text: Many of our key IT systems are "software as a service" solutions provided by third parties with extensive experience and knowledge in addressing cybersecurity risks involving those systems and have their own robust system of controls regarding their software products, which we monitor on a recurring basis through review of independent reports on their systems of internal controls provided to us. Such IT systems include our primary accounting, financial reporting, payroll and employee benefits, document storage, email and video communication, employee expense reporting and our internal IT ticketing and asset control systems. Our internal IT team holds regular weekly meetings to discuss cybersecurity-related items such as (i) operating and application system patching, (ii) phishing attempts, (iii) malware, (iv) non-compliant devices, (v) third-party secure scorecard results, and (vi) alerts provided through our Security Operations Center.

companyName: FTC Solar, Inc.

ticker: FTCI


text: In order to further protect ourselves financially, we maintain insurance coverage of up to $ 3 million with respect to losses from business interruption, data recovery, cyber-extortion and ransomware, data breach response and crisis management as a result of a cybersecurity incident.

secItem: Item 1C


text: During 2024, members of o ur Cybersecurity Governance Committee included our Chief Financial Officer, Vice President of Software, Senior Manager of IT, Corporate Controller, Director of SEC Reporting and Technical Accounting, and Director of Internal Audit. Our Chief Financial Officer, Corporate Controller, Director of SEC Reporting and Technical Accounting and Director of Internal Audit each have a number of years of experience in auditing internal controls and assessing risk processes of public companies, including controls involving a company's information technology systems. Our Vice President of Software has a number of years of experience leading software development efforts, including ensuring new software has proper safeguards included to minimize the risk of cybersecurity events. Finally, our Senior Manager of IT has a number of years of experience in implementing and monitoring controls and processes in a company's information technology systems environment that are designed to minimize the risk of cybersecurity events. Accordingly, we believe the members of our Cybersecurity Governance Committee have relevant knowledge and experience in either IT systems, auditing of controls over IT systems, or management and assessment of risk processes and internal control systems to ensure proper management oversight.


text: Our IT management is responsible for notifying the Cybersecurity Governance Committee of cyber incidents they become aware of from software alerts, third-party vendors, employees or by other means. The Cybersecurity Governance Committee will review such incidents, including activities by IT management to evaluate the severity of the incidents, and will provide details of any cybersecurity events, including those not deemed to have a material impact, to our Internal Controls and Disclosure Committee for reporting to our Audit Committee. In addition, our Chief Financial Officer, Senior Manager of IT and Director of Internal Audit maintain an ongoing dialogue with the Audit Committee during the year regarding emerging or potential cybersecurity risks.


text: Our information technology (IT) systems process, store, and transmit sensitive information, and we are heavily reliant on IT to operate our business. As such, IT security is viewed as a critical aspect of our business and one which we must continually evaluate and optimize in order to ensure ongoing effectiveness across the business in meeting the challenge of evolving cyber threats.

companyName: Loar Holdings Inc.

ticker: LOAR


text: We have incorporated a number of technical, administrative and personnel controls in order to holistically address cybersecurity threats across the business.


text: Cybersecurity Policies and Standards We have a comprehensive collection of documented policies and standards that are leveraged to establish and affirm expectations for security controls, mitigate known cybersecurity risks and provide consistent levels of protection across the Company. Our policies and standards are effective in meeting numerous compliance requirements while simultaneously reducing duplication of controls.


text: Incident Response Our incident response plan provides consistent guidance for preparing for cybersecurity incidents and events, establishes clear ownership of roles and responsibilities during a cyber incident, and has inter-dependent processes for detecting and responding to cyber incidents to include leveraging guidance from the legal team. We have retained a trusted and experienced third-party investigator/negotiator, and also maintain cybersecurity insurance to help mitigate the risk of a catastrophic cyber event.


text: Technical Controls We have implemented a technical security architecture consisting of a multitude of controls to identify, protect, detect, and respond to cybersecurity events. Continually evaluating common and best practices for deploying these controls, as well as determining when new or alternative controls may be more appropriate or effective, aids in our ability to counter actions from evolving threat actors. We also leverage various sources of cyber intelligence to ensure that technical controls maintain optimal configuration and deployment models to increase control effectiveness.


text: Third Party Security Monitoring Leveraging an industry recognized expert in cybersecurity monitoring, we have incorporated cybersecurity monitoring to increase visibility, awareness and responsiveness to cyber threat actors. Our monitoring partner is able to quickly analyze and alert us to suspicious activity, as well as take part in any active cyber investigation when necessary. The monitoring expertise provided allows us to focus on other aspects of cybersecurity while simultaneously ensuring that we are prepared to detect and respond appropriately to security incidents.


text: Testing and Validation We have incorporated multiple avenues of control and process testing and validation across the company. Our internal audit team regularly tests controls against established policies and standards. We leverage a trusted partner for performing regular penetration tests, to include phishing simulation exercises. Our IT and security team regularly conduct control validation exercises for each of the business units. We conduct regular incident response tabletop exercises to test and validate awareness of roles and responsibilities of incident responders across the organization and to educate individuals as to real world security incident scenarios.


text: Security Awareness All employees are required to undertake security awareness training on a number of topics to include phishing awareness, importance of cybersecurity and proper cyber hygiene, insider threat awareness and roles and responsibilities. Our IT and security teams regularly update training modules being leveraged in order to provide timely and relevant awareness, as well as to aid in better individual engagement with the training.


text: Management of Third-Party Risks We manage third-party risks from vendors and service providers by requiring that providers comply with our cybersecurity requirements and employ appropriate security controls in accordance with local, state and Federal laws. We evaluate applicable security controls of vendors and providers prior to contracting and at least annually thereafter. We evaluate the impact of any control deficiencies or exceptions identified during the review process and consider the effectiveness of the service provider's remediation plans and their commitment to addressing identified issues when determining continued engagement with the service provider.


text: Board Oversight and Management's Role Our cybersecurity program is led by our Chief Information Security Officer (CISO) at the direction of the CFO in coordination with our Director of IT. Our CISO has over 30 years of experience in cybersecurity and cyber risk management. His role includes assessing enterprise cybersecurity risks, developing policies and standards for the cybersecurity program, developing strategies for mitigating cybersecurity risks and informing senior leadership on cybersecurity related issues and activities affecting the organization. The CISO works with the IT and security team to implement cybersecurity controls across the organization.


text: Our Board of Directors is ultimately responsible for cybersecurity risk and has delegated its oversight to the Audit Committee. The Audit Committee considers cybersecurity risks in connection with its financial and compliance risk oversight role. The Audit Committee receives updates on cybersecurity risks and key initiatives for mitigating those risks from the CISO and CFO. For more information about the potential impact of cybersecurity risks, please refer to Item 1A. Risk Factors.


text: Cybersecurity is a significant and integrated component of the Company's risk management strategy. As a financial services company, cyber threats are present and growing, and the potential exists for a cybersecurity incident to occur, which could disrupt business operations or compromise sensitive data. The Company takes very seriously the responsibilities to protect sensitive client information, technology resources, and shareholder value from the risk of cyber threats and incidents. The Company has not identified risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, financial condition or results of operation. Risks relating to cybersecurity and their potential impact are discussed more fully in "Risk Factors" in Part I, Item 1A herein.

companyName: LINKBANCORP, Inc.

ticker: LNKB


text: Additionally, we employ innovative technology solutions designed to identify, protect, detect, and mitigate cybersecurity threats through the use of firewalls, intrusion detection systems, patching, endpoint detection and response, encryption, multi factor authentication, and data backups to immutable storage.


text: We regularly engage third-party assessors, auditors, and solutions to test and evaluate our controls for managing cybersecurity threats. These engagements include penetration testing, vulnerability assessments, internal and external audits, security framework maturity assessments for continued focus and improvement, and social engineering tests of the effectiveness of our employee training to monitor our security posture. We leverage a managed security service provider to monitor users, application, infrastructure, and network activity on a 24/7/365 basis to detect and alert the cyber security operation team of cyber threats and potential cybersecurity events of concern.


