text: As of the date of this report, we have not identified any cybersecurity threats, including any past cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our business strategy, financial condition, or results of operations. We continue to monitor cybersecurity risks closely and remain committed to taking proactive measures to address evolving threats.


text: Cybersecurity Governance. We have established a cybersecurity governance framework to ensure effective oversight, accountability, and strategic alignment across the organization. The Audit Committee of our Board of Directors oversees cybersecurity-related risks as part of its broader risk management responsibilities. The Audit Committee of the Board of Directors receives periodic reports from executive management and external cybersecurity advisors on our security initiatives, emerging threats and risk mitigation efforts.

companyName: ENTRAVISION COMMUNICATIONS CORP

ticker: EVC

secItem: Item 1C


text: Day-to-day management of our cybersecurity program is led by our Chief Information Security Officer, or CISO, who is responsible for overseeing information security policies, threat mitigation strategies, and compliance initiatives. The CISO provides periodic updates to management and the Audit Committee of the Board of Directors, ensuring that cybersecurity remains a key focus of our risk management framework. Our incident response protocols are structured to provide clear escalation pathways for cybersecurity incidents, ensuring that appropriate leadership is engaged in a timely manner to coordinate an effective response.


text: We also maintain stringent security requirements for third-party service providers, ensuring that vendors comply with our cybersecurity policies and controls. Our third-party risk management program includes due diligence assessments prior to engagement and ongoing security evaluations to mitigate external risks that could impact our operations.


text: As cybersecurity threats continue to evolve, we remain committed to strengthening our cybersecurity governance model, enhancing transparency and implementing best-in-class security measures. Our approach reflects a proactive commitment to protecting our digital infrastructure, ensuring business continuity and upholding the trust of our stakeholders.


text: Risk Management and Strategy We maintain a cybersecurity management program designed to identify, assess, manage, mitigate and respond to cybersecurity threats and incidents. We review our program design on at least a quarterly basis and update as needed to address the risks and threats that our corporate security team has identified. Our team also benchmarks our program to industry recognized frameworks, including the International Organization for Standardization. The Audit Committee of the Board of Directors receives regular reports on cybersecurity risks and evaluates these risks as a part of their enterprise risk review.

companyName: National CineMedia, Inc.

ticker: NCMI


text: Our teams also rely on third-party diagnostic tools and periodic audits to ensure that our program is performing as designed and in-line with applicable standards. Our Chief Information Officer oversees a security committee made up of professionals on our corporate security and other information technology teams to review the results of these audits and recommend improvements. Prior to engaging a third party to provide services, our information technology team performs a risk assessment to determine the level of review of the vendor needed based on the nature of the services to be provided and type of information that may be shared. The resulting vendor review may include requiring the vendor to provide the results of external audits. We continue to monitor our vendors throughout their engagements with us to ensure they have complied with their contractual obligations, including service level agreements and other contractual standards.


text: We have also established an incident response plan to assess, identify and manage specific potential cybersecurity incidents. This plan requires the corporate security team to notify a response team. The response team assesses the risks of the identified potential incident and determines an appropriate response based on the risks identified. The response team then reports on the incident to senior management and, if necessary, a subset of our financial disclosure committee to determine if the cybersecurity incident should be reported in our public filings.


text: We face cybersecurity risks in connection with our business operations. Although such risks have not materially affected us, including our business strategy, results of operations or financial condition, to date, we have experienced threats to our data and systems, including social engineering threats, denial of service attacks, malware and computer virus attacks. For more information about the cybersecurity risks we face, see Item 1A—Risk Factors.


text: Board Oversight—The Audit Committee of the Board of Directors oversees the Company's cybersecurity program. The cybersecurity team updates the Audit Committee on at least a quarterly basis to discuss the effectiveness of the Company's risk management program, potential and identified threats, remediation and mitigation plans, and other topics as requested by the Audit Committee. The Audit Committee regularly reports to the full Board of Directors and management reports on specific matters as requested by the Board of Directors.


text: Management's Role— The Company's Chief Information Officer is responsible for the Company's cybersecurity team and for reporting to the Audit Committee of the Board of Directors. The Company's corporate security team reports directly to the Chief Information Officer. Our Chief Information Officer has more than thirty years of experience managing communication networks, data centers, information technology teams, systems administration and cybersecurity in the media and advertising industry. Our corporate security team is similarly composed of seasoned professionals with significant experience in the field. The Chief Information Officer regularly informs the Company's senior management regarding the prevention, detection, mitigation and remediation of cybersecurity incidents and supervises such efforts. The corporate security team has a broad range of experience selecting, deploying and operating cybersecurity technologies initiatives and seeks to ensure that each team stays educated on emerging technologies and threats.


text: Our information security organization comprises internal and external resources designed to identify, protect, detect, mitigate, resolve, and recover from various threats and attacks by malicious actors. We leverage 24x7x365 monitoring tools and services to address the confidentiality, integrity, and availability of Silvercrest assets and data. Regular internal and third-party reviews are performed on our processes and technologies to validate the effectiveness of our privacy and data security controls and safeguards. We monitor industry best practices and developments in data privacy and security, including increased scrutiny of third-party service providers with access to sensitive Silvercrest data. We have implemented and maintain a written proprietary security incident response plan, with defined roles and responsibilities that address notification obligations and incident response procedures to follow in the event of a data security breach. We are dedicated to business continuity and resiliency, and have documented strategies, policies, and procedures in place to protect employee, business, and client data in the event of an emergency or natural disaster. Our information security risk management processes are integrated into our broader risk management program.

companyName: Silvercrest Asset Management Group Inc.

ticker: SAMG


text: Managing Material Risks & Integrated Overall Risk Management We have implemented tools and strategies to promote a company-wide culture of cybersecurity risk management. This ensures that cybersecurity considerations are an integral part of our decision-making process. Our IT Department works closely with our leadership and key operating personnel to evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.

companyName: Arcturus Therapeutics Holdings Inc.

ticker: ARCT


text: Our information security function and our Vice President of Information Technology help identify, assess and manage the Company's cybersecurity threats and risks. This group works to identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile using various methods in certain contexts, including, for example, manual tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threat actors, conducting scans of certain environments, evaluating certain threats reported to us, conducting threat and vulnerability assessments, using external intelligence feeds, and using third parties to conduct tabletop incident response exercises and other tests.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our information systems and data, including, for example: incident detection and response, disaster recovery/business continuity policies, encryption of certain data, network security controls and data segmentation for certain systems, access controls, physical security, asset management and tracking, systems monitoring, annual mandated employee training, penetration testing, cybersecurity insurance, and dedicated cybersecurity staff.


text: Oversee Third-party Risk Because we are aware of the risks associated with third-party service providers, we conduct thorough security assessments of all determined high-risk third-party providers as deemed necessary, before engagement to ensure compliance with industry cybersecurity standards and frameworks. This includes assessments performed by our Vice President of IT, who oversees the Company's cybersecurity function.


text: Risks from Cybersecurity Threats We have not encountered cybersecurity challenges that have materially affected or are reasonably likely to materially affect our operations or financial standing.


text: Board of Directors Oversight The Audit Committee of the Board (the "Audit Committee") is central to the Board's oversight of cybersecurity risks and bears the primary responsibility for this domain. The Audit Committee is composed of board members with diverse expertise including, risk management, and finance, equipping them to oversee cybersecurity risks effectively. The Audit Committee receives briefings on cybersecurity risks from the Vice President of IT or the Chief Legal Officer as described below in "Management's Role Managing Risk."


