaceutical company, we must comply with extensive regulations, including requirements imposed by the Federal Drug Administration related to adequately safeguarding patient information and reporting cybersecurity incidents to the SEC. In addition to following SEC guidance and implementing pre-existing third party frameworks, we have developed our own practices and frameworks, which we believe enhance our ability to identify and manage cybersecurity risks. Assessing, identifying, and managing cybersecurity related risks are factored into our overall business approach. We rely heavily on our supply chain to deliver our products and services, and a cybersecurity incident at a clinical site, subcontractor, or business partner could materially adversely impact us. We require that our subcontractors report cybersecurity incidents to our IT Incident Response Coordinator who will investigate the direct impact of the incident. Once a potential incident has been confirmed, the Incident Response Coordinator will notify senior management that activation of the incident response plan is required and assign a severity rating, ranging from none to critical, based on the perceived impact.


text: The Audit Committee has oversight responsibility for risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements, cooperation with law enforcement, and related effects on financial and other risks, and it reports any findings and recommendations, as appropriate, to the full Board for consideration. Senior management regularly discusses cyber risks and trends and, should they arise, any material incidents with the Audit Committee.


text: Our Information Technology Lead is responsible for the strategic leadership and day-to-day management of our cybersecurity risk management program. The individual is working in that role for more than 10 years for the company. We also engaged with third-party IT service providers, who specialize in the field of cybersecurity risk management, for targeted employee training and system risk assessments.


text: While we have not experienced any material cybersecurity threats or incidents in recent years, there can be no guarantee that we will not be the subject of future threats or incidents. Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. See "Risk Factors" for a discussion of cybersecurity risks.


text: The Company maintains a cybersecurity risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. The program is integrated within the Company's enterprise risk management framework and addresses both the corporate information technology environment and the external ecosystem.

companyName: ROCKET PHARMACEUTICALS, INC.

ticker: RCKT


text: The underlying controls of the cybersecurity risk management program are based on recognized best practices and standards for cybersecurity and information technology. The Company has a third party perform an annual assessment of the Company's cybersecurity risk management program. The Company has a Cyber Security Operations Center monitoring our global cybersecurity environment and coordinates investigations and remediation of alerts. We are enhancing our programs for staging incident response drills to prepare support teams for a significant incident. The cybersecurity risk management program includes administrative, physical, and technical controls.


text: Our VP, Head of Information Technology is the Company's designated Chief Information Security Officer (CISO) and is responsible for developing and implementing the cybersecurity risk management program, including and reporting on cybersecurity matters to the Board. The VP, Head of Information Technology has over twenty years of experience leading cybersecurity oversight. Additionally, members of the IT security team have cybersecurity experience and/or certifications, such as the Certified Information Systems Security Professional and Certified Information Systems Audit credential. The Company views cybersecurity as a shared responsibility across our management team and plans to periodically perform simulations and tabletop exercises at a management level and incorporate external resources and advisors as needed. All employees are required to complete cybersecurity training at least once annually and have access to more frequent cybersecurity training through online and live events. We also require employees in certain roles to complete additional role-based, specialized cybersecurity training that is documented in our quality management system. Employees outside of our corporate information security organization also have a role in our cybersecurity defenses and they are immersed in a corporate culture supportive of security, which we believe improves our cybersecurity.


text: Our Chief Information Security Officer is responsible for continuously monitoring and assessing the Company's cybersecurity risk management program, informing senior management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents, and supervising such efforts. The cybersecurity team collectively has decades of experience selecting, deploying, and operating cybersecurity technologies, initiatives, and processes around the world, and relies on threat intelligence as well as information obtained from governmental, public, and private sources, including external consultants engaged by the Company on a real time basis. The Company is continuously enhancing its processes for oversight of third-party vendors, including appropriate due diligence for new providers and continuous monitoring, including ongoing direct contact with vendor personnel. Third-party vendors are re-evaluated at regular intervals as part of our supplier qualification process.