text: The Company relies on third-party vendor solutions to support its operations; many of these vendors have access to sensitive and proprietary information. We exercise a detailed vendor due diligence evaluation during the onboarding and periodically review vendors with access to sensitive Company data. The Company requires contracts with third parties to incorporate industry and regulatory standard clauses requiring reporting to the Company of the occurrence and mitigation of cybersecurity threats and incidents as well as to maintain adequate levels of cybersecurity insurance coverage.


text: In the event of a cyber incident, the Company created and maintains a Business Contingency Program. This program provides guidance to prepare, detect, analyze, remediate and recover business operations with the least impact to the Company and its customers.


text: Cybersecurity Governance The Company has established an Information Security Committee consisting of the Chief Operations & Technology Officer, Chief Risk Officer, and department representatives across multiple functional areas of the Company to focus on cybersecurity strategic and tactical delivery, policy oversight, monitoring of key cybersecurity risk indicators, and the assessment and management of cyber risk threats. The Committee is assisted by a Virtual Chief Information Security Officer (the "vCISO") which is provided by a contracted third-party security firm. The Committee's activities support the overall protection of data and information assets of the Company in accordance with the Information Security Program, regulatory requirements and Federal Financial Institutions Examination Council guidance. The Committee submits a quarterly report, together with the minutes of its meetings, to the Enterprise Risk Management Committee of the Board of Directors.


text: The Chief Operations & Technology Officer, among other duties, is responsible for the security and integrity of infrastructure, applications and databases and coordinates security implementations, monitoring and enforcement in conjunction with the vCISO and our risk management department. Our Chief Operations & Technology Officer has over 25 years of relevant experience in information technology and information security, building and leading technical organizations of various sizes, including in the banking industry. The vCISO has 15 years of information technology and security-based experience, and holds certifications relevant to cybersecurity, including CMMC CCP (Certified Cybersecurity Maturity Model Certification Professional) and CISSP (Certified Information Systems Security Professional). During the first quarter of 2025, the Company hired an Information Security Manager who is a CISSP-certified cybersecurity professional with over 20 years of experience in information technology, security engineering, and risk management. The Information Security Manager has also been added to the Information Security Committee mentioned above.


text: The Board of Directors receives periodic training related to cybersecurity and annually reviews comprehensive risk assessments of the Company's information technology, privacy and cybersecurity programs. The Board of Directors formally approves the Company's cybersecurity policies and program annually, and more frequently if material changes are adopted. Oversight of the Company's Information Security Program has been delegated to the Enterprise Risk Management Committee of the Board of Directors. The Enterprise Risk Management Committee reviews comprehensive risk assessments of the Company's information technology, privacy, and cybersecurity programs annually and receives quarterly reports on the effectiveness and overall performance of the cybersecurity program and provides a report of the same to the full Board of Directors.


text: Our information security and engineering functions, led by our Vice President of Operational Engineering, help identify, assess and manage the Company's cybersecurity threats and risks. These teams identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and our industry's risk profile using various methods including, for example manual and automated tools (including firewalls and endpoint protection); subscribing to and analyzing reports and services that identify cybersecurity threats; conducting scans of our environment; evaluating threats reported to us and coordinating with law enforcement concerning certain threats as may be appropriate; conducting threat assessments of both internal and external threats; conducting risk, threat and vulnerability assessments to identify vulnerabilities; working with third parties to conduct testing and tabletop exercises; and using external threat intelligence feeds.

companyName: SOUNDTHINKING, INC.

ticker: SSTI


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, and network and cellular communications providers. We have a vendor management program to manage cybersecurity risks associated with our use of certain of these providers. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider, including for example, conducting risk assessment of certain vendors, providing our vendors with a security questionnaire or reviewing their SOC report, reviewing the vendor's written information security program in certain circumstances, conducting audits of our vendors as may be needed, and requiring certain technical controls of our vendors through contractual obligations.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the risks titled "If our information technology systems or data, or those of third parties with whom we work, are or were compromised, our solutions may be perceived as not being secure, our customers may be harmed and we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation or mass arbitration demands; fines and penalties; disruptions of our business operations; reputation harm; loss of revenue or profits; loss of customers or sales; and other adverse consequences."


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Vice President of Operational Engineering. Our Vice President of Operational Engineering has over thirty years of experience in information technology and information security management and oversees our operational engineering component, which includes our information security function, IT, networking, cloud operations, and development operations teams.


text: Our Vice President of Operational Engineering is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Our Chief Financial Officer is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response and vulnerability management processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the Chief Executive Officer, Chief Financial Officer, and the Vice President of Operational Engineering. Those members of management work with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response and vulnerability management processes includes members of management reporting to the audit committee of the board of directors for certain cybersecurity incidents.


text: Risk Management and Strategy As part of our strategy to cease deploying capital into new opportunities in order to focus on supporting our existing ownership interests and maximizing monetization and other strategic opportunities to enable us to return value to our shareholders, we eliminated our internal management of technology and cybersecurity and outsourced this function to a third-party service provider. Our third-party service provider monitors and tests our safeguards, including through the use of automated tools and manual processes, such as vulnerability scanning, penetration tests, and assessments of our technology infrastructure, and offers training to our employees on these safeguards, including through phishing tests and other processes.

companyName: Horizon Kinetics Holding Corp

ticker: HKHC


text: One of the key functions of our Board of Directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. The Company's Audit Committee annually reviews with management the Company's operational risk exposure and the steps management has taken to monitor and control these exposures.


text: The Trustee maintains a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats, which processes are integrated into the Trustee’s overall risk management process. The Trustee maintains robust cybersecurity protocols, including but not limited to technological capabilities that prevent and detect disruptions; computer workstations and programs protected with passwords and passphrases, as well as employee training throughout the year on financial regulations and cybersecurity followed up by testing of that knowledge. The protocols are based on recognized best practices and standards for cybersecurity and information technology. The Trustee has an annual assessment, performed by a third-party vendor, of the Trustee’s cyber risk management program.

companyName: SAN JUAN BASIN ROYALTY TRUST

ticker: SJT


text: The Trust faces risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows or reputation. The Trustee has experienced, and will continue to experience, cyber incidents in the normal course of its business. However, prior cybersecurity incidents have not had a material adverse effect on the Trust’s business, financial condition, results of operations, or cash flows. See Item 1A. “Risk Factors – Cybersecurity Risks.”


text: Risk Management and Strategy Our policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats are integrated into our overall risk management process and are based on frameworks established by the National Institute of Standards and Technology ("NIST"), the International Organization for Standardization and other applicable industry standards and best practices. Our cybersecurity program in particular focuses on the following key areas: collaboration, risk assessment, technical safeguards, incident response and recovery planning, third-party risk management, education and awareness, and governance.

companyName: Strategic Storage Trust VI, Inc.

ticker: SGST


text: At least annually, we conduct a cybersecurity risk assessment that takes into account information from internal stakeholders, known security vulnerabilities, and other external sources (e.g., reported security incidents that have impacted other companies, industry trends, and evaluations by third parties and consultants). The results of the assessment are used to drive alignment on, and prioritization of, initiatives to enhance our security controls, make recommendations to improve processes. Our board of directors and members of management, as appropriate, are presented with any updates we make due to our risk assessment.


text: Incident Response and Recovery Planning We have established comprehensive incident response and recovery plans and continue to evaluate the effectiveness of those plans. Our incident response and recovery plans address — and guide our response to — a cybersecurity incident.


text: Our Sponsor's IT team, led by its Chief Information Officer, is responsible for assessing and managing our significant risks from cybersecurity threats and has primary responsibility for our risk management process and overall cybersecurity risk management program. This team includes in-house personnel devoted to these efforts, as well as a third-party IT firm, and they collectively have extensive knowledge of the technologies and applications we have adopted to address our cybersecurity risk.


text: In addition, our Sponsor's Chief Information Officer supports our company by staying informed about and monitoring efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include: briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources; and alerts and reports produced by security tools deployed in the IT environment.