text: Management's Role Managing Risk The Vice President of IT, Chief Legal Officer ("CLO") and the Director of IT Infrastructure and Security, play a pivotal role in informing the Audit Committee on cybersecurity risks. They provide briefings to the Audit Committee on a regular basis, with a minimum frequency of once per year. The current Vice President of IT, who is responsible for assessment and management of cybersecurity risks, has over 20 years of experience in information and technology security, including senior roles at several companies in the pharmaceutical industry, and possesses the requisite education, skills, experience, and industry certifications expected of an individual assigned to these duties. These briefings encompass a broad range of topics, including: • Current cybersecurity landscape and emerging threats; • Status of ongoing cybersecurity initiatives and strategies; • Incident reports and learnings from any cybersecurity events; and • Compliance with regulatory requirements and industry standards.


text: Risk Management Personnel Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the Vice President of IT and the Director of IT Infrastructure and Security. Our IT Leadership team oversees our governance programs, tests our compliance with standards, remediates known risks, stays informed of significant developments in the cybersecurity domain, and leads our employee training program.


text: Monitor Cybersecurity Incidents The Vice President of IT is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. In cooperation with the Vice President of IT, the Director of IT Infrastructure and Security implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the Vice President of IT is equipped with a well-defined incident response plan. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.


text: Reporting to Board of Directors The Vice President of IT and the Director of IT Infrastructure and Security, in their respective capacity, inform the Chief Financial Officer (CFO) and Chief Legal Officer (CLO) of cybersecurity risks and incidents. Furthermore, significant cybersecurity matters, and strategic risk management decisions are required to be escalated to the Board, ensuring that they have comprehensive oversight and can provide guidance on critical cybersecurity issues. See Item 1A "Risk Factors" – "Risks Related to Business Operations and Industry."


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the risk management program to other legal, compliance, strategic, operational, and financial risk areas.

companyName: Atea Pharmaceuticals, Inc.

ticker: AVIR


text: Key elements of our cybersecurity risk management program include, but are not limited to, the following: • risk assessments designed to help identify material risks from cybersecurity threats to our critical systems and information; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to monitor, assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, including incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for key service providers based on our assessment of their criticality to our operation and respective risk profiles.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section titled "Risk Factors — Our business and operations may suffer in the event of information technology system failures, cyberattacks, or deficiencies, which could materially affect our results."


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Audit Committee") oversight of cybersecurity risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program.


text: The Audit Committee receives periodic reports from management on our cybersecurity risks. These reports include updates on our processes for preparing for, preventing and detecting cybersecurity incidents. Between such regular updates, the Audit Committee would be notified regarding any significant cybersecurity threat or incident, if applicable. The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity.


text: Our information technology ("IT") team, which includes both our internal staff and retained consultants with IT and cybersecurity expertise, is led by our Vice President of IT who has more than 25 years of experience managing and securing technology infrastructure and is certified in cybersecurity by the Information System Security Certification Consortium. The IT team has responsibility for, among other things, developing and implementing practices, procedures and controls designed to identify, assess and manage cybersecurity programs and risks. The IT team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment. Our IT team is supplemented by a security committee, comprised of representatives from key functional areas of our business and includes both our CFO and our Sr. VP of Human Resources to whom the Vice President of IT reports.


text: Cybersecurity Risk Management and Strategy; Effect of Risk We face risks related to cybersecurity such as unauthorized access, cybersecurity attacks and other security incidents, including as perpetrated by hackers and unintentional damage or disruption to hardware and software systems, loss of data, and misappropriation of confidential information. To identify and assess material risks from cybersecurity threats, we maintain a comprehensive cybersecurity program and work with a third party managed service provider to ensure our systems are effective and prepared for information security risks, including regular oversight of our programs for security monitoring for internal and external threats to ensure the confidentiality and integrity of our information assets. We consider risks from cybersecurity threats alongside other company risks as part of our overall risk assessment process. We and our third-party partners employ a range of tools and services, including regular network and endpoint monitoring and protection, audits, vulnerability assessments, and penetration testing, to inform our risk identification and assessment. As discussed in more detail under "Cybersecurity Governance; Management" below, our audit committee provides oversight of our cybersecurity risk management and strategy processes, which are led by our Principal Executive Officer and Principal Financial Officer.

companyName: SYNLOGIC, INC.

ticker: SYBX


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition, under the heading "Our internal computer systems, or those of our collaborators or other contractors or consultants, may fail or suffer cybersecurity incidents, which could result in a material disruption of our product development programs," which disclosures are incorporated by reference herein. In the last three fiscal years, we have not experienced any cybersecurity incidents which have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition.


text: At least annually and on a periodic basis, our audit committee receives an update from management on our cybersecurity threat risk management and strategy processes and generally receives materials on our ability to mitigate current and emerging risks. Our processes require that our audit committee is designated to receive prompt and timely information regarding any cybersecurity incident that meets establishing reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by the Company's Principal Executive Officer and Principal Financial Officer, along with the Company's managed services provider, which monitors the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. As discussed above, the Company's Principal Executive Officer and Principal Financial Officer reports to the audit committee of our board of directors about cybersecurity threat risks, among other cybersecurity related matters, on an annual basis.


text: Our cybersecurity program is designed to protect our information, and that of our customers, against cybersecurity threats that may result in adverse effects on the confidentiality, integrity, and availability of our information systems. Our cybersecurity risk management program, which is integrated into our overall enterprise risk management program, includes policies, processes and technologies to assess, identify and manage risks from cybersecurity threats and leverages the National Institute of Standards and Technology Cybersecurity Framework.

companyName: Exodus Movement, Inc.

ticker: EXOD


text: Our Board, with assistance from its Audit Committee, oversees the Company's enterprise risk management process, including the management of risks arising from cybersecurity threats. Our Audit Committee receives reports on significant cybersecurity developments from the management team responsible for overseeing the Company's risk and cybersecurity management processes, including our Chief Compliance Officer and VP of Infrastructure & Security. We also have protocols by which certain cybersecurity incidents are escalated within the Company and, where appropriate, reported to our Board in a timely manner.


text: At the management level, our VP of Infrastructure & Security leads the team responsible for implementing, monitoring and maintaining our cybersecurity risk management program across our business. He has extensive cybersecurity knowledge and skills gained from over 15 years of relevant work experience, including various leadership and management roles in information technology at the Company and elsewhere. He also has a Bachelor of Science in information systems.


text: Risk Management and Strategy Our cybersecurity program includes technical safeguards, including automated tools managed and monitored by our cybersecurity team. Additionally, we regularly conduct penetration and vulnerability testing and tabletop exercises, along with regular employee training on cybersecurity matters. We also employ systems and processes designed to oversee, identify, and reduce the potential impact of a security incident at a third-party vendor, service provider or customer or otherwise implicating the third-party technology and systems we use.


text: While we have not identified any material cybersecurity threats or incidents in the last year that have had a material adverse effect on our business, there can be no guarantee that we will not be the subject of future successful attacks, threats or incidents. For more information on our cybersecurity related risks, see "Item 1A. Risk Factors—Risks Related to Our Business – Any actual or perceived failure of the Exodus Platform to block malware or prevent failures or security breaches or other cybersecurity incidents could harm our reputation, cause the Exodus Platform to be perceived as insecure, underperforming or unreliable, impede our efforts to attract and retain users and otherwise negatively impact our business, results of operations and financial condition." of this report.


text: We have implemented and maintain various information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property and confidential information that is proprietary, strategic or competitive in nature.

companyName: Nuvation Bio Inc.