text: The Audit Committee, in addition to the Company's Chief Financial Officer, General Counsel and Chief Compliance Officer, oversees the Company's cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. The cybersecurity team briefs the Audit Committee, Chief Financial Officer, General Counsel and Chief Compliance Officer on the effectiveness of the Company's cyber risk management program, generally on a quarterly basis. In addition, cybersecurity risks will be reviewed by the Board of Directors, at least annually, as part of the Company's corporate risk mapping exercise.


text: We have not experienced any material cybersecurity incidents to date, and, by default, we believe no cybersecurity events have occurred that have materially affected the Company or its business strategy, results of operations or financial condition. We continue to invest in cybersecurity and the resilience of our infrastructure and the enhancement of our internal controls and processes, which are designed to help protect our systems and data, and the information they contain. For more information regarding the risks we face from cybersecurity threats, please see "Risk Factors."


text: Key elements of our cybersecurity risk management program include but are not limited to the following: • risk assessments designed to help identify material risks from cybersecurity threats to our critical systems and information; • an information technology team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers with subject matter expertise, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, incident response personnel, and senior management; and • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.

companyName: LENSAR, Inc.

ticker: LNSR


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity risks, including oversight of management's implementation of our cybersecurity risk management program.


text: The Audit Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the Audit Committee, where it deems appropriate, regarding any cybersecurity incidents it considers to be significant or potentially significant.


text: Our management team takes steps to stay informed about and monitors efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal information technology personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: We face a number of cybersecurity risks in connection with our business and recognize the growing threat within the general marketplace and our industry. To help the Company address these risks, we have implemented a cybersecurity risk management program that is informed by recognized industry standards and frameworks and incorporates elements of the same, including elements of the National Institute of Standards and Technology Cybersecurity Framework. Our cybersecurity risk management program is integrated within our enterprise risk management program.

companyName: Intellia Therapeutics, Inc.

ticker: NTLA


text: Our cybersecurity risk management program includes a number of components, including but not limited to a Cybersecurity Incident Response Plan ("CSIRP"), annual cybersecurity awareness training for our employees, security assessments, vendor risk management, regular system maintenance including application of security patches as appropriate, regular penetration testing and implementation of enhancements to security measures used to protect our systems and data. We employ third parties, including assessors, consultants and auditors, in our cyber risk management program as appropriate, e.g., training, assessment, auditing, benchmarking, and penetration testing.


text: Our CSIRP is designed to guide our incident response process for cybersecurity incidents that could affect our systems, network, or data. The CSIRP identifies the individuals responsible for developing, maintaining, and following appropriate procedures related to identified cybersecurity incidents, including a framework for identifying and addressing material cybersecurity incidents. We periodically test our CSIRP using tabletop exercises with the goal of improving our processes and preparedness.


text: Risks from cybersecurity threats have not to date materially affected us, including our business strategy, results of operations or financial condition. For more information about the cybersecurity risks we face, see the risk factor entitled "Our internal computer systems, or those of our collaborators or other contractors or consultants, may fail or suffer security breaches, incidents or compromises, which could result in a disruption of our operations and development efforts" in Item 1A. Risk Factors.


text: The Board of Directors, as a whole and through its committees, has responsibility for the oversight of risk management, which includes ensuring that the risk management process implemented within our organization is appropriate and functioning as designed. The Audit Committee of our Board of Directors oversees cybersecurity risks pursuant to its charter, and our governance framework includes oversight by the Audit Committee. The Audit Committee, with assistance from our management, including our Head of Information Technology ("IT"), periodically reports to the full Board of Directors to inform them of potential cybersecurity risks and threats, the status of projects to further develop our information security systems, and the emerging cybersecurity threat landscape.