text: Cybersecurity Risk Management and Strategy As an externally managed company, our risk management function, including cybersecurity, is governed by the cybersecurity policies and procedures of the Operating Manager, an indirect subsidiary of Apollo. Apollo determines and implements appropriate risk management processes and strategies as it relates to cybersecurity for us and other affiliated entities managed by Apollo, and we rely on Apollo for assessing, identifying and managing material risks to our business from cybersecurity threats.

companyName: Apollo Asset Backed Credit Co LLC


text: As one of the critical elements of Apollo's overall ERM approach, Apollo's cybersecurity program is focused on the following key areas: • Governance. As discussed further under the heading "Cybersecurity Governance," the AGM Board of Directors has an oversight role, as a whole and also at the committee level, in overseeing management of Apollo's risks, including its cybersecurity risks. AGM's Chief Information Security Officer ("CISO") and the CISO of Athene, a subsidiary of AGM, with support from the broader Apollo Technology team, are responsible for information security strategy, policies and practices, and also receive support, as appropriate, from our executive officers and other representatives of the Operating Manager and its affiliates. • Collaborative Approach. Apollo utilizes a cross-functional approach involving stakeholders across multiple departments, including Apollo Compliance, Legal, Technology, Operations, Risk and others, aimed at identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of potentially material cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by Apollo management, in consultation with our management and our Board, as applicable, in a timely manner. • Technical Safeguards. Apollo deploys technical safeguards that are designed to protect its information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved on an ongoing basis using vulnerability assessments and cybersecurity threat intelligence. • Incident Response and Recovery Planning. Apollo has established and maintains incident response and recovery plans that address its response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis. • Third-Party Risk Management. Apollo maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of its systems, as well as the systems of third parties that could adversely impact its business and the business of its externally managed entities such as our Company, in the event of a cybersecurity incident affecting those third-party systems. • Education and Awareness. Apollo provides regular, mandatory training for personnel regarding cybersecurity threats to equip its personnel with effective tools to help mitigate cybersecurity threats, and to communicate its evolving information security policies, standards, processes and practices.


text: Apollo engages in the periodic assessment and testing of its policies and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of its cybersecurity measures. Apollo regularly engages third parties, including auditors and consultants, to perform assessments on its cybersecurity measures, including information security maturity assessments, audits and independent reviews of its information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to Apollo's risk management function, and Apollo adjusts its cybersecurity policies and practices as necessary based on the information provided by these assessments, audits and reviews. For further discussion of the risks we face from cybersecurity threats, including those that could materially affect us, see "Item 1A. Risk Factors—Risks Related to our Company and an Investment in our Shares—We may face a breach of our cyber security, which could result in exposure of confidential information and adverse consequences to our operations."


text: To our knowledge, cybersecurity threat risks have not materially affected our Company, including our business strategy, results of operations or financial condition.


text: Cybersecurity Governance The AGM Board of Directors' oversight of Apollo's cybersecurity risk management is supported by the audit committee of the AGM Board of Directors (the "AGM audit committee"), the AAM Global Risk Committee ("AGRC"), the Operational Risk Forum (the "ORF"), the Cybersecurity Working Group and management. The AGM Board of Directors, the AGM audit committee, the AGRC, the ORF and the Cyber Security Working Group receive regular updates on Apollo's information technology, cybersecurity risk profile and strategy, and risk mitigation plans from Apollo's risk management professionals, AGM's Chief Security Officer ("CSO"), its CISO, and other members of Apollo's management and relevant management committees and working groups. The Cyber Security Working Group is chaired by the CISO and has representation from Apollo's Technology, Legal, Compliance, and ERM teams. The group meets at least once a quarter to discuss cybersecurity and risk mitigation activities, among other topics. The CISO regularly reports to the ORF regarding cyber risk, and the ORF in turn reports to the AGRC on a quarterly basis, noting any cyber updates when necessary or appropriate. In turn, AGM's board of directors and/or the AGM audit committee receive quarterly risk updates from risk management professionals, as well as at least annual updates on cyber risk specifically. The full AGM Board of Directors or the AGM audit committee receives presentations and reports on cybersecurity risks from AGM's CSO or CISO, as well as from Athene's CISO, at least annually.


text: As part of the risk management oversight (including oversight of cyber risks) of the Company's Board, the Board will regularly interact with, and receive reports from, management of the Company, the Operating Manager, Apollo, and other service providers. The Company's Board is expected to receive presentations and reports on cybersecurity risks from AGM's CSO or CISO, at least annually, addressing a wide range of topics including recent developments, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to Apollo's peers and third parties. Additionally, Apollo and other service providers are expected to periodically report to management as it relates to the Company's cybersecurity practices.


text: Apollo's cybersecurity incident response plan provides for proper escalation of identified cybersecurity threats and incidents, including, as appropriate, to the Company's management. These discussions provide a mechanism for the identification of cybersecurity threats and incidents, assessment of cybersecurity risk profile or certain newly identified risks relevant to the Company, the Operating Manager, and evaluation of the adequacy of the Company's cybersecurity program (as coordinated through the Operating Manager and Apollo), including risk mitigation, compliance and controls.


text: The Trustee maintains a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats, which processes are integrated into the Trustee’s overall risk management process. The Trustee maintains robust cybersecurity protocols including, but not limited to, technological capabilities that prevent and detect disruptions; computer workstations and programs protected with passwords and passphrases, as well as employee training throughout the year on financial regulations and cybersecurity followed up by testing of that knowledge. The protocols are based on recognized best practices and standards for cybersecurity and information technology. The Trustee has an annual assessment, performed by a third-party vendor, of the Trustee’s cyber risk management program.

companyName: HUGOTON ROYALTY TRUST

ticker: HGTXU


text: The Company's management recognizes the critical importance of monitoring for and properly addressing cybersecurity threats. Our Chief Financial Officer is the executive primarily responsible for identifying and managing risks to the Company from cybersecurity threats. With respect to the Company's information systems, we rely on third-party technology and software providers to manage the cybersecurity risk to which those systems are subject. For elements of cybersecurity risk which fall outside the purview of the third-party technololgy and software providers, our Chief Financial Officer oversees the implementation of additional controls to reduce the likelihood of a cybersecurity incident occurring as well as to reduce the impact of any such incident, should it occur. At least annually, he discusses cybersecurity risk and the Company's mitigation efforts and effectiveness of controls with the Audit Committee of the Board of Directors, which is the committee that has primary responsibility for overseeing our risk assessment and is composed solely of independent directors. The Audit Committee reviews and discusses our cybersecurity risk and reviews the tests of controls performed by consultants that perform the Company's internal audit function. The chair of the Audit Committee may, at his discretion, report to the Chairman of the Board or the full Board of Directors.

companyName: Sotherly Hotels Inc.

ticker: SOHOO


text: As of December 31, 2024, no risk from cybersecurity threats, including as a result of any previous cybersecurity incidents, has materially affected or is reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. Although we have implemented controls to protect our data and information systems and monitor our systems on an ongoing basis, such efforts may not prevent material compromises to our information systems in the future, including those that could have a material adverse effect on our business. We maintain cybersecurity insurance coverage to mitigate our financial exposure to certain incidents, and we consult with our consultants that perform the Company's internal audit function regarding opportunities and enhancements to strengthen our policies and procedures.


text: We do not retain any confidential information from our customers. While we have control over our information systems, we do not have control over the information systems of our hotel manager, Our Town, or of our franchisors. Although we set expectations for Our Town and our franchisors, we rely on them to manage the cybersecurity risk to which they are subject. Our hotel manager maintains separate cybersecurity insurance coverage to offset a portion of potential costs incurred from a security breach.


text: We currently do not have a cybersecurity incident response plan with respect to our data and information systems. We rely on our hotel manager and their cybersecurity consultants as well as our franchisors, to maintain cybersecurity incident response plans applicable to their systems and hotel-level systems they manage on our behalf.


text: For additional information about cybersecurity risk, see "Item 1A. Risk Factors - We and our hotel manager rely on information technology in our operations, and any material failure, inadequacy, interruption or security failure of that technology could harm our business."