ticker: NUVB


text: Our Audit Committee, together with our information security function and third-party service providers help identify, assess, and manage the Company's cybersecurity threats and risks. Additionally they identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile using various methods including, for example using automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting scans of the threat environment, evaluating our and our industry's risk profile, evaluating threats reported to us, conducting internal and/or external audits, conducting threat assessments for internal and external threats, third party threat assessments, conducting vulnerability assessments to identify vulnerabilities, and using external intelligence feeds.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: cybersecurity-related policies and procedures (including incident response plans and policies, a vulnerability management policy, disaster recovery/business continuity plans), incident detection and response, periodic risk assessments, implementation of security standards/certifications, encryption of data, network security and system monitoring controls (including technology solutions such as antivirus, firewalls and monitoring tools), awareness training for all employees, security measures, asset management, tracking and disposal, penetration testing, cybersecurity insurance coverage, and a dedicated cybersecurity staff.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, (1) cybersecurity risk is addressed as a component of the Company's enterprise risk management program; (2) security management works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business; (3) our management evaluates material risks from cybersecurity threats against our overall business objectives and reports to the audit committee of the board of directors, which evaluates our overall enterprise risk, and (4) we have a cybersecurity incident response plan to identify, assess, respond to, and inform escalating levels of management based on the nature and severity of such incidents.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example Professional services firms, including legal counsel, threat intelligence service providers, cybersecurity consultants, cybersecurity software providers, managed cybersecurity service providers (including SIEM tools and 24/7 managed detection and response), penetration testing firms, and dark web monitoring services.


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, and contract research organizations. We have a vendor management program to manage cybersecurity risks associated with our use of these providers. The program includes a risk assessment for each vendor, a security questionnaire, review of the vendor's written security program, review of security assessments and other reports. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The audit committee of our board of directors is responsible for oversight of the Company's cybersecurity risk. Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Senior Director Infrastructure, Operations and Cyber Security who has fifteen years of experience in the industry and oversees the Company's infrastructure, operations and cyber security, and our Vice President of Legal, who has expertise in legal, compliance and privacy matters.


text: Our Senior Director Infrastructure, Operations and Cyber Security is responsible for integrating cybersecurity risk considerations into the Company's overall risk management strategy, communicating key priorities to relevant personnel, approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, reviewing security assessments and other security-related reports, and retaining assessors, consultants, auditors, or third parties in connection with the company's cybersecurity program.


text: Our cybersecurity incident response processes and policies are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the Senior Director Infrastructure, Operations and Cyber Security, who works with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response processes and policies include reporting to the audit committee of the board of directors for certain cybersecurity incidents.


text: The board of directors and audit committee receive periodic reports concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The board of directors and audit committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: As discussed in this Annual Report on Form 10-K, the changes in our business and operations that will occur in connection with our review of strategic alternatives may impact our cybersecurity program in the future. As such, the following section describes the Company's cyber risk management and strategy, and governance related to cybersecurity risks, for the fiscal year that ended December 31, 2024. For more information regarding the changes to our business and operations and associated risks, please see (i) Item 1 – Business, (ii) Item 1A – Risk Factors, and (iii) Item 7 – Management's Discussion and Analysis of Financial Condition and Results of Operations in this Annual Report on Form 10-K.

companyName: Kalaris Therapeutics, Inc.

ticker: KLRS


text: We leveraged internal and external resources to support our cyber risk management efforts, including security monitoring tools, periodic penetration tests and vulnerability assessments. We have in the past also engaged the services of external information security service providers to help support our information technology environment, assist with security monitoring, and help us draft and implement information security policies.


text: To date, w e have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. As mentioned above, the changes in our business and operations may impact our cybersecurity program in the future. In addition, like other companies in our industry, we and our third-party vendors have, from time to time, experienced threats and security incidents relating to our third-party vendors' information systems and infrastructure. For more information, please see Item 1A - Risk Factors.


text: Governance Related to Cybersecurity Risks Our Vice President, Head of Information Technology meets periodically with representatives from our external Managed Services Provider ("MSP") to, as applicable, review aspects of the Company's cybersecurity processes or evaluate risks from cybersecurity threats. The individual who currently holds the title of Vice President, Head of Information Technology has over 20 years of experience in information security and cybersecurity risk management. Our Vice President, Head of Information Technology reports to the Chief Financial Officer.


text: Governance Related to Cybersecurity Risks Our board has final oversight responsibility over cybersecurity-related matters. Our Chief Technology Officer (CTO) leads the full board in interactive sessions dedicated to cybersecurity risks at least once a year. These sessions address a range of cybersecurity-related topics, such as recent developments in the threat environment, the status of ongoing information security program initiatives, and cybersecurity strategy. In addition, the audit committee assists the board in fulfilling its oversight responsibilities with respect to policies relating to risk assessment and management, including the management of risks arising from cybersecurity threats. The audit committee is responsible for reporting findings related to its review of these matters to the board.

companyName: FORRESTER RESEARCH, INC.

ticker: FORR


text: With respect to management, our CTO, who reports directly to our chief executive officer, has over 12 years of experience with our company, including more than 6 years serving in technology-based leadership roles. Our VP, Infrastructure, Operations & Security, who reports directly to the CTO, serves as our ISO and has extensive cybersecurity experience gained from over 20 years serving in security-related roles for the Company. Our ISO, together with our technology management security team, is responsible for developing, maintaining and enhancing systems and processes necessary to protect confidential information from loss, theft, and unauthorized access or use. This team also monitors the systems and networks to detect unauthorized activity or access, responding to any such unauthorized attempts to mitigate loss or to ensure the cessation of all unauthorized access to data. If an incident is identified, this team reports such events to the CTO, who will then, as appropriate, advise the chief executive officer, chief legal officer and other management, as well as others, potentially including law enforcement or clients. We have also established a Risk Committee consisting of members of our finance, legal and technology management departments whose duties include assessing the materiality of any identified incidents to help ensure compliance with the SEC's cybersecurity incident disclosure rules.


text: Cybersecurity Risk Management and Strategy As an externally managed closed-end management investment company that has elected to be regulated as a BDC under the 1940 Act, our day-to-day operations are managed by the Adviser, Administrator and our executive officers under the oversight of our Board of Trustees. Our executive officers are senior professionals of Onex Credit and each of the Adviser and Administrator is a subsidiary of Onex Corp. As such, we are reliant on Onex Corp. for assessing, identifying and managing material risks to our business from cybersecurity threats. Below are details Onex Corp. has provided to us regarding its cybersecurity program that are relevant to us.

companyName: Onex Direct Lending BDC Fund


text: For a discussion of how risks from cybersecurity threats affect our business, and our reliance on Onex Corp. and its affiliates in managing these risks, see "Item 1A. Risk Factors— Risks Related to Our Business and Structure—We may face a breach of our cyber security, which could result in adverse consequences to our operations and exposure of confidential information" in this Annual Report on Form 10-K.


text: The Managing Director – Enterprise Technology and Manager, Cybersecurity has extensive experience in technology and cybersecurity, respectively. The cybersecurity team of Onex Corp. is responsible for all aspects of cyber security across Onex.


text: The Managing Director – Enterprise Technology has 18 years of IT experience across financial services, healthcare and manufacturing industries in Canada including as the VP Financial Crimes and Enterprise Risk Technology at CIBC that provided cybersecurity platforms and services to protect the bank. Reporting to the Managing Director – Enterprise Technology, is the Manager, Cybersecurity who has over 15 years of experience in cybersecurity including Incident Readiness and Response, Strategy, GRC, Vulnerability and Threat Management, Business Continuity, Disaster Recovery. The Manager, Cybersecurity holds the CISSP (Certified Information Systems Security Professional) designation, has a BSc in Business Information Systems, and a Cybersecurity Bootcamp Certification from the University of Toronto. Reporting to the Manager, Cybersecurity is an IT Security Analyst who has over 5 years of experience in cybersecurity, including Digital Forensics, Identity and Access Management, Third-Party Risk Management. The IT Security Analyst also has a BSc in Forensic Science, an MSc in Information Security and Digital Forensics, and is currently pursuing a PHD in Information Systems and Design.