text: Our Head of IT has primary responsibility for day-to-day management of our cybersecurity risk management program, including leading a dedicated team of IT professionals to monitor and assess cybersecurity risks, and is responsible for strategic leadership of our cybersecurity risk management program. The Head of IT role is currently held by an individual who has close to twenty years of professional IT management experience in the life sciences industry. Our Head of IT also provides regular updates on our cybersecurity risk to our executive leadership team and other management committees responsible for IT and cybersecurity risk management. Under our CSIRP and other applicable policies and procedures, we have established a framework for responding to cybersecurity incidents based on severity of the incident, which includes escalation to our executive leadership team and other management committees and assessment of materiality of cybersecurity incidents individually and in the aggregate.


text: Risk Management and Strategy. The cybersecurity program at Cars Commerce is part of our enterprise risk management program. At Cars Commerce, we believe cybersecurity risk management is of the utmost importance. As a result, Cars Commerce has implemented an information security management system (the "ISMS") designed to protect our infrastructure from potential threats and to allow us to assess, identify and manage material risks from cybersecurity threats as described in more detail below. The ISMS supports the security safeguards that are designed to protect the confidentiality, integrity, availability, and contractual compliance of the Cars.com Inc. (d/b/a Cars Commerce, Inc.) entities, which include Cars.com LLC, Accu-Trade, LLC, CreditIQ, LLC, DealerRater.com LLC and Dealer Inspire Inc. which is inclusive of the In-Market Video and NewCars brands. In addition, we engage with external resources to contribute to, and provide independent evaluation of, our existing cybersecurity practices. As a result, in 2023, Cars Commerce engaged an independent auditor to conduct an audit of the ISMS, and Cars Commerce completed the certification to meet International Organization for Standardization 27001 requirements for the above-stated entities. In October 2024, Cars successfully completed its ISO 27001 surveillance audit. In November 2023, Cars Commerce, through its subsidiary, completed the acquisition of D2C Media. During the due diligence, Cars Commerce completed an evaluation of its cybersecurity risk management process and plans to integrate D2C Media into the ISO 27001 certification process.

companyName: Cars.com Inc.

ticker: CARS


text: Protect. Our employees are the first line of defense against cybersecurity incidents. As such, employees receive annual security awareness training to understand the behaviors and technical requirements necessary to protect information. We also conduct annual phishing awareness exercises to educate employees to recognize and report suspicious activity. We also use a combination of tools and in-house technologies to protect Cars Commerce, our employees and our customers, including but not limited to using only SOC 2 compliant hosting providers, anti-malware software, intrusion prevention systems, network and web application firewalls, multi-factor authentication, encryption, and remote access via virtual private network ("VPN") software.


text: Respond and Manage. When detected, suspected cybersecurity threats are escalated to the Information Security Team (as described below) in various ways based on the nature of the cybersecurity incident, including but not limited to system engineer escalation, the Cars Commerce helpdesk and in-house and third-party security tools. Cars Commerce employees are also responsible for reporting any suspected cybersecurity or information security event that they observe or experience as soon as possible, by either contacting the Cars Commerce helpdesk, or the Information Security Team directly. The Information Security Team then creates a Security Incident Response Team ("SIRT") which, depending on the incident, is comprised of cybersecurity staff, Systems and Network Engineers, the Chief Technology Officer and the Chief Legal Officer, or other stakeholders as appropriate. The SIRT investigates and manages the impact of cybersecurity incidents in accordance with the security incident response procedures.


text: Report. Following the conclusion of a security investigation, the SIRT prepares a report for the Information Security Governance Committee, as appropriate. The report includes information about the incident, details about the response and includes recommendations to prevent similar security events from occurring in the future. Additionally, the Information Security Team provides the Audit Committee and the Board with regular updates on cybersecurity matters, including recent cybersecurity threats and incidents and ongoing efforts to prevent, detect and respond to internal and external cybersecurity threats.


text: The SEC adopted rules requiring the disclosure of material cybersecurity incidents. To ensure compliance with the SEC requirement, Cars Commerce has a review process to determine whether the impact of a cybersecurity threat is material and requires disclosure of the cybersecurity incident. In compliance with the SEC rule and Cars Commerce's process, if such a cybersecurity incident occurs and the appropriate representatives from the Information Security Governance Committee determine that the cybersecurity incident is material, Cars Commerce will make the appropriate disclosures in a Current Report on Form 8-K within the required timeframe.