text: In response to the complexity and evolving nature of cybersecurity threats, incidents and risks, we engage with a range of third-party experts, including cybersecurity penetration testers, data protection services, security awareness and training, and AI based security services in evaluating and supporting our risk management. Our collaboration with these third parties includes regular independent audits, threat assessments, and consultation on security enhancements. Depending on the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, we evaluate the security and risk posture of third-party service providers according to the perceived level of risk and benchmarked against industry standard best practices.

companyName: Cue Biopharma, Inc.

ticker: CUE


text: Our Information Technology and Cyber Security Manager, who reports to our Chief Financial Officer, leads the operational oversight of company-wide cybersecurity strategy, policy, standards, and processes and works across relevant departments to assess and help prepare us and our employees to address cybersecurity risks. Specific cybersecurity related responsibilities of the Information Technology and Cyber Security Manager include overseeing our processes and strategies for the detection, mitigation, and remediation of cybersecurity incidents. Our Information Technology and Cyber Security Manager has over 17 years of experience in information technology and cybersecurity, enabling him to effectively oversee cybersecurity risks and threats. He helped design and implement our initial cybersecurity infrastructure.


text: We do not believe that there are currently any risks from known cybersecurity threats that have materially affected or are reasonably likely to materially affect us or our business strategy, results of operations or financial condition. Despite our cybersecurity efforts, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. See Part I, Item 1A, Risk Factors, in this Annual Report for a discussion of cybersecurity risks. We maintain cyber insurance coverage; however, such insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyber-attacks, and other related breaches.


text: As we are fully externally advised, we are reliant on our external advisor's network and risk management program. Our external advisor has elected to engage third-party managed service providers to maintain its network and to manage the monitoring, detection, mitigation, and prevention of cybersecurity threats. These service providers are responsible for managing our advisor's hosted services, all of the computer and computer-related hardware and software they use, and for managing the backup process. Our advisor's primary managed service provider supplies management with monthly updates and activity reports related to network alerts, connectivity issues and help desk tickets.

companyName: New York REIT Liquidating LLC


text: We are subject to risks from cybersecurity threats and incidents. As of December 31, 2024, we do not believe such risks have materially affected or are reasonably likely to materially affect the Company, including the Company's business strategy, results of operations or financial condition. However, there can be no assurance that the Company will not be materially affected in the future. For additional information regarding risks from cybersecurity threats, refer to Item 1A, "Risk Factors", in this Annual Report on Form 10-K.


text: Cyber Risk Management and Strategy We have processes in place to assess, identify, and manage material risks from cybersecurity threats. Our business is dependent on the communications and information systems of the Adviser, AB and other third-party service providers. The Adviser manages our day-to-day operations and has implemented AB's Information Security Program ("ISP") that applies to the Fund and its operations.

companyName: AB Private Credit Investors Corp


text: We rely on the digital technology of AB and the Adviser to conduct our business operations and engage with our clients and business partners. The technology that AB, the Adviser, clients, and business partners rely upon becomes more complex over time as do threats to our business operations from cyber intrusions, denial of service attacks, manipulation and other cyber misconduct. Information Security is an ongoing process of exercising due care that is designed to protect corporate, client and employee information and systems from unauthorized access, destruction, disclosure, disruption and modification of use.


text: Through a combination of security, risk and compliance resources, AB implements information security through a dedicated ISP that is intended to identify, assess and manage material risks from cybersecurity threats applicable to the Fund, and which includes a focus on safeguarding information and assets from cyber threats, engaging in cyber threat monitoring and responding to actual or potential cyber incidents. Our ISP is led by AB's Chief Information Security Officer ("CISO") who actively partners with AB's Chief Compliance Officer and Chief Risk Officer and, in turn, the Fund's Adviser, Board and Chief Compliance Officer. Ultimately, we rely on AB's full enterprise risk framework, which includes the ISP, information technology, business continuity, resiliency and cybersecurity risk, in combination with a broader risk management team, including AB's Chief Security Officer.


text: AB's CISO, with assistance from internal and external resources, is responsible for implementing and providing oversight of the ISP that applies to the Fund. The ISP employs a defense-in-depth strategy: an information assurance concept in which multiple layers of security controls are distributed throughout an operating environment. The concept manages risk with diverse defensive strategies, so that if one layer of defense fails, another layer of defense will attempt to compensate. The ISP features cybersecurity policies, standards and guidelines, committee governance, training, access controls and data controls.


text: The ISP, together with related risk and compliance resources, is designed to proactively manage the risk of threat from cybersecurity incidents through (i) implementing protocols to take cybersecurity considerations into account in adopting and onboarding our technology resources, (ii) monitoring IT controls to better ensure compliance with cybersecurity and other related legal and regulatory requirements, (iii) assessing adherence by critical and material third parties we partner with to ensure that the appropriate risk management standards are met, (iv) ensuring essential business functions remain available during a business disruption, and (v) regularly developing and updating response plans to address potential IT or cyber incidents should they occur. AB's security, risk and compliance resources are designed to prioritize IT and cybersecurity risk areas, identify solutions that minimize such risks, pursue optimal outcomes and maintain compliance standards. We also rely on AB's ISP to maintain an operation security function that has a real time response capability that triages potential incidents and triggers impact mitigation protocols.


text: Additionally, we rely on AB and the Adviser to utilize third parties to conduct periodic cybersecurity assessments, including assessments impacting the Fund, and AB's internal audit function includes certain cyber risk audits as part of any overall risk audit. We rely on AB to review the recommendations and findings from those assessments and audits and implement corrective and other measures as appropriate and as may be relevant to the Fund. AB's cybersecurity processes rely predominantly on internal resources, but also include important third party resources for certain matters, including the aforementioned assessments as well as our continuous cybersecurity threat monitoring and initial incident reporting system.


text: As part of the ISP that is applicable to the Fund, AB also performs cyber risk assessments on the Fund's critical and material third party vendors during onboarding and periodically thereafter.


text: During the reporting period, we have not had a cybersecurity incident that has materially affected, or was reasonably likely to materially affect, the Fund, including our business strategy, results of operations or financial condition. There are risks from cybersecurity threats that if they were to occur could materially affect our business strategy, results of operations or financial condition, including as discussed in "Item 1A Risk factors – The failure in cyber security systems, as well as the occurrence of events unanticipated in the Fund's disaster recovery systems and management continuity planning could impair its ability to conduct business effectively," although we do not currently believe that such a result is reasonably likely.


text: Cyber Risk Governance The Board provides strategic oversight over the Fund generally and has delegated oversight on cybersecurity matters to the Fund's Audit Committee, including oversight of risks associated with cybersecurity threats. AB's CISO, the Adviser's Chief Compliance Officer and the Fund's Chief Compliance Officer periodically report to the Audit Committee, which in turn reports to the Board on the status of AB's ISP, cybersecurity risks, risk management policies and risk assessment initiatives. Such reports particularly emphasize any material risks concerning the Fund.


text: The Chief Compliance Officer of the Fund oversees the Fund's risk management function generally and relies on the Adviser's Chief Compliance Officer to assist with assessing and managing material risks from cybersecurity threats. The Adviser's Chief Compliance Officer has 13 years of experience in the financial services industry, and during such time has acquired relevant experience overseeing and actively managing cybersecurity and information security programs for financial services companies with complex information systems. The Fund's Chief Compliance Officer has been responsible for the general oversight function as Chief Compliance Officer to the Fund for 4 years and has worked in the financial services industry for 19 years, during which the Fund's Chief Compliance Officer has gained expertise in assessing and managing risk applicable to the Fund.


text: Management is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Fund, including through the receipt of notifications from service providers and reliance on communications with ISP personnel of the Adviser and AB.


text: During the reporting period, we have not had a cybersecurity incident that has materially affected, or was reasonably likely to materially affect, the Fund, including our business strategy, results of operations or financial condition. There are risks from cybersecurity threats that if they were to occur could materially affect our business strategy, results of operations or financial condition, including as discussed in "Item 1A Risk factors – Cybersecurity" although we do not currently believe that such a result is reasonably likely.