text: Impact of Cybersecurity Risks In 2024, we did not experience a material cybersecurity incident. While we do not believe that our business strategy, results of operations or financial condition have been materially adversely affected by any cybersecurity incidents, we describe whether and how future incidents could have a material impact on our business strategy, results of operations or financial condition in "Risks Related to Our Business and Structure— We may face a breach of our cyber security, which could result in adverse consequences to our operations and exposure of confidential information."


text: The Sponsor's Security Awareness Program includes training that reinforces the Sponsor's Information Security policies, standards, and practices, and the expectation that employees will comply with these policies. The Security Awareness Program engage s personnel through training on how to identify potential cybersecurity risks and protect the Sponsor's resources and information. This training is mandatory for all employees upon onboarding at the firm and again annually, and it is supplemented by firmwide training and testing initiatives, including periodic phishing tests.

companyName: Grayscale Ethereum Classic Trust (ETC)

ticker: ETCG


text: We recognize the critical importance of protecting our information technology ("IT") systems and the data of our employees, customers, patients, and partners. We have an enterprise-wide cybersecurity program designed to identify, detect, investigate, protect, and respond to cybersecurity risks.

companyName: Sight Sciences, Inc.

ticker: SGHT


text: Our policies and approach to cybersecurity include several key elements: • Continuous Monitoring and Defense: We work to protect our environments and products from threats through multi-layered defenses. We utilize data analytics to detect anomalies and search for cyber threats. Our Security Operations Center provides comprehensive, around the clock, cyber threat detection and response capabilities. • Third-Party Software Risk Assessment: W e complete security audits on all third-party platforms prior to selection. • Incident Response Plan: Our Incident Response Plan includes the investigation steps and notifications required on all actual and suspected information security incidences • Cybersecurity Training Programs: Our training program is multi-faceted and focused on awareness of new techniques that threat actors utilize both in the corporate environment, as well as their personal lives. Employees undergo regular training on information security best practices, including interactive training to confirm understanding and test employee skills. • Compliance Policy: Mandatory compliance with all cybersecurity programs, including applicable legislative and regulatory requirements. • Third-Party Cybersecurity Plan Assessment: We regularly engage with cybersecurity professionals in reviewing our cybersecurity plan.


text: To date, the Company is not aware of any cybersecurity threats, including any prior cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. However, as discussed under the heading, "Security breaches, loss of data and other disruptions could compromise sensitive information related to our business or our customer's patients, or prevent us from accessing critical information and expose us to liability, which could adversely affect our business and our reputation" in Part I, Item 1A, "Risk Factors," the Company remains subject to evolving cybersecurity risks that could have adverse impacts.


text: Risk Management and Strategy We have established policies and processes designed to assess, identify, and manage material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein. We monitor our environments to identify cybersecurity threats, as well as assess our environments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.

companyName: Atara Biotherapeutics, Inc.

ticker: ATRA


text: Following our monitoring, we adjust, implement and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with our Chief Information Officer, who reports to our Chief Financial Officer and Chief Operating Officer, to manage any identified risks and mitigation process. As part of our overall cyber security framework, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with our information technology (IT) department and management. Personnel at all levels and departments are made aware of our cybersecurity policies through ongoing training.


text: Our management team, including our Chief Legal Officer and Head of Operations and external IT consultants, is responsible for assessing and managing our material risks from cybersecurity threats. Our Chief Legal Officer is a former federal prosecutor and deputy chief of cybercrime in the U.S. Attorney's Office for the Eastern District of Virginia, as well as a former law firm partner conducting and overseeing investigations, prosecutions, and cases relating to cybercrime, hacking, trade secrets, large-scale identity theft, national security, data breaches, and related cybersecurity and data privacy matters. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience, in close cooperation with external IT consultants, includes significant experience of leading and managing IT infrastructure and security operations teams for various sized global companies across several different industries.

companyName: Unity Biotechnology, Inc.


text: Our board of directors and management exercise oversight over our cybersecurity program, which represents an important component of our overall approach to enterprise risk management.

companyName: Alpha Teknova, Inc.

ticker: TKNO


text: Teknova's Vice President of Information Systems and Architecture (VP of IT) manages a team responsible for leading enterprise-wide strategy, policy, standards, architecture, processes, and risk assessment related to information security and data protection, including data privacy and network security (our Cybersecurity Program). The VP of IT has served in various roles in information technology and information security, along with other members of the IT department, and holds relevant and applicable certifications. The VP of IT reports directly to our Chief Executive Officer and provides periodic reporting on our Cybersecurity Program to our senior management team, our board of directors, and the audit committee of our board of directors.


text: Our board of directors, in coordination with our audit committee, oversees our management of cybersecurity risk, with the audit committee reviewing and discussing with management matters related to our Cybersecurity Program, including as it relates to financial reporting. The board of directors and audit committee receive periodic reports about the prevention, detection, mitigation, and remediation of cybersecurity incidents, including material security risks and information security vulnerabilities. Additionally, risks associated with the Cybersecurity Program are integrated into our enterprise risk management assessment and reported to our Board as needed. We also share the key results of third-party assessments with our board of directors and audit committee.


text: Technical Safeguards As part of our Cybersecurity Program, we deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.


text: The Company is committed to protecting the confidentiality, integrity, and availability of its information systems and the data they contain from cybersecurity threats. The Company recognizes that cybersecurity is a dynamic and evolving area of risk that requires ongoing assessment, management, and oversight. The Company works with third party companies to assess, identify, manage, and mitigate material cybersecurity threats, as well as to respond to and recover from cybersecurity incidents.

companyName: GEN Restaurant Group, Inc.

ticker: GENK


text: Management's Role Managing Risk Our CEO, Chief Financial Officer ("CFO"), and Information Technology Manager ("IT Manager") play a primary role in informing the Audit Committee on cybersecurity risks. Our IT Manager has seven years of experience with the Company, which includes management of cybersecurity. These individuals monitor activity and potential risks related to the day-to-day operations of the business, including reviewing results of the work of our outside consultants. They will provide briefings to the Audit Committee on a periodic basis regarding cybersecurity matters, including but not limited to the following: • Current cybersecurity landscape and emerging threats; • Status of ongoing cybersecurity initiatives and strategies; • Incident reporting, if any, and learning from any cybersecurity events; • Risk mitigation efforts and insurance, and • Compliance with regulatory requirements and industry standard.


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part I. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "Our information technology systems or sensitive data, or those of our third-party CROs or other contractors or consultants, or third parties with whom we work, may fail or suffer security incidents, loss or leakage of data, and other disruptions, which could result in a material disruption of our product candidates' development programs, compromise sensitive data related to our business or prevent us from accessing critical information, potentially exposing us to liability or otherwise adversely affecting our business."

companyName: Design Therapeutics, Inc.

ticker: DSGN


text: Key elements of our cybersecurity risk management program include but are not limited to the following: • risk assessments designed to help identify material risks from cybersecurity threats to our critical systems and information; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, including incident response personnel, and senior management; and • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for key service providers, suppliers, and vendors based on our assessment of their criticality to our operations and respective risk profile.

companyName: Aligos Therapeutics, Inc.

ticker: ALGS


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section titled "Risk Factor— Risks related to product development and regulatory process—Our business and operations may suffer in the event that our information technology systems, or those used by our CROs or other contractors or consultants, fail or suffer security breaches."