text: Governance. The Board of Directors provides strategic guidance regarding Cars Commerce's overall risk oversight, including identification, management and mitigation of risk. The Board has delegated direct cybersecurity and information security risk oversight to the Audit Committee. Cars Commerce management provides the Audit Committee with regular updates at least quarterly regarding the effectiveness of Cars Commerce's overall cybersecurity program and other cybersecurity related matters, which may include, Cars Commerce's inherent cybersecurity risks, updates on recent cybersecurity threats and incidents, policies and practices, industry trends, regulatory developments, threat environment and vulnerability assessments and specific and ongoing efforts to prevent, detect and respond to internal and external cybersecurity threats. The Chair of the Audit Committee informs the Board of the outcome of these meetings through updates presented to the Board at regularly scheduled Board meetings.


text: At the management level, our CEO provides general management, oversight and mitigation of Cars Commerce's risk. Our Chief Technology Officer and Senior Vice President of Information Security manage Cars Commerce's Information Security function. The Information Security Team is composed of skilled professionals with relevant information and cybersecurity education, certifications and experience. The Information Security Team coordinates with the Cars Commerce Information Security Governance Committee, comprised of senior business leaders who support Cars Commerce's Information Security Management System based on their area of expertise. Cars Commerce's Information Security Team, in conjunction with the Information Security Governance Committee, assesses and manages material risks from cybersecurity threats and provides management direction and support for information security. Working together the teams initiate and control the implementation and operation of information security within Cars Commerce.


text: Item 2. Properties. We do not own any material real property. Our principal executive offices are located in Chicago, Illinois. We also lease a production studio in Chicago, Illinois and administrative offices in Canada. We terminated our Naperville, Illinois office lease effective February 2024.


text: Item 3. Legal Proceedings. From time to time, the Company and its subsidiaries may become involved in actions, claims, suits or other legal or administrative proceedings arising in the ordinary course of business. The Company does not expect, based on circumstances currently known, that the ultimate resolution of any of these proceedings will have, either individually or in the aggregate, a material adverse effect on the Company's consolidated financial position, results of operations or cash flows. We hereby incorporate by reference Note 10 (Commitments and Contingencies) to the Consolidated Financial Statements included in Part II, Item 8. "Financial Statements and Supplementary Data" of this Annual Report on Form 10-K.


text: Cybersecurity Risk Management and Strategy We have established policies and processes for identifying, assessing, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein. We design and are assessing our cybersecurity risk management program based on the ISO 27001:2022 standard, for which we received certification in 2024. We use the ISO 27001:2022 framework as a structure to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Merus N.V.


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with IT and management. Personnel at all levels and departments are made aware of our cybersecurity policies through regular communication, trainings and mock cybersecurity exercises to increase company awareness.


text: We engage consultants, auditors or other third parties in connection with our risk assessment processes. These parties assist us with designing and implementing our cybersecurity policies and procedures, as well as to monitor and test our safeguards, and investigations on an as needed basis. We contractually require third-party service providers to implement and maintain appropriate security measures, consistent with applicable laws, to implement and maintain reasonable security measures in connection with their work with us.


text: Our team that is responsible for assessing and our material risks from cybersecurity threats, including our Chief Operating Officer, Chief Financial Officer, and Executive Director, Head of IT Security and Compliance, which collectively have more than a combined 30 years of risk management experience. Our team's experience includes the Executive Director, Head of IT Security and Compliance, who has an extensive (25+ years) track record on cyber- and IT risks management, developing security and compliance programs and frameworks and leading IT security organizations, our Chief Financial Officer who, serving that role at Merus and prior companies and serving previously as Audit Committee chairperson for Merus and current Audit Committee chairperson at Kala Pharmaceuticals, has devoted significant attention to evaluation of risks posed by cybersecurity threats, and means to mitigate those risks, while evaluating strategies to gain a high level of cyber security, and our Chief Operating Officer, who has managed the IT organization at Merus for approximately five years and has devoted significant attention to evaluation of risks posed by cybersecurity threats, and means to mitigate those risks, and review of U.S. jurisprudence concerning protection of confidential information and trade secrets and has participated in trainings on cybersecurity threat defense and response, and cybersecurity strategies from a legal perspective.