companyName: AB Private Lending Fund


text: Response. Occurs when a security incident is a confirmed data breach; when a security incident requires the Company to take further action to protect the organization and/or affected parties whose impacted personal information is at risk or has been compromised; or when additional administrative, physical, or technical controls are needed after a security incident. In the Response phase, the priority is to swiftly complete required notifications and other procedures according to applicable law.

companyName: Petco Health & Wellness Company, Inc.

ticker: WOOF


text: Review. Occurs after the event has been resolved. The priority in this phase is to review the investigation/response process and update the above steps based on the lessons learned.


text: Tier 3. No direct system access but may be associated through a partnership or have links hosted or embedded within Company marketing material or websites.


text: While we face a variety of cybersecurity risks, such as phishing attempts, ransomware attacks, account takeovers, fraudulent orders, and unauthorized access attempts, such risks have not materially affected us to date, including our business strategy, results of operations or financial condition, and we do not believe such risks are reasonably likely to have such an effect over the long term. For more information about the cybersecurity risks we face, see "Item 1A – Risk Factors - Our reputation and business may be harmed if our or our vendors' computer network security or any of the databases containing customer, employee, or other personal information maintained by us or our third-party providers is compromised, which could materially adversely affect our results of operations."


text: Cybersecurity Governance Our board of directors has ultimate oversight of our risk management policies and strategies. Our executive leadership team, which is responsible for our day-to-day overall risk management practices, presents to the board of directors on the various material risks to our Company, including risks related to information technology and cybersecurity.


text: The audit committee has formal oversight responsibility for cybersecurity, as delegated by our board of directors, and is responsible for reviewing our policies and procedures with respect to cybersecurity risk assessment and risk management. As part of the board of directors and audit committee's oversight, our Chief Technology Officer ("CTO"), and/or Chief Information Security Officer ("CISO") provide semi-annual updates to the audit committee with respect to cybersecurity incidents, mitigation, threats, risks, and management, which are also communicated to the full board. In addition, a cross-functional committee comprised of key stakeholders throughout the Company meets regularly to review cybersecurity incidents, mitigation, threats, risks, and management.


text: Cybersecurity Risk Management and Strategy Due to the size of our company, we have not yet developed robust policies and processes for assessing, identifying, and managing material risk from cybersecurity threats. We have implemented access controls with respect to our systems, which we monitor regularly and audit annually. Our most sensitive data is stored in offline air-gapped devices. We currently rely heavily on products and services provided by third-party suppliers to operate certain critical business systems, including without limitation, cloud-based infrastructure, encryption and authentication technology, email, and other functions. We rely on third party providers and outsourced IT services to monitor and address cybersecurity related risks, including installing software for threat protection and malware. Such third party providers are tasked with notifying management of any material risks or cybersecurity concerns that they identify, which management then assesses and may bring to our board of directors to discuss if deemed necessary or appropriate. Based on the results of our risk assessments, if deemed necessary or appropriate, we take steps to re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards.

companyName: ASP Isotopes Inc.

ticker: ASPI


text: Our management team is primarily responsible for assessing and managing our strategic risk exposures, including material risks from cybersecurity threats, with assistance from third-party service providers. Management oversees our cybersecurity process on a day-to-day basis, including those described under the heading "Cybersecurity Risk Management and Strategy" above.


text: Our audit committee is tasked with general oversight of our risk management process, including risks from cybersecurity threats. Members of management provide periodic briefings to the audit committee of our board of directors regarding our cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. In furtherance thereof, the committee is responsible for monitoring and assessing strategic risk exposure. Our audit committee provides regular updates to the board of directors on such reports.


text: We use a risk-based approach with respect to our use and oversight of third-party service providers, tailoring processes according to the nature and sensitivity of the data accessed, processed, or stored by such third-party service provider. We use a number of means to assess cyber risks related to our third-party service providers, including conducting due diligence in connection with onboarding new vendors. We also seek to include appropriate security terms in our contracts, where applicable as part of our oversight of third-party providers.

companyName: PLUS THERAPEUTICS, INC.

ticker: PSTV


text: Management Oversight The controls and processes employed to assess, identify and manage material risks from cybersecurity threats are implemented and overseen by our Information Technology and Facilities Director (the "ITFD"). Our ITFD is a third-party consultant, from whom we have a dedicated resource who specializes in the industry and has over 25 years of experience addressing cybersecurity risks. Our ITFD is responsible for the day-to-day management of the cybersecurity program, including the prevention, detection, investigation, response to, and recovery from cybersecurity threats and incident s, and is regularly engaged to help ensure the cybersecurity program functions effectively in the face of evolving cybersecurity threats. Our CFO oversees the ITFD and briefs our Board on cybersecurity matters, including the nature and design of our cybersecurity program, and threats, events, and program enhancements.


text: While the Board has overall responsibility for risk oversight, the Board delegated to the audit committee of the Board the responsibility for assisting the Board with cybersecurity disclosure matters. In its oversight role, the Board is expected to specifically consider risks that relate to the reputation of the Company and the general industry in which we operate, including with respect to privacy, information technology and cybersecurity and threats to technology infrastructure.


text: We work with third-party service providers from time to time that assist us to identify, assess, and manage cybersecurity risks, including professional services firms, consulting firms, threat intelligence service providers, and penetration testing firms. We seek to engage reliable, reputable service providers that maintain cybersecurity programs. We are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, which have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. Refer to Item 1A "Risk Factors" in this Annual Report on Form 10-K for additional discussion about cybersecurity-related risks.

companyName: Surrozen, Inc./DE

ticker: SRZN


text: Our cybersecurity risk management and strategy processes are overseen by our Information Technology team. Such individuals have an average of over 20 years of prior work experience in various roles involving information technology, including security, auditing, compliance, systems and programming. These individuals are informed about, and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan, and report to the audit committee on any appropriate items. The audit committee holds quarterly meetings and receives periodic reports from management, concerning our significant cybersecurity threats and risk and the processes we have implemented to address them.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain of our management, including our CFO, who oversees our information security team and has over 3 years of experience overseeing such function.

companyName: Rani Therapeutics Holdings, Inc.

ticker: RANI


text: Our cybersecurity risk management program includes: • physical, technological and administrative controls intended to support our cybersecurity and data governance framework, including controls designed to protect the confidentiality, integrity and availability of our key information systems and tenant, employee and other third-party information stored on those systems, such as access controls, encryption, data handling requirements and other • cybersecurity safeguards, and internal policies that govern our cybersecurity risk management and data protection practices; • a defined procedure for timely incident detection, containment, response and remediation, including a written security incident response plan that includes procedures for responding to cybersecurity incidents; • cybersecurity risk assessment processes designed to help identify material cybersecurity risks to our critical systems, information, products, services and broader enterprise Information Technology ("IT") environment; • a security team responsible for managing our cybersecurity risk assessment processes and security controls; • the use of external consultants or other third-party experts and service providers, where considered appropriate, to assess, test or otherwise assist with aspects of our cybersecurity controls; • annual cybersecurity and privacy training of employees, including incident response personnel and senior management, and specialized training for certain teams depending on their role and/or access to certain types of information; and • a third-party risk management process that includes internal vetting of certain third-party vendors and service providers with whom we may share data.

companyName: REGIONAL HEALTH PROPERTIES, INC

ticker: RHEP


text: As of December 31, 2024, we have not identified risks from known cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. For an examination of cybersecurity threats that could potentially have a material impact on us, please refer to Part I, Item 1A., "Risk Factors" –"Cybersecurity incidents or other damage to the information systems and technology of us or our tenants could harm our business" in this Annual Report."


text: We are requiring each of our significant third-party service providers to agree that it will implement and maintain appropriate security measures in connection with their work with us, and promptly report any suspected breach of its security measures that may affect our company.

companyName: IO Biotech, Inc.

ticker: IOBT


text: We recognize the critical importance of maintaining the trust and confidence of all our stakeholders. Our Board is actively involved in oversight of our risk management program, and cybersecurity represents an important component of our overall approach to risk management. Our cybersecurity policies, standards, processes, and practices are fully integrated into our risk management program and are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Velo3D, Inc.