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (Committee) oversight of cybersecurity risks, including oversight of management's implementation of our cybersecurity risk management program. The Committee receives reports from management on our cybersecurity risks, at a minimum annually and as needed. In addition, management updates the Committee, where it deems appropriate, regarding any cybersecurity incidents it considers to be significant or potentially significant. The Committee reports to the full Board regarding its activities, including those related to cybersecurity.


text: Our management team, lead by our Executive Director, Information Technology, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises our retained external cybersecurity consultants. Our Executive Director, Information Technology's experience includes 25 years of experience in managing IT environments including assessing the overall risk management program and material risks, as well as building our cybersecurity framework over the past six years.


text: Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: Our Vice President of Information Technology leads the operational oversight of company-wide cybersecurity strategy, policy, standards, and processes and works across relevant departments to assess and help prepare us and our employees to address cybersecurity risks. The Vice President of Information Technology has over 25 years of experience working with life science companies and venture capital firms in the information technology field, a certificate from HarvardX (Cybersecurity: Managing Risk), and an active membership in Health-ISAC.

companyName: Inozyme Pharma, Inc.


text: The Corporation's cybersecurity risk management policies include physical, administrative and technical safeguards, as well as plans and procedures designed to help the Corporation seek to prevent and effectively respond to cybersecurity threats and incidents, including threats or incidents that may impact us or RCM. In addition, our cybersecurity risk management program includes periodic identification and testing of our vulnerabilities and cybersecurity awareness training. Finally, our Chief Compliance Officer conducts an annual due diligence review, including as to cybersecurity matters, of those third-party service providers that have possession of the Corporation's material non-public information and reports the results of those assessments to the Board.

companyName: RAND CAPITAL CORP

ticker: RAND


text: Material Impact of Cybersecurity Risks In the last three fiscal years ended December 31, 2024, we have not experienced a material information security breach incident, and we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business strategy, results of operations or financial condition. However, future incidents could have a material impact on our business strategy, results of operations or financial condition. For additional discussion of the risks posed by cybersecurity threats, see "Item 1A. Risk Factors — Risks related to our Business and Structure — We are subject to cybersecurity risks and incidents that may adversely affect our operations, the operations of RCM or the companies in which we invest. A failure in our, or RCM's, cybersecurity systems could impair our ability to conduct business and damage our business relationships, compromise or corrupt our confidential information and ultimately negatively impact business, financial condition and operating results."


text: The Company understands that security of our banking operations is critical to protecting our customers, maintaining our reputation and preserving the value of the Company. The Company is focused on addressing cybersecurity risks on confidentiality, integrity, and the availability of the information the Company collects, transmits and stores by identifying, preventing, and mitigating cybersecurity risks. The Board of Directors, through the Board Risk and Audit Committees, and the Company's Enterprise Risk Management Committee provide direction and oversight of the enterprise-wide risk management program of the Company, which includes the Information Security Program. The Chief Information Officer and the Chief Risk Officer oversee these programs to accomplish the following: • assure the confidentiality, integrity and availability of our information and information systems; • protect against any anticipated threats or hazards to the confidentiality, integrity or availability of such information and information systems; and • protect against unauthorized access to or use of such information or information systems that could result in substantial harm or inconvenience to us, our clients and the value of the Company.

companyName: CIVISTA BANCSHARES, INC.

ticker: CIVB


text: These programs establish policies (including vendor management), procedures, risk assessments, systems, monitoring, reporting, strategies, and training to effectively manage cybersecurity risks. Specifically, the Company deploys multiple layers of controls, including embedding security into our technology investments, designed to identify, protect, detect, respond to and recover from information security and cybersecurity incidents. The Company also performs simulations and drills to further ensure our readiness and preparedness for potential threats. In addition, the Company employs a nationally recognized firm with information security experts to annually perform audits that extensively test our program and controls, which are reviewed by the Board Audit Committee. These programs and controls align with Federal Financial Institutions Examination Council guidelines and standards.


text: While we do not believe that our business strategy, results of operations or financial condition have been materially adversely affected by any cybersecurity incidents, cybersecurity threats are present and similar to other financial institutions. The Company, as well as our customers, colleagues, regulators, service providers and other third parties, have seen an increase in information security and cybersecurity risk in recent years. We continue to assess the risks and threats in the cyber environment, invest in enhancements to our cybersecurity capabilities, and engage in industry and government forums to promote advancements in our cybersecurity collaboration and capabilities.


text: Risk management and strategy Cybersecurity is a critical aspect of our operations, and our board of directors and management prioritize safeguarding our digital assets and ensuring the integrity and confidentiality of sensitive information to protect our assets, customers, and stakeholders. Our cybersecurity program is managed by our Global IT Director and overseen by our executive leadership team and board of directors. It encompasses risk management, a management framework, governance, education and training across the organization, SOC2 compliance, and an incident response protocol.

companyName: Bright Mountain Media, Inc.

ticker: BMTM


text: We employ a proactive risk management strategy to identify, assess, track, and mitigate cyber security risks. Our risk assessment process involves continuous monitoring of our IT infrastructure, external vulnerability assessments, and reviews of our third-party relationships. We prioritize risks based on their potential impact on our operations and implement targeted controls and safeguards to mitigate identified threats.


text: Our Cybersecurity management framework is aligned with the Cybersecurity Framework (CSF) developed by the National Institute of Standards and Technology (NIST) and COBIT 2019. This framework provides a structured approach to managing our policies, standards, and processes, improving our cyber security posture. Additionally, we maintain SOC2 compliance, demonstrating our adherence to industry-recognized security standards and best practices.


text: Our board of directors and executive leadership team, through our Information Security Executive Charter, oversees our risk management program, of which cybersecurity represents an important component. Our Global IT Director is responsible for managing our risk management program, including our cybersecurity strategies and initiatives and the periodic review of our policies, standards, and risks. Our Global IT Director has over 25 years of experience in technology and security.


text: Our board of directors and executive leadership approves cyber security strategies, initiatives, and investments to ensure alignment with business objectives and risk tolerance.


text: In the event of a cyber security incident, we would follow an incident response protocol that includes procedures for incident tracking, escalation, containment, eradication, and recovery. As part of our incident response process, we would adhere to SEC reporting requirements related to cyber security incidents, providing timely and transparent disclosures as necessary.


text: Cybersecurity threats, and their evolving nature, pose a risk to us and our strategy, results of operations, and financial condition in the future. Our risk factors include further detail about the cybersecurity risks we face. To date, cybersecurity threats or incidents have not materially affected us or our operations. Our focus on risk management, governance, compliance, and incident response is intended to mitigate the potential harm posed by evolving cyber threats and challenges.


text: Our cybersecurity risk management program includes: • periodic risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • teams principally responsible for managing (1) our cybersecurity risk assessment and mitigation processes, (2) our security controls, and (3) our response to cybersecurity incidents; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response and reporting plan that includes procedures for responding to cybersecurity incidents; • a team responsible for compliance with security and regulatory standards including, but not limited to, Service Organization Controls (SOC) reporting, International Organization for Standardization (ISO) frameworks 27001/27017/27018/27701, FedRAMP, and HIPAA; • the use of external service providers, where appropriate, to audit, assess, test or otherwise assist with aspects of our security controls, and to assist with the design and implementation of our cybersecurity policies and procedures; and • a third-party risk management process for service providers, suppliers, and vendors.

companyName: BOX INC

ticker: BOX


text: Senior leaders of global cybersecurity, governance, risk and compliance teams are responsible for assessing and managing our material risks from cybersecurity threats. They also have primary responsibility for our overall cybersecurity risk management program and supervise both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes industry-specific expertise in SaaS technology, regulatory compliance knowledge, previous leadership roles in cybersecurity or related fields, as well as a track record of successfully implementing effective cyber risk mitigation strategies.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engage d by us; and alerts and reports produced by security tools deployed in the IT environment.