text: Since we understand that cybersecurity threats are complex and evolving, we have a dedicated team of both internal and external cybersecurity experts, which is led by our Chief Information & Cybersecurity Officer ("CICSO"). This team is responsible for publishing information technology and security policies, promoting compliance with those policies, implementing a program to mitigate potential threats, and performing periodic risk and maturity assessments. Our risk mitigation measures include network segmentation, cyber protection and containment, detection and response, and recovery. The primary goal of this team is to decrease the risk of cyber incidents having a material impact.

companyName: TREACE MEDICAL CONCEPTS, INC.

ticker: TMCI


text: The CICSO has over three decades of technology experience, working for leading technology and consulting companies and previously served as chief information and cybersecurity officer for both public and private medical device and healthcare organizations. Our cybersecurity team includes a former chief information security officer for large healthcare organizations, a former head of global security for a major enterprise cybersecurity platform, and other similarly credentialed professionals. Our CICSO reports to the Chief Financial Officer and provides regular reports to the Audit Committee on cybersecurity policies, procedures, and risk and remediation efforts. Our CICSO also serves on our Disclosure Committee and has regular dialogue with the senior management team on information security matters and risk management practices.


text: The CICSO is regularly informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. We believe this ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. The cybersecurity team implements and oversees processes for the regular monitoring of our information systems. In the event of a cybersecurity incident, the cybersecurity team follows a written security incident response runbook, which includes procedures to, among other things, respond to the incident, mitigate its impact, and evaluate and satisfy applicable obligations.


text: Risk Management and Strategy As part of our overall approach to integrated risk management, we have established an information security program that includes policies, processes, and organizations to assess, identify and manage risk from information security threats, including cybersecurity threats, and including risks related to third parties, such as partners, vendors, and suppliers. The program also includes an incident response plan that is designed to provide controls and procedures for responding to cybersecurity or other security incidents. We have established an Information Security team that is responsible for overseeing the program across the Company, including with respect to information, personnel, and facilities. The Information Security team is led by our Chief Information Security Officer, or CISO, who coordinates with other departments in areas such as facilities, physical security, operations, data protection, information technology, product development, finance, legal and compliance.

companyName: OneStream, Inc.

ticker: OS


text: Regular assessments and reviews, through both internal and external experts, are conducted on OneStream information assets and networks, including systems, devices, applications, solutions and related computing resources, to evaluate potential risks and vulnerabilities, identify actions to be taken, and evaluate the effectiveness of our cybersecurity program. Risk management exercises occur regularly and in response to changes in Company operations, risk landscape, and threat actor activities, using tabletop exercises, threat modeling, risk forecasting, and other techniques to monitor and evaluate the sufficiency of our policies, processes and controls. Internal assessments occur based on results from risk management exercises, changes in infrastructure, cybersecurity risks, threat actor activity, and in response to other internal or external events. External assessments are conducted by third-party assessors, consultants or auditors, as relevant, and occur regularly in order to maintain our certifications and accreditations with certain compliance regimes (for example, FedRAMP). Additionally, the Company utilizes third-party software, services and providers in our cybersecurity program in furtherance of our security processes such as endpoint security, threat intelligence, cloud security, and authentication services.


text: We also provide employees with policies and training in areas such as ethics, information security, social engineering, data protection, and compliance, and with regular updates on the cybersecurity program and potential threats.


text: We are aware of the risks associated with engaging third-party service providers and other third parties. We have implemented risk-based processes to oversee and manage these risks, including, where appropriate, contractual requirements to implement technical, administrative, cybersecurity, and physical measures to protect the security and confidentiality of OneStream information (including customer information), and to notify the Company promptly of relevant security incidents. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third parties.


text: We face a number of cybersecurity risks in connection with our business. To date, our business, operating results and financial condition have not been materially affected by cybersecurity incidents. For additional information, please refer to Item 1A. "Risk Factors" in this Annual Report on Form 10-K, including the risk factors under the section titled "Risk Factors—Risks Related to our Technology and Intellectual Property."


text: Management is responsible for the day-to-day management of risks we face, including risks related to cybersecurity. Primary responsibility for our cybersecurity program is assigned to our CISO, who joined OneStream in May 2017 and has served as our CISO since December 2020. He has over 28 years of cybersecurity experience in the commercial and government sectors and works directly with the Information Security team to oversee and implement our cybersecurity program, including the policies and processes described in "Risk Management and Strategy" above. Our CISO reports directly to our Chief Risk Officer, or CRO. The CISO and the CRO both participate in regular meetings of our Operations and Risk Committee, a management committee which monitors risks across the Company, including cybersecurity and other information security risks.


text: Our board of directors, which has overall responsibility for enterprise risk management, has delegated to our audit committee primary oversight of cybersecurity risks and the processes to manage them. The audit committee regularly reviews and discusses with our CISO, CRO, and other senior management our policies and processes designed to identify, monitor and address enterprise risks, including risks from cybersecurity threats and incidents. Material cybersecurity threat risks are also considered during board of directors and audit committee meeting discussions of matters like enterprise risk management, operational budgeting, business continuity planning, and other relevant matters. In addition, at least annually, our board of directors discusses our programs and policies related to cybersecurity and considers them from a risk management perspective and as part of OneStream's business strategy.


text: As our Information Security team monitors the security and effectiveness of our policies and processes, they also work to keep the CISO, CRO and other members of leadership informed of critical incidents, process updates, or other material details, in accordance with our internal reporting structure. Depending on the nature and severity of an incident, this reporting structure provides for escalating notification to our CEO and the board of directors.


text: We recognize the importance of developing, implementing, and maintaining robust cybersecurity measures to maintain the security, confidentiality, integrity, and availability of our business systems and commercially sensitive or confidential information. Our business depends on the proper functioning and availability of our information technology platforms, including communications and data processing systems. We are also required to effect electronic transmissions with third parties including clients, vendors and others with whom we do business, and with our Board. We also recognize that, as we continue to increase our dependence on information technologies to conduct our operations the risks associated with cybersecurity also increase.

companyName: LSB INDUSTRIES, INC.

ticker: LXU


text: We utilize an enterprise-wide risk management process to identify, assess, track and manage risks faced by our organization. The Company's Enterprise Risk Management Committee ("ERM Committee"), is designated with the responsibility to direct our risk management program and to execute our risk management strategy, including cyber, technology, and third-party risk. To protect our information systems and operations from risks and to execute our cyber strategy, we use various security processes and technology tools that help identify, investigate, assess, prevent, and resolve potential vulnerabilities and security incidents in a timely manner. These include, but are not limited to, detection, monitoring and reporting processes and tools. Our team uses widely adopted methods and models to identify, evaluate, prioritize, and manage cyber and technology risks and develop and implement related information security safeguards. In partnership with third party advisors and consultants, we conduct regular reviews and tests of our program and leverage audits, penetration and vulnerability testing, cyber risk tabletops and security awareness trainings, and other business resilience exercises to evaluate the effectiveness of our program and improve our security measures. Our information security policies are designed to address current applicable legal requirements and to align with industry-recognized frameworks for cyber risk management. These standards cover physical, administrative, and technical safeguards and address a wide range of current cyber threats, including from third-party service providers. These policies and standards are reviewed and updated on a regular basis in order to respond to the constantly changing threat landscape.