ticker: VELO


text: Governance: The Board's oversight of cybersecurity risk management is supported by the Audit Committee of the Board, which receives, at a minimum, quarterly reports and presentations from our risk management function, our Information Technology department and other members of management. The Board and Audit Committee also receive prompt and timely information regarding material cybersecurity incidents as described below.


text: Collaborative Approach: We have implemented a comprehensive, cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and incidents, while also executing controls and procedures that provide for the prompt escalation of certain material cybersecurity incidents so that decisions regarding the public disclosure and reporting of such material incidents can be made by management in a timely manner.


text: Incident Response and Recovery Planning: We have established and maintain comprehensive incident response and recovery plans to address our response to cybersecurity incidents, and such plans are tested and reviewed on an as needed basis. Our cybersecurity program includes a dedicated security incident response team (the "SIRT") responsible for identifying, investigating, and mitigating cybersecurity threats. The SIRT follows a well-defined incident response process encompassing intake, investigation, mitigation, and recovery. This process leverages tools for threat detection and utilizes standardized protocols for containment, root cause analysis, and system restoration. By integrating security measures with a robust response process, we aim to minimize the impact of potential cyber incidents.


text: Incident Reporting and Communication: We have established protocols for reporting material cybersecurity incidents to management, stakeholders, and regulatory bodies as required. The Board is promptly informed and receives ongoing updates regarding material cybersecurity incidents as described below.


text: Education and Awareness: We provide annual mandatory training for personnel regarding cybersecurity threats to equip our employees and contractors with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices.


text: We engage in an annual assessment and testing of our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, focused on evaluating the effectiveness of our cybersecurity measures and planning.


text: Our Board, supported by the Audit Committee, oversees our risk management process. The Audit Committee receives, at a minimum, quarterly presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties. The Board and the Audit Committee also receive prompt and timely information regarding any material cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.


text: Our IT personnel, in coordination with our executive management team, works collaboratively across the company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans. Through ongoing communications with our entire employee basis and appropriate third-party contractors, as well as the management team monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and report threats and incidents to the Audit Committee, as needed.


text: Our IT personnel oversees information technology ("IT") strategy, operations, cybersecurity, compliance, and business applications. They are dedicated to accelerating and scaling our company by implementing innovative technology across the company. Additionally, they are an accomplished IT expert with over 15 years of experience driving transformative change across diverse industries, including manufacturing, financial services, and software as a service.


text: Although we are subject to ongoing and evolving cybersecurity threats, we are not aware of any material risks from cybersecurity threats in 2024 that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. For more information on our cybersecurity risks, see "Risk Factors—Risks Related to Compliance Matters—Aspects of our business are subject to privacy, data use and data security regulations, which could increase our costs" and "—Risks Related to Our Business and Industry—We rely on our information technology systems to manage numerous aspects of our business and a disruption of these systems could adversely affect our business."


text: Risk Management and Strategy We regularly assess risks from cybersecurity threats; monitor our information systems for potential vulnerabilities; and test those systems pursuant to our internal information technology policies which are inclusive of cybersecurity policies, processes, and practices. To protect our information systems from cybersecurity threats, we use various security tools that are designed to help identify, escalate, investigate, resolve, and recover from security incidents in a timely manner. Our Cybersecurity Committee, which is comprised of representatives from our business operations and support functions, assesses risks based on current risks we are aware of, probability and potential impact to key business systems and processes. Risks that are considered high are incorporated into our overall risk management program. A mitigation plan is developed for each identified high risk, with progress reported to the Cybersecurity Committee and tracked as part of our overall risk management program overseen by the Audit Committee of our board of directors.

companyName: Biomea Fusion, Inc.

ticker: BMEA


text: We take a risk-based approach to cybersecurity and have implemented cybersecurity policies throughout our operations that are designed to address cybersecurity threats and incidents. Our Head of Information Technology, and the Cybersecurity Committee, is responsible for the establishment and maintenance of our cybersecurity program, as well as the assessment and management of cybersecurity risks. The current Head of Information Technology has over 20 years of experience in information security and possesses the education, skills, experience, and industry certifications expected by our company of an individual assigned to these duties. The Head of Information Technology provides periodic updates on our information technology environment risk, which is inclusive of our cybersecurity risk profile, to the Board of Directors, which includes the Audit Committee members.


text: Risk Management and Strategy We recognize the critical importance of securing our information systems and protecting the confidentiality, integrity, and availability of our data. To achieve this, we have developed and implemented a comprehensive cybersecurity risk management program designed to identify, assess, and mitigate risks to our critical systems and data, including risks resulting from cybersecurity threats associated with our use of third-party service providers.

companyName: Galera Therapeutics, Inc.

ticker: GRTX


text: Our cybersecurity strategy is integrated into the company's broader enterprise risk management framework, ensuring that cybersecurity considerations are an integral part of decision-making at all levels of the organization. We collaborate with external experts, including cybersecurity assessors and vendors, to continuously evaluate and enhance our security posture and conduct regular risk assessments, penetration testing, and security audits.


text: Monitoring, Training and Incident Response We continuously monitor our information systems for potential cybersecurity threats. Our cybersecurity incident response plan outlines specific procedures for responding to incidents, minimizing damage, and recovering swiftly. We have implemented a comprehensive cybersecurity training program for all employees to ensure they are fully equipped to handle cybersecurity responsibilities. The training emphasizes making cybersecurity an integral part of our corporate culture. It covers a wide range of topics, including understanding the different types of malware and how to avoid them, recognizing social engineering tactics like phishing and pretexting, and the importance of creating strong passwords while using multi-factor authentication. Additionally, the program addresses the unique security risks associated with remote work, mobile device usage, and Wi-Fi connections, as well as best practices for securing email communications and ensuring physical security of devices. Employees also learn about the importance of information classification, securing sensitive data, and safeguarding mobile devices and USB drives from unauthorized access or attacks. The program highlights the risks associated with the dark web and emphasizes how employees can protect themselves and the organization from information exposure. Furthermore, the training ensures that employees understand how to effectively respond to cybersecurity incidents, including how to recognize, report, and address security threats in a timely manner. This training is regularly updated to reflect the latest security threats and trends, ensuring employees are always aware of evolving risks. Employee understanding is assessed through quizzes, and executive leadership plays a key role in reinforcing cybersecurity as a top priority by modeling strong security behaviors and emphasizing ongoing vigilance.


text: Cybersecurity Risks We have not experienced or identified risks from cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: The Board of Directors (the Board), with oversight from the Audit Committee, is responsible for the governance of cybersecurity risks. The Audit Committee receives regular updates from management on cybersecurity risks and incidents, ensuring that the Board is kept informed. Management, led by the Chief Executive Officer (the "CEO"), is responsible for implementing the cybersecurity program, monitoring the company's risk posture, and reporting to the Audit Committee and the Board regarding cybersecurity-related risks. The CEO works closely with external consultants and vendors, including IntellectMap, to ensure that we stay current with industry standards and best practices.


text: The Senior Director of IT acts as the Incident Manager and meets regularly with our Incident Response Team, including members of Financial Risk Management, IT Security and Human Resources senior management to discuss the necessary measures to take prior to and during an incident. In the event of an incident, the Incident Manager meets regularly with the executive leadership team and keeps them apprised of the status of any incident during the incident response. Our Board and the Audit Committee also receive prompt and timely information from the Senior Director of IT and executive leadership regarding any cybersecurity risks that meet certain reporting thresholds, as well as ongoing updates regarding any such risk. Finally, the Incident Response Manager briefs corporate leadership on lessons learned from the incident during or after the recovery phase.

companyName: Scilex Holding Co

ticker: SCLX


text: The Senior Director of IT, in collaboration with a team of IT professionals, our legal counsel and Human Resources, are tasked with implementing a program designed to protect our information systems from cybersecurity threats and manage material risks. The Senior Director of IT has served in various roles in information technology and information security for over 20 years. The Senior Director of IT and senior management are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and report such threats and incidents to the Audit Committee when appropriate.


text: Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition as of December 31, 2024. For more information, please see the risk factor disclosures included in Item 1A of this Annual Report on Form 10-K.