text: We have implemented a comprehensive cybersecurity program designed to identify, assess, and mitigate potential threats and vulnerabilities, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. Our cybersecurity program includes regular risk assessments, network monitoring, penetration testing and incident response protocols. We also provide regular, mandatory training to our personnel regarding cybersecurity threats to educate employees with effective tools and knowledge to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices. Our Senior Director of Operations/IT and his team work collaboratively across the Company and with our board of directors and management to maintain our cybersecurity program and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans. Our board of directors and management receive periodic cybersecurity updates from our Senior Director of Operations/IT, which may include recent material cybersecurity incidents and related responses, if any, changes to the risk landscape, and updates or changes to our cybersecurity program. The Company's Senior Director of Operations/IT has served in various roles in information technology and information security at Gaia for over 18 years.

companyName: GAIA, INC

ticker: GAIA


text: Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with our management. Our Senior Director, Human Resources & Infrastructure, who together with our Chief Financial Officer and General Counsel, work in close partnership with our outside information technology and cybersecurity consulting firm, and collectively, comprise the core team members of our Rapid Response Team under our Incident Response Policy. The Rapid Response Team is made up of a broad range of participants with relevant education, skills, and experience to investigate cybersecurity threats and assess the materiality thereof to determine internal reporting to our audit committee and board of directors, as well as external reporting or disclosure requirements. Management provides at least quarterly updates to the audit committee, and in turn management and the audit committee provide periodic updates to our board of directors, regarding ongoing cybersecurity risk assessments and related activities.

companyName: Lineage Cell Therapeutics, Inc.

ticker: LCTX


text: Following these risk assessments, we consider whether and how to re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. In consideration of the size and complexity of our business, we devote significant internal and external resources to manage material risks from cybersecurity threats. We also designate specific personnel, including our Senior Director, Information Technology, to manage the risk assessment and mitigation process and to closely coordinate with our General Counsel on applicable regulatory obligations.

companyName: Tenaya Therapeutics, Inc.

ticker: TNYA


text: Our Senior Director, Information Technology, along with the members of our Incident Response Team, which includes our Senior Vice President, Finance and our General Counsel, are primarily responsible to assess and manage our material risks from cybersecurity threats. Our Incident Response Team is supported by an experienced managed service provider and an incident response provider with extensive global cybersecurity expertise, who each monitor, assess and report threats to us. Additionally, our Senior Director, Information Technology has over twenty years of experience operating in the information technology, security and cybersecurity space. In particular, he has experience with cybersecurity assessment and prevention, incident responses, breach notifications and remediation.


text: Our Senior Director, Information Technology oversees our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above and, along with and informed by the Information Technology organization and our Incident Response Team, monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents. Depending on the severity of the security incident, the Incident Response Team will report the security incident to our Audit Committee, including the financial impact of the security incident and any regulatory violations. As our Information Technology organization monitors the security and effectiveness of our policies and procedures, they also work to keep the Senior Director, Information Technology and other members of leadership informed of critical incidents, process updates, or other material details, in accordance with our internal reporting structure.


text: Our Audit Committee receives an annual briefing regarding our company's cybersecurity risks and activities, including the status of cybersecurity system development, company-wide cybersecurity training programs, material changes to the cybersecurity system, policies or practices, any recent cybersecurity incidents and related responses, cybersecurity systems testing and engagement of third-party service providers in support of our cybersecurity system. Special meetings may also be called with the Audit Committee to brief the members on any material cybersecurity incidents and related responses thereto. After such briefings, our Audit Committee will provide an update to the Board on such reports. In addition, the Board will receive periodic updates in meeting materials or directly from our Senior Vice President, Finance on cybersecurity risks and activities.


text: Cyber Risk Management and Strategy Our manager of information technology works in conjunction with our third-party managed security service provider to establish and maintain our cybersecurity risk management processes, which are informed by and incorporate elements of recognized industry standards, such as the National Institute of Standards and Technology Cybersecurity Framework. We also leverage our managed security services provider and other third-party consultants, providers, and technologies to support our internal information technology resources to monitor, identify, and address cybersecurity risks, including managing our monitoring and alerting tools and conducting periodic assessments of certain system applications.

companyName: MYOMO, INC.

ticker: MYO


text: Further, as part of our cybersecurity risk management, we have adopted an incident response plan that has been designed to identify and manage significant events that may impact our information technology infrastructure, including those arising from or related to cybersecurity threats.


text: We conduct periodic risk assessments of our information technology systems as part of our cybersecurity risk management processes and to evaluate the effectiveness of applicable security controls. Our efforts to address cybersecurity risks also include training employees, both from programs provided by our third-party managed security service provider and internal policies and training, which are designed to increase awareness of cybersecurity threats.


text: Although risks from cybersecurity threats have to date not materially affected, and we do not believe they are reasonably likely to materially affect, us, our business strategy, results of operations or financial condition, we do, from time to time, experience threats and communicate security incidents relating to our and our third-party vendors' information systems. For more information please see the section entitled "Risks Related to Cybersecurity and Data Protection" in Item 1A- Risk Factors.


text: Governance Related to Cybersecurity Risks Our cyber risk management program and related operations and processes are directed by our Chief Financial Officer, in consultation with internal information technology resources, other members of senior management and our third-party security managed service provider. The Chief Financial Officer is responsible for identifying, evaluating, and implementing risk management control and methodologies to address any identified risks, including risks from cybersecurity threats, with advice from our third-party managed security service provider as appropriate.


text: The Chief Financial Officer periodically provides reports to the technology, quality and regulatory committee of the board of directors regarding information technology and cybersecurity matters and associated risks. The technology, quality and regulatory committee is responsible for reviewing and overseeing the Company's risk management process and strategy, including risks from cybersecurity threats. The technology, quality and regulatory committee periodically reports on cybersecurity risk management to the full board of directors.


text: As a part of its cybersecurity program, GECM's cybersecurity processes and systems are reviewed and assessed by third parties. These third parties assess and report on GECM's compliance with applicable laws and regulations and its internal incident response preparedness, including benchmarking to best practices and industry frameworks. These third parties also help identify areas for continued focus and improvement. Annual penetration testing of its network, including critical systems and systems that store confidential or sensitive information, is conducted with third-party consultants and vulnerabilities are reviewed by Great Elm's Information Technology & Security Committee ("IT Committee"), comprised of GECM's Chief Operating Officer and other members of Company management as well as its third-party IT and consultant. In order to oversee and identify risks from cybersecurity threats associated with its use of large vendors and material third parties who will have access to sensitive data or client systems and facilities, GECM requires third parties to adhere to GECM's cybersecurity requirements prior to accessing such data. In addition, GECM performs periodic reviews of its critical vendors with the assistance of a third-party consultant to identify and assess the vendors' security posture to reduce risk to the Company.

companyName: Great Elm Capital Corp.

ticker: GECC


text: In May 2024, the SEC adopted amendments to Regulation S-P, which, beginning in December 2025, require investment companies and SEC-registered investment advisers to adopt written policies and procedures for incident response programs to address unauthorized access to, or use of, customer information, including providing notice to certain individuals affected by any such incident. We will need to comply with this amended rule beginning December 2025. With the SEC particularly focused on cybersecurity, we expect increased scrutiny of our and GECM's policies and systems designed to manage cybersecurity risks and related disclosures.


text: Governance and Oversight of Cybersecurity Risks GECM's cybersecurity program is managed by the IT Committee. The members of the IT Committee collectively have years of experience helping to oversee the information technology infrastructure and processes at GECM and other asset managers. The IT Committee is responsible for supervising and interfacing with providers to implement GECM's monitoring and alert response processes, vulnerability management, changes made to its critical systems, including software and network changes, and various other technological and administrative safeguards.