text: (a) Cybersecurity Risk Management Strategy We have developed our cybersecurity risk management program (Cybersecurity Framework), including a cybersecurity incident response plan, based on the National Institute of Standards and Technology Cybersecurity Framework’s (NIST CSF) principles: Identify, Protect, Detect, Respond, and Recover, and our Cybersecurity Framework is intended to address current vulnerabilities and anticipate future cybersecurity threats and risks to our cyber ecosystem. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Aardvark Therapeutics, Inc.

ticker: AARD


text: Our cybersecurity risk management program includes: • assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training for our employees, incident response personnel, and senior management; • a cybersecurity incident response process that includes procedures for responding to cybersecurity incidents; and • a risk evaluation of our service providers, suppliers, and vendors of critical systems during contracting.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. There can be no assurance, however, that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information. For more information, see Part I, Item 1A, “Risk Factors—Risks Related to the Operation of Our Business—Significant disruptions of our information technology systems or data security incidents could result in significant financial, legal, regulatory, business and reputational harm to us” of this Annual Report.


text: (b) Cybersecurity Governance Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management’s implementation of our cybersecurity risk management strategy.


text: The Audit Committee receives periodic reports from management, including our IT Governance Team, on our cybersecurity risks. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: Our IT Governance Team is comprised of senior Aardvark leadership, including our Chief Financial Officer, Vice President, Head of Product Management and Strategy and Vice President, Quality, as well as third party advisors. Our IT Governance Team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. The experience of our IT Governance Team encompasses leadership, development, and support of cybersecurity strategies, along with the implementation of policies and procedures.


text: Our IT Governance Team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: Our management team has taken additional steps to implement our cybersecurity risk management program. For example, we have implemented periodic management reviews of our controls related to provisioning of user access to certain third-party hosted applications that we use in connection with the business and risks posed by certain critical vendors; this includes reviewing System and Organizational Control audit reports of such vendors. We maintain insurance coverage intended to mitigate our financial exposure to certain cybersecurity threats, and we consult with external advisors regarding opportunities and enhancements to strengthen our cybersecurity processes and practices.

companyName: Seritage Growth Properties

ticker: SRG


text: We are subject to risks from cybersecurity threats and incidents. As of December 31, 2024, we do not believe such risks have materially affected or are reasonably likely to materially affect the Company, including the Company's business strategy, results of operations or financial condition. However, there can be no assurance that the Company will not be materially affected by such risks in the future. For additional information regarding risks from cybersecurity threats, refer to Item 1A, "Risk Factors", in this Annual Report on Form 10-K.


text: Our Board of Trustees considers cybersecurity risk as part of its risk oversight function. In February 2024, the Board delegated to its Audit Committee oversight of cybersecurity and other information technology risks. Our Audit Committee oversees management's implementation of our cybersecurity risk management program. Our Audit Committee will receive periodic reports from our Interim Chief Financial Officer or our Chief Legal Officer on our cybersecurity risks. In addition, our Interim Chief Financial Officer or our Chief Legal Officer will update our Audit Committee, as necessary, regarding any significant cybersecurity incidents impacting our information systems. Our entire Board will also receive briefings from our Interim Chief Financial Officer or Chief Legal Officer on our cybersecurity risk management program as part of our overall business risk updates.


text: Management policies and procedures We recognize the need to protect our data, systems and technology. We have described related risks in Item 1A under the heading "Risks Related to our Technology and Data." We have previously assessed and periodically measure our security maturity using the US National Institute of Standards and Technology Cybersecurity Framework. ("NIST CSF") supported by other internal and third-party assessments. Gaps or perceived weaknesses in our NIST CSF score are highlighted to our Cybersecurity Risk Committee and subsequently to the Board of Directors. A reassessment of our maturity using NIST CSF was carried out in the early part of 2024, demonstrating ongoing improvement. These assessments allow us to prioritize investment into those areas which provide the greatest improvement in the CSF scoring and by implication, our ability to identify, protect, detect, respond and recover from information and cybersecurity incidents. Risks are recorded in OneTrust and are formally assessed monthly, considering likelihood and potential impact and mitigating actions are implemented where possible to reduce identified risks. Controls designed to reduce or eliminate risk are designed into our technology, processes and management of third parties. We conduct regular vulnerability scanning and use a third party for regular penetration testing designed to help us identify new weaknesses or vulnerabilities. In addition, we use the same third party to help us conduct cybersecurity incident simulation which is subsequently used to inform updates to our Cybersecurity Incident Response Plan. We also have procedures designed to assess risks related to the use of third-party suppliers.

companyName: Soho House & Co Inc.


text: We have implemented a governance program which facilitates senior management oversight of cybersecurity risk management. An operational risk group comprising senior SHCO Cyber Risk and third-party Cyber Risk professionals together with the IT Infrastructure lead meet monthly to review emerging risks, progress with mitigation of identified risk and prioritization of risk reduction activities. The output from this group is shared quarterly with the Cyber Security Risk Committee ("CSRC") a Board Sub-Committee which comprises the Chief Executive Officer (CEO), Chief Financial Officer (CFO), Chief Technology Officer (CTO), Chief Legal Officer (CLO) and Director of Information Security. The CSRC is responsible for reviewing the top strategic cyber risks, progress against cyber maturity improvement and recommending funding and resource requirements. The CSRC reports twice per year to the Audit Committee. The CSRC is also the body that collectively assesses materiality in the event of a cybersecurity incident and meets as required for this purpose.


text: Management's role and relevant experience in assessing and managing cybersecurity The NIST CSF is used to assess cybersecurity maturity. An initial baseline assessment has been used to inform our Cybersecurity Strategy and periodic assessments are used to update the NIST CSF scoring. These assessments are carried out by an independent third party to provide appropriate objectivity and challenge. In addition, we are progressing towards certification to the international information security management standard - ISO 27001 and the related standard ISO 27701 for privacy information management. Execution of our cybersecurity strategy is overseen by our Director of Information Security who is a qualified CSIM, CISA and a Fellow of the UK Chartered Institute of Information Security and has over 30 years of experience in cyber security. The Director of Information Security provides the CTO with periodic updates and also chairs the CSRC which provides a forum for senior management to discuss cyber risk management in greater detail.


text: Cybersecurity Risk Management and Strategy We have developed and maintained a Cybersecurity risk management methodology intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our Cybersecurity risk management methodology is integrated into our overall enterprise risk management, and shares common methodologies, reporting channels and governance processes that apply across the Company to other legal, compliance, strategic, operational, and financial risk areas. As part of our overall risk management processes and procedures, we have instituted a Cybersecurity awareness campaign designed to identify, assess and manage material risks from Cybersecurity threats, including by engaging a third-party Cybersecurity service provider, which communicates directly with our management and compliance personnel. The cyber risk management methodology involves risk assessments, implementation of security measures and ongoing monitoring of systems and networks, including networks on which we rely. Through our Cybersecurity awareness, the current threat landscape is actively monitored in an effort to identify material risks arising from new and evolving Cybersecurity threats. We may engage external experts, including Cybersecurity assessors, consultants, and auditors to evaluate Cybersecurity measures and risk management processes as needed. We also depend on and engage various third parties, including suppliers, vendors, and service providers in connection with our operations. Our risk management, legal, and compliance personnel oversee and identify, including through a third-party Cybersecurity service provider, material risks from Cybersecurity threats associated with our use of such entities.

companyName: JFB Construction Holdings

ticker: JFB


text: Our Cybersecurity risk management methodology includes: • risk assessments designed to help identify material Cybersecurity risks to our critical systems, information, services, and our broader enterprise IT environment; • individuals, including employees and external third-party service providers, who are responsible for managing our Cybersecurity risk assessment processes, our security controls, and our response to Cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • Cybersecurity awareness training of our employees, incident response personnel, and senior management; • a Cybersecurity incident response plan that includes procedures for responding to Cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.


text: Cybersecurity Governance Our Board provides strategic oversight on Cybersecurity matters, including material risks associated with Cybersecurity threats. The Board has delegated to the Audit Committee oversight of Cybersecurity and other information technology risks. The Audit Committee oversees management’s implementation of our Cybersecurity risk management methodology. Our Board and the Audit Committee receives periodic updates from our Chief Financial Officer and more frequently as needed, regarding the overall state of our Cybersecurity preparedness, information on the current threat landscape, and material risks from Cybersecurity threats and Cybersecurity incidents. The Audit Committee and our management team are informed about and monitor the prevention, detection, mitigation, and remediation of Cybersecurity incidents, including through the receipt of notifications from third-party service providers and reliance on communications with our risk management, legal, and/or compliance personnel.


text: The Audit Committee reports to the full Board regarding Cybersecurity activities. The full Board also receives briefings from management on cyber risk issues and best practices. Our management team is responsible for assessing and managing our material risks from Cybersecurity threats. The team has primary responsibility for developing and maintaining our overall Cybersecurity risk methodology and supervises both our internal Cybersecurity personnel and our retained external Cybersecurity consultants. Our management team supervises efforts to prevent, detect, mitigate, and remediate Cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology environment.


text: Cybersecurity Risk Management and Strategy We are dedicated to protecting the integrity, confidentiality, and availability of our data, infrastructure and operating systems. As part of our commitment to safeguarding our operations against cybersecurity threats, we employ a comprehensive strategy for the assessment, identification, and management of cybersecurity risks. We engage a managed services provider ("MSP"), which provides wide-ranging services including risk assessments, threat detection, monitoring and response strategies, security audits and cybersecurity training.

companyName: ODYSSEY MARINE EXPLORATION INC

ticker: OMEX


text: Cybersecurity Processes: We conduct robust cybersecurity processes aligned with the National Institute of Standards Technology ("NIST") and the Cybersecurity Maturity Model Certification ("CMMC") protocols. Our comprehensive approach includes: • An enterprise firewall; • Implementation of Multi-Factor Authentication (MFA); • Adherence to the Zero Trust model; • Utilization of Managed Detection and Response (MDR); • Endpoint Detection and Response (EDR) technologies; • 24x7 Security Operations Center (SOC); and • Employment of Security Information and Event Management (SIEM) systems to continuously monitor our network and respond to threats in real time.


text: Risk Assessment Procedures: We conduct periodic risk assessments to identify potential cybersecurity threats and vulnerabilities within our IT infrastructure. These assessments are conducted using various software tools and methodologies that enable us to evaluate our systems critically and comprehensively. Our risk assessment process includes, but is not limited to, the analysis of: • Hardware and software configurations; • Network and data access protocols; • Encryption standards; and • Compliance with relevant industry and regulatory standards.


text: Threat Identification: We utilize advanced threat detection tools and services that continuously monitor our network for signs of unauthorized access, anomalies, and potential breaches. Our third-party cybersecurity provider is equipped with sophisticated detection technologies that help to swiftly identify even the most subtle signs of compromise. We focus on: • Real-time monitoring of our networks; • Regularly updated intrusion detection systems (IDS); • Deployment of endpoint detection and response (EDR) solutions; and • Utilization of threat intelligence platforms to stay abreast of emerging threats.


text: Threat Management: Upon identification of a potential threat, our managed service provider's dedicated incident response team takes immediate action to mitigate any adverse impacts. Our threat management procedures include: • Immediate isolation of affected systems to prevent the spread of threats; • Application of appropriate remediation measures, such as patches and software updates; • Conducting a thorough investigation to understand the breach's nature and scope; and • Implementing enhancements to prevent future occurrences.


text: Our incident response plan provides a concise strategy of how we will respond to an incident, including who will respond and their roles and responsibilities, the facilities that are in place to help with the management of the incident, how decisions will be taken with regard to our response to an incident, how communication will be handled both internally and externally, and defining what will happen once the incident is resolved and how we can learn and improve from the situation.


text: Integration into Overall Risk Management: Our cybersecurity risk assessment processes are fully integrated into the broader risk management framework. Cybersecurity is positioned as a core component of our risk management strategy, with direct reporting to our President and COO, who is guided by our MSP firm. The MSP firm provides strategic direction on policy, procedures and best practice. The synergy between cybersecurity and risk management ensures a resilient posture against emerging cyber threats.


text: Engagement of Third Parties: These providers are selected based on stringent criteria for cybersecurity expertise, particularly their capability to implement and manage NIST and CMMC protocols.


text: Third-Party Service Provider Oversight: Our oversight processes include comprehensive due diligence checks for any new third-party service provider and continuous monitoring of our existing MSP firm's activities. We have established protocols for communication and incident response that align with our managed service provider's operations, and industry best practice, ensuring swift action in the face of cybersecurity threats. Furthermore, a scheduled series of meetings has been established to procure updates and deliberate upon cybersecurity strategy with our contracted third-party providers.


text: Impact of Cybersecurity Risks Material Effects from Cyber Threats: To date, our operations and financial condition have not been materially affected by cybersecurity threats, due in part to our proactive measures such as employee security training programs and advanced threat detection and response capabilities. Our defensive strategies have successfully mitigated the risks of cyber incidents.


text: Potential Risk Exposure: While we have not experienced significant disruptions from cyber threats, we recognize the evolving nature of cyber risks. We continually evaluate the likelihood of potential cybersecurity incidents that could materially impact our strategic direction, operational efficacy, and financial stability. Our investment in training, alongside our sophisticated SOC, SIEM, and Zero Trust architecture, positions us to identify and address potential cybersecurity challenges promptly.


text: Cybersecurity Governance Our executive team is actively involved in overseeing our cybersecurity operations to ensure that they meet industry standards. The executive team provides regular updates to the Board—specifically the audit committee—on the status of our cybersecurity efforts, including any potential risks, threats or incidents.


text: Our President and COO, with guidance from our third-party MSP, manages our cybersecurity risk management and strategy process. Collectively, our consultants have 50+ years' experience in the cybersecurity industry in various roles.


text: Processes for Informing the Board: The audit committee is regularly informed about cybersecurity risks through quarterly briefings from our President and COO. These briefings may include risk assessment reports, incident response updates, changes to the cybersecurity landscape, and other relevant information. In the case of a cybersecurity incident that meets reporting thresholds, the audit committee will be promptly notified and will receive continual updates until the situation is remedied.


text: Cybersecurity is critical to advancing our overall objectives and enabling our digital efforts. As a company operating in the technology and software sectors, we face a wide variety of cybersecurity threats that range from common attacks such as ransomware and denial-of-service, to more advanced attacks. Our customers, suppliers and other partners face similar cybersecurity threats, and a cybersecurity incident impacting these entities could materially adversely affect our operations, performance and results. These cybersecurity threats and related risks make it imperative that we maintain focus on cybersecurity and systematic risks. Below is a discussion of our risk management and approach to governance as it relates to cybersecurity. For additional information on the impact of cyber risks, refer to Part I, Item 1A. "Risk Factors", of this Form 10-K.

companyName: Phunware, Inc.

ticker: PHUN


text: Risk Management and Strategy Cybersecurity risk management is a core tenet of our information technology security program. We have implemented various cybersecurity technologies, controls, and processes to ensure the integrity and availability of our infrastructure, data, and operations. We periodically review and modify these technologies and policies to align with the latest in industry best practices and an ever-changing threat landscape.


text: As part of our cybersecurity risk management program: • Cybersecurity risk assessment is performed on all new products and product updates; • We e mploy internal staff with security certifications, and we work with third parties to perform security vulnerability testing; • Changes to data protection laws are closely monitored and necessary changes are implemented; • We provide routine security training to employees and communicate any emerging threats; • We review the security posture of all third parties that we engage; • We maintain a comprehensive incident response plan; and • We carry cybersecurity insurance to help mitigate any potential losses arising from cybersecurity incidents.


text: While we face a number of ongoing cybersecurity risks in connection with our business, such risks have no t materially affected us to date, including our business strategy, results of operations, or financial condition.


text: Our Vice President of Information Technology, who reports directly to the Chief Executive Officer, manages and monitors our cybersecurity program. Our board of directors, as a whole, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage and mitigate those risks, including cybersecurity risks. The board of directors receives regular updates on cybersecurity and information technology matters and related risk exposures from our executive team.