text: GECM has also developed an incident response framework to monitor the prevention, detection, mitigation and remediation of cybersecurity events. This framework is managed and implemented by the IT Committee, with support from third-party consultants. The IT Committee alongside the General Counsel and Chief Compliance Officer of GECM are responsible for gathering information with respect to cybersecurity incidents, assessing their severity and determining potential responses, as well as communicating with business leaders and senior management and the Board of Directors, as appropriate.


text: Our Board monitors cybersecurity risk as part of GECM's overall risk management program. Our Board has delegated the primary responsibility for oversight and review of guidelines and policies with respect to risk assessment and risk management to the Audit Committee, which includes oversight of risks related to cybersecurity threats. The Audit Committee and the Board, as appropriate, are informed about risks related to cybersecurity threats through periodic reports from GECM's Chief Operating Officer. Such reporting includes updates on GECM's cybersecurity program, the external threat environment, and GECM's programs to address and mitigate the risks associated with the evolving cybersecurity threat environment. These reports also include updates on GECM's preparedness, prevention, detection, responsiveness and recovery with respect to cyber incidents, where applicable.


text: Impact of Cybersecurity Risks As of the filing of this Form 10-K, we are not aware of any cyber-attacks that have occurred since the beginning of 2024 that have materially affected, or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. We acknowledge that we cannot eliminate all security risks within our organization, and we cannot guarantee that any undetected cybersecurity incidents have not occurred. For additional information about these risks, see "Item 1A. Risk Factors" in this Annual Report on Form 10-K.


text: We recognize the importance of assessing, identifying and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, operational disruption; intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy or security laws; other litigation and legal risk; customer attrition; and reputational risks. We have implemented several cybersecurity processes, technologies and controls to aid in our efforts to assess, identify and manage such material risks.

companyName: Paymentus Holdings, Inc.

ticker: PAY


text: Risk Management and Strategy Our cybersecurity risk assessment process helps identify our cybersecurity threat risks by assessing our cybersecurity program against industry and best practices standards set by the National Institute of Standards and Technology ("NIST"), the International Organization for Standardization ("ISO") and the Center for Internet Security ("CIS"), as well as by annually engaging experts to attempt to infiltrate/test our information systems (as such term is defined in Item 106(a) of Regulation S-K).


text: We have established a cybersecurity risk management process that includes internal reporting of significant cybersecurity risk to our senior leadership and executive team on a monthly basis. At the management level, we have established an information security risk committee, chaired by our Chief Information Security Officer ("CISO") and comprised of employees and executive management, to, among other things, coordinate and communicate the direction, current state, security risks (gaps) and governance of our information security program. Our cybersecurity program focuses in particular on the following key areas: Collaboration


text: To identify and assess material risks from cybersecurity threats, our Cybersecurity Governance, Risk and Compliance ("GRC") team considers cybersecurity threat risks alongside other company risks as part of our overall risk assessment process. Our enterprise risk professionals collaborate with subject matter experts, as necessary, to gather insights for identifying and assessing material cybersecurity threat risks, their severity and potential mitigations.


text: Incident Response and Recovery Planning We have established incident response and recovery plans and continue to regularly test and evaluate the effectiveness of those plans. Our incident response and recovery plans address and guide our employees, management and board of directors on our response to a cybersecurity incident. We also have relationships with third party experts that can be utilized in the case of an incident.


text: Third-Party Risk Management Our cybersecurity risk processes address risks associated with our use of third-party service providers, including subcontractors used by those third-parties. Third-party risks are included within our GRC and procurement program, including the selection and oversight of our third-party service providers.


text: Education and Awareness Our policies require each of our employees to contribute to our data security efforts. We regularly train employees of the importance of handling and protecting customer and employee data, including through annual privacy and security training to enhance employee awareness of how to detect and respond to cybersecurity threats. We also have annual specialized training of our development staff that focuses on secure development best practices.


text: External Assessments We perform periodic internal and third-party assessments to test our cybersecurity controls and regularly evaluate our policies and procedures for handling and control of sensitive data and systems in an effort to identify areas for continued focus, improvement and/or compliance under various applicable regulatory frameworks (e.g., SOC, SOX, PCI, HIPAA).


text: Board's Oversight Role Cybersecurity is an important part of our risk management processes and an area of continued focus for our board of directors, audit committee and management. Our board of directors is responsible for the oversight of the overall corporate approach to cybersecurity risks. The board of directors has delegated such enterprise and cybersecurity risk management to its audit committee. At least quarterly, the audit committee and/or board of directors receives an overview from management of our cybersecurity threat risk management and strategy, covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan and any material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. Members of the audit committee and the board of directors are also encouraged to engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management programs.


text: Under its charter, the audit committee is charged with discussing our major financial, information technology and cybersecurity risk exposures and the steps management has taken to monitor and control such exposures as well as the oversight of management's plans to address such risks. One member of our audit committee and board of directors has a strong background in information technology and cybersecurity risk management through service in related senior executive positions of other publicly traded companies meets regularly with our CISO to discuss our cybersecurity risk management processes.


text: Management's Role Our cybersecurity program, which is discussed in greater detail under the "Risk Management and Strategy" heading above, is led by our CISO, who has over 20 years of prior work experience in various roles with large public companies involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs. In addition, our CISO manages a team of highly trained and experienced cybersecurity professionals in support of the cybersecurity program.


text: Cybersecurity Risks In 2024, we did not identify any cybersecurity threats that resulted in a material adverse effect on our business strategy, results of operations, or financial condition. Notwithstanding the discussion above and our efforts to address cybersecurity risks, we cannot guarantee that we can mitigate or eliminate all cyber-related risks, including those related to operational disruption; intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy or security laws and other litigation and legal risk; customer attrition; and reputational risks. We urge you to read our discussion regarding whether and how risks from identified cybersecurity threats could materially affect us as part of our risk factor disclosures at "Item 1A - Risk Factors"—Risks Related to Our Business and Industry" and "—Risks Related to Our Technology and Intellectual Property" of this Annual Report on Form 10-K, which disclosures are incorporated by reference herein.


text: Risk Management and Strategy Standard BioTools regularly assesses risks from cybersecurity threats; monitors our information systems for potential vulnerabilities; and tests those systems pursuant to our cybersecurity policies, processes, and practices, which are integrated into our overall risk management program. To protect our information systems from cybersecurity threats, we use various security tools that are designed to protect against cyber security incidents, as well as to identify, escalate, investigate, resolve, and recover from security incidents in a timely manner. As part of this program, we conduct periodic assessments of our assets to evaluate the effectiveness of applicable security controls. These assessments are informed by industry standard frameworks (NIST, ISO) and include a review of our information security controls, policies and procedures to assess cybersecurity maturity against industry standards. In accordance with our IT Risk Management Program, we actively identify and assess risks based on the probability and potential impact to key business systems and processes. All risks identified are assessed to identify the range of possible outcomes and risks are prioritized by their level of importance. Each risk is assigned to a risk owner who will track, monitor, and report on the status with a risk response aligned to the probability and impact of occurrence. Risks that are considered high are incorporated into our corporate risk management program overseen by the Audit Committee of our Board of Directors (the "Audit Committee") and our Board of Directors.

companyName: STANDARD BIOTOOLS INC.

ticker: LAB


text: All employees receive cybersecurity training upon hire with at least annual training thereafter with job-specific topic considerations. Our Information Security team, consisting of the VP of Information Technology, Sr. Manager of Network Security and IT Security Manager, among others, engage third-party vendors to assist with providing timely cybersecurity threat alerts in addition to monitoring for cybersecurity threats and our defenses against cyberattacks. This monitoring includes the proactive identification of vulnerabilities in our systems through testing and threat intelligence awareness. The employees within our Information Security team and broader IT team who specialize in cybersecurity operations are responsible for coordinating and overseeing the activities of these third-party vendors.


text: In early 2024, Standard BioTools completed a merger with SomaLogic. Critical to integration activities has been a wholesale review of policies, procedures and tools relevant to the combined cybersecurity environment with the objective of deploying and maintaining those which serve to reinforce our security presence to the greatest extent. While these activities continue, it has been noted that the SomaLogic organization takes a comparable, if not more stringent, approach to their cyber and information security posture inclusive of their ongoing ISO 27001 compliance certification.


text: While our management team is responsible for the day-to-day management of the risks Standard BioTools faces, our Board of Directors has the responsibility to oversee management's processes for identifying, monitoring, and addressing enterprise risks, evaluate and discuss with management its assessments of matters relating to enterprise risks, and oversee and monitor management's plans to address such risks. The Board of Directors takes an enterprise-wide approach to risk management designed to support the achievement of organizational objectives, including strategic objectives, to improve long-term organizational performance, and to enhance stockholder value. In order to understand the most significant risks faced by the Company and the steps being taken to manage those risks, Standard BioTools conducts quarterly enterprise risk management assessments, facilitated by the Company's executive leadership team in collaboration with the internal audit function, which are presented by management at each quarterly Board of Directors meeting. The Board of Directors' review of our business is an integral aspect of its assessment of management's tolerance for risk and its determination as to the appropriate level of risk for our Company.


text: Although the Board of Directors has determined that enterprise risk management should be the responsibility of the Board of Directors as a whole, it has delegated responsibility to oversee specific areas of risk management to its committees. Our Audit Committee oversees and reviews the Company's cybersecurity, data privacy, and other information technology risks, controls and procedures, including the Company's plans to mitigate cybersecurity risks and respond to data breaches. At periodic meetings of the Board of Directors and its committees and in other meetings and discussions, management reports to the Board of Directors and its committees with respect to the most significant risks that could affect our business, including cybersecurity-related risks. Our Audit Committee also receives prompt and timely information regarding any cybersecurity incident to meet reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.


text: Our cybersecurity risk management and strategy processes are led by our Chief Financial Officer and our Vice President of Information Technology. Our Vice President of Information Technology has over 19 years of work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs and has carried relevant degrees and certifications, including Certified Information Systems Auditor. These management team members are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. As discussed above, these management team members report to the Audit Committee about cybersecurity threat risks, among other cybersecurity related matters, on an at least annual basis. Should a material breach be identified, as defined by the Board of Directors and the executive team, these management team members will notify the executive team and the Board of Directors and draft the required disclosure.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. We designed and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF).

companyName: Q32 Bio Inc.

ticker: QTTB


text: We leverage the support of third-party information technology and security providers, including for periodic security testing, as part of our risk management process, designed to identify, assess, and manage cybersecurity risks. We maintain an incident response and notification plan designed to assist us in identifying, responding to, and recovering from cybersecurity incidents, and we have a process to assess the security practices of certain third-party vendors. We have also engaged a third-party with specialized expertise in cybersecurity to conduct an audit, which resulted in no notable findings, and reported the results to the Audit Committee.


text: We, like other companies in our industry, face a number of cybersecurity risks in connection with our business. Although such risks have not materially affected us, including our business strategy, results of operations or financial condition, to date, we and/or our vendors have, from time to time, experienced threats to, or security incidents, related to our data and systems or that had the potential to otherwise impact our business.


text: Our management team, with the assistance of the Company's third-party information technology providers, is responsible for assessing and managing our material risks from cybersecurity threats. Internal personnel, including our Senior Vice President, Finance, have primary responsibility for our overall cybersecurity risk management program and supervise both our internal cybersecurity personnel and our retained external cybersecurity consultants. Members of our senior management do not have direct cybersecurity expertise obtained through certifications, but their experience managing the Company, which includes consulting and coordinating as necessary with third-party information technology and cybersecurity experts, enables them to assess and manage material risks from cybersecurity threats.


text: Our management team stays informed about and monitors efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include: briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources; and alerts and reports produced by security tools deployed in our IT environment.


text: Cyber Risk Management and Strategy We have adopted cybersecurity risk management processes, in accordance with our risk profile and business size, that are designed to identify, assess, and mitigate risks from current and emerging cybersecurity threats. Our cybersecurity processes, which are informed by the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"), are supported by a third-party Managed Service Provider ("MSP") that assists us in managing our information technology systems.

companyName: Rapport Therapeutics, Inc.

ticker: RAPP


text: We implement a multi-layered approach to cybersecurity that includes, but is not limited to, employee security awareness training, phishing simulations, incident response planning, and various cybersecurity tools and technologies. We leverage the support of third-party information technology and security providers to manage our information technology systems, including through the performance of system scans and threat intelligence analysis. We have also previously conducted a cybersecurity risk assessment that was intended to take into account the evolving cyber threat landscape and industry best practices, and we are adapting our cyber risk strategy in an effort to mitigate emerging cybersecurity risks.


text: We maintain a risk-based process to assess and review the cybersecurity practices of our third-party vendors, as appropriate, based on the level of access which the vendor has to critical operations, our information technology systems, and personally identifiable information.


text: To date, we have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition; however, like other companies in our industry, we have, from time to time, experienced threats and cybersecurity incidents relating to our information technology systems and infrastructure. Our third party vendors may also experience threats and cybersecurity incidents from time to time. For more information, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K.


text: Governance Related to Cybersecurity Risk Management is responsible for identifying, considering and assessing material risks for the business, including risks related to cybersecurity, on an ongoing basis. Our Chief Information Officer ("CIO") is responsible for our overall IT strategy and operations, including the strategic direction of our cybersecurity program, cybersecurity risk oversight and monitoring of the prevention, detection, mitigation, and remediation of cybersecurity incidents. The individual serving as our CIO has over 10 years of experience in information security.


text: Our Board of Directors has delegated oversight of our cybersecurity risk management program to our Audit Committee, per the Audit Committee Charter. Our CIO provides quarterly updates to the Audit Committee regarding our cybersecurity risks and an annual enterprise risk management update, which includes updates on plans intended to enhance our overall cybersecurity posture, to the Audit Committee. The Audit Committee updates the full Board of Directors on matters relating to cybersecurity risk management as needed.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of our management, including our Senior Director of Information Technology who has served in various roles managing information technology and information security for over twenty-five years and reports directly to the Chief Financial Officer.

companyName: ACHIEVE LIFE SCIENCES, INC.

ticker: ACHV


text: We face various cybersecurity threats, including unauthorized access, malware, ransomware, and phishing attacks. These threats could compromise the security of our information systems and the data we store and process. While we have experienced, and expect to continue to experience, cybersecurity threats, we have not experienced a material cybersecurity incident in the three year period ended December 31, 2024. The potential consequences of a material cybersecurity incident could include reputational damage, litigation with third parties, regulatory criticism or proceedings and increased cybersecurity protection and remediation costs, which in turn could materially adversely affect our results of operations.

companyName: CHOICEONE FINANCIAL SERVICES INC

ticker: COFS


text: ChoiceOne recognizes the importance of cybersecurity and has established a comprehensive framework to assess and manage material risks from cybersecurity threats. The Company's cybersecurity risk management program is overseen by the Information Technology Committee, which is responsible for developing and implementing policies and procedures to protect the Company's information assets. Key members of ChoiceOne's cybersecurity team include: