text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, please see "Risk Factors - Our internal information technology systems, and those of our third-party CROs and other third parties upon which we rely, are subject to failure, security breaches and other disruptions, which could result in a material disruption of our investigational products' development programs, jeopardize sensitive information, prevent us from accessing critical information or result in a loss of our assets, and potentially expose us to notification obligations, loss, liability or reputational damage and otherwise adversely affect our business." in Part I, Item 1A herein.


text: Our Security Committee is comprised of key management stakeholders and experts and is chaired by our Chief Information Officer, who has over 20 years of strategic and operational IT/cybersecurity leadership experience and multiple cybersecurity certifications, from leading security organizations such as (ISC)2, Cloud Security Alliance, Cisco Security, Microsoft Security. The Security Committee is responsible for helping to integrate cybersecurity risk considerations into our overall risk management strategy and communicating key priorities to relevant personnel, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: Arcus Biosciences, Inc.

ticker: RCUS

secItem: Item 1C


text: The audit committee receives periodic reports from our Chief Information Officer concerning significant cybersecurity threats and risk and the processes we have implemented to address them. Under our incident response plan, certain incidents would also be reported to the board.


text: Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include: briefings from internal personnel; threat intelligence and other information obtained from public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our IT environment.


text: Our cybersecurity program is managed by our Senior Vice President, Digital and Information Technology, or SVP of Digital and IT, whose team is responsible for leading our enterprise-wide cybersecurity policy, strategy, standards, and architecture.

companyName: Zentalis Pharmaceuticals, Inc.

ticker: ZNTL


text: Our cybersecurity program is aligned with industry standards and reasonable security safeguards for comparable companies in our industry. We also actively engage with industry participants as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures. We may engage consultants from time to time to assist us with assessing and improving our cybersecurity program.


text: The Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity program and receives periodic reports regarding the program. These reports include updates on our information security program and the status of projects to strengthen our information security systems. The Board also receives reports regarding cybersecurity risks.


text: Our management team, including our SVP of Digital and IT and our Chief Legal Officer, is responsible for assessing and managing our risks from cybersecurity threats. Certain members of our management team, including our SVP of Digital and IT and our Chief Legal Officer, are part of our Cyber Incident Response Team and are responsible for executing the processes set forth therein, including with respect to our third party service providers. Cybersecurity events are escalated to our Board as appropriate. Our management team's experience includes developing and overseeing the information technology security program as head of the information technology department and certification from the National Association of Corporate Directors for the Cyber-Risk Oversight Program.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity and availability of our critical systems and information. Our cybersecurity program is aligned with industry standards and reasonable security safeguards for comparable companies in our industry. We reference various security industry frameworks and other guidance to help us assess, identify and manage cybersecurity risks. We also actively engage with industry participants as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures. We may engage consultants or other third parties from time to time to assist us with assessing and improving our cybersecurity program.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information. See "Risk Factors—Risks Related to Employee Matters, Managing Our Growth and Other Risks Related to Our Business—Our business and operations may suffer in the event of information technology system failures, cyberattacks or deficiencies in our cybersecurity."


text: The Board considers cybersecurity risk as part of its overall risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and information security risks, including oversight of management's implementation of our cybersecurity risk management program. The Audit Committee receives periodic reports from management regarding our cybersecurity program. These reports include updates on our cybersecurity program and the status of projects to strengthen our information security systems. The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity.


text: Our management team, including our Chief Executive Officer, our Chief Legal Officer and our Executive Director, IT Infrastructure & Information Security, is responsible for assessing and managing our risks from cybersecurity threats. Certain members of our management team are part of our Cyber Incident Response Team and are responsible for executing the processes set forth therein, including with respect to our key third party service providers. Cybersecurity events are escalated to the Audit Committee or to our Board as appropriate. Our Executive Director, IT Infrastructure & Information Security, has close to thirty years of experience in information security, including twenty years of experience building and leading information security teams, and has held Certified Information Systems Security Professional certification from the International Information System Security Certification Consortium since 2002, as well as Qualified Technical Expert certification from the Digital Directors Network. Our Chief Executive Officer has thirty years of experience overseeing information technology, or IT, functions and has eight years of experience serving on the audit committees of companies that had oversight responsibility of the company's cybersecurity risk management program. Our Chief Legal Officer has overseen our IT team since 2023. Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our IT environment.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our internal and customer facing information technology systems and confidential information. As part of this program, we prioritize maintaining the highest cybersecurity standards to safeguard information stored within our information technology systems. Our cybersecurity framework and controls are designed to align with key aspects of recognized best practices and standards for cybersecurity and information technology including industry standards based upon guidelines from the Center for Information Security ("CIS") and the National Institute of Standards and Technology Cyber Security Framework ("NIST CSF"). Additionally, we incorporate guidance from the Federal Financial Institutions Examination Council ("FFIEC") to ensure we meet the expectations of our partners and any applicable regulatory requirements.

companyName: BM Technologies, Inc.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels, and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas. As part of our enterprise risk assessment function, we have implemented processes to assess, identify, and manage the material risks facing the Company, including from cyber threats. Key elements of our cybersecurity risk management program include, but are not limited to the following: • risk assessments designed to help identify material cybersecurity risks to our information technology systems and confidential information; • products and services built with security tools; • cybersecurity awareness training, including internal phishing tests of our employees, contractors, consultants, or any third-parties who will have access to our information technology systems and environment; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; • a third-party risk management process for key service providers, suppliers, and vendors based on their criticality and risk profile; and • a level of cybersecurity insurance that we believe is appropriate, taking into consideration the material risks from cybersecurity threats.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us. For more information on our cybersecurity-related risks, see Item 1A - "Risk Factors."


text: Cybersecurity Governance The Company's information technology team is responsible for assessing and managing cybersecurity risks and has a depth of experience focused on increasing the Company's resilience to security threats and stays current on new developments through monitoring of the cybersecurity landscape. The Company's information technology environment is actively monitored for potential security threats, and security events are investigated and acted on to minimize potential risk to the environment.


text: Our Board of Directors considers cybersecurity risk as part of its risk oversight function and oversees management's implementation of our cybersecurity risk management program. The Board of Directors receives periodic reports from management on our cybersecurity risks and program. In addition, management updates the Board of Directors, as necessary, regarding any significant cybersecurity incidents.


text: Our enterprise (the holding company and its operating subsidiaries) is using technology in virtually all aspects of the business. Much like many other businesses, certain of our subsidiaries' information systems have been subject to computer viruses, malicious codes, unauthorized access, and other cyberattacks. We expect to be subject to similar attacks in the future as such attacks become more sophisticated. A significant disruption or failure of our technology systems could result in service interruptions, safety failures, security events, regulatory compliance failures, an inability to protect information and assets against unauthorized users, and other operational difficulties. Attacks perpetrated against our systems could result in loss of assets and critical information and expose us to remediation costs and reputational damage.

companyName: Biglari Holdings Inc.

ticker: BH-A


text: Cyberattacks could compromise confidential customer and employee information. Cyberattacks may result in business interruptions, lost revenues, higher commodity prices, disruption in fuel supplies, lower energy consumption, unstable markets, increased security, repair or other costs, or may materially adversely affect us in ways that cannot be predicted at this time.


text: Our operating businesses are managed on an unusually decentralized basis. There are few centralized or integrated business functions. Consistent with our decentralized management philosophy, our operating businesses individually establish specific practices concerning cybersecurity risks. Although our subsidiaries have taken steps intended to mitigate these risks, including business continuity planning, disaster recovery planning, and business impact analysis, a significant disruption or cyber intrusion at one or more of our significant operations could adversely affect our results of operations, financial condition, and liquidity. Additionally, if we are unable to acquire, develop, implement, adopt, or protect rights around new technology, we may suffer a competitive disadvantage, which could also have an adverse effect on our results of operations and financial condition. Given the wide variations in the nature and size of business activities, specific practices may vary widely among our operating subsidiaries.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity program includes a cybersecurity incident response plan.

companyName: Gossamer Bio, Inc.

ticker: GOSS


text: Our cybersecurity program is integrated into our overall risk management program and includes reporting channels to the executive management team and an internal Cybersecurity Oversight Committee, as well as governance processes which communicate cybersecurity risks to departments across the organization, including legal, strategic, operational, and financial areas. This encourages consideration of cybersecurity oversight, accountability and diligence across the organization.


text: Our cybersecurity program includes: • Processes to assess cybersecurity risk, designed to help identify material cybersecurity risks to critical systems, information, products, services, and the broader enterprise information technology environment; • a security team principally responsible for coordinating and managing (1) cybersecurity risk evaluation processes, (2) implementation of cybersecurity controls, and (3) response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of the organization's cybersecurity controls; • cybersecurity awareness training of employees, incident response personnel, including third party providers, and senior management; • a cybersecurity incident response plan which includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors that have access to sensitive data or information.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, which have materially affected or are reasonably likely to materially affect the organization, including operations, business strategy, results of operations, or financial condition. For more information, see the section titled "Risk Factors— Our information technology systems, or those of any of our CROs, manufacturers, other contractors or consultants or potential future collaborators, may fail or suffer security breaches, which could result in a material disruption of our seralutinib development program, which could materially affect our results."


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated oversight of cybersecurity and other information technology risks to the Audit Committee. The Audit Committee oversees management's implementation of the cybersecurity program.


text: The Audit Committee receives formal annual reports from management regarding cybersecurity risks. In addition, management updates the Board and Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential. The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity.


text: Our management team including the Executive Vice President, Technical Operations and Administration is responsible for assessing and managing material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes collective decades of experience working in and overseeing information technology and cybersecurity functions, technical cybersecurity certifications, and active membership in cybersecurity professional organizations, as well as local groups, to support knowledge sharing and ongoing education.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us and alerts and reports produced by security tools deployed in the information technology environment.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity governance program intended to protect the confidentiality, integrity, and availability of our critical systems and information.


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This does not imply we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity governance program includes reporting channels to the executive management team and an internal Cybersecurity Oversight Committee, as well as governance processes which communicate cybersecurity risks to departments across the organization, including legal, strategic, operational, and financial areas. This encourages consideration of cybersecurity oversight, accountability and diligence across the organization.


text: Key elements of our cybersecurity governance program includes but are not limited to the following: • Processes to assess cybersecurity risk, designed to help identify material risks from cybersecurity threats to critical systems and information; • a security team principally responsible for coordinating and managing (1) cybersecurity risk evaluation processes, (2) implementation of cybersecurity controls, and (3) response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of the organization's cybersecurity processes; • cybersecurity awareness training of employees, including incident response personnel including third party providers, and senior management; • a cybersecurity incident response plan which includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for key service providers based on our assessment of their criticality to our operations and respective risk profile.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, which have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect the organization, including operations, business strategy, results of operations, or financial condition. See "Risk Factors - Our information technology systems, or those of any of our CROs, manufacturers, other contractors or consultants or Chiesi or potential future collaborators, may fail or suffer security breaches, which could result in a material disruption of our seralutinib development program, which could materially affect our results."


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated oversight of cybersecurity risks, including oversight of management's implementation of the cybersecurity governance program.


text: The Audit Committee receives formal annual reports from IT management regarding cybersecurity risks. In addition, management would update the Audit Committee and Board, where it deems appropriate, regarding cybersecurity incidents it considers to be significant or potentially significant. The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity.


text: Assessment and management of material risks from cybersecurity threats are performed by the Executive Director, Information Security, Risk & Compliance and the Vice President, IT and Facilities, reporting to the Executive Vice President, Technical Operations and Administration. Our Executive Vice President, Technical Operations and Administration reports to the President and Chief Executive Officer. This group holds primary responsibility for our overall cybersecurity governance program, along with our internal Cybersecurity Oversight Committee, which includes senior personnel from key departments in the organization. The collective experience of the individuals listed above, along with the Cybersecurity Oversight Committee, includes decades of experience working in and overseeing IT and cybersecurity functions and enterprise, IT and cybersecurity risk management functions, in addition to holding active technical cybersecurity certifications and maintaining active membership in cybersecurity professional organizations, as well as local groups, to support knowledge share and ongoing cybersecurity professional development.


text: Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us and alerts and reports produced by security tools deployed in our IT environment.


text: Cybersecurity Risk Management and Strategy We recognize the importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. As a result, we have integrated cybersecurity risk management into our broader risk management framework to promote a holistic approach toward assessing, identifying, and managing material risks associated with cybersecurity threats. This integration ensures that cybersecurity considerations are an integral part of the decision-making processes at every level of our organization.

companyName: Piedmont Lithium Inc.


text: Recognizing the complexity and evolving nature of cybersecurity threats, we have partnered with third-party cybersecurity agencies to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes remain at the forefront of industry best practices. Our cybersecurity partners work to continuously scan and monitor our networks for threats and vulnerabilities and provide access to a 24/7 incident response team. Further, through our partnerships, we conduct annual security risk assessments, which are designed in alignment with the National Institute of Standards and Technology Cybersecurity Framework and perform annual penetration tests and breach and attack simulations to validate security controls. These partnerships are actively managed by members of our management team, together with our information technology department, to ensure effective implementation.


text: Additionally, to best position Piedmont Lithium to avoid cybersecurity incidents, we, among other things, conduct employee trainings and, where appropriate, utilize a coordinated procurement process to bring consistency, compliance, and interoperability to the hardware, software, and services we obtain from vendors and other business partners. This coordinated procurement process includes, in addition to other safeguards, review by our information technology and legal departments to address any security concerns before any vendor or business partner is granted access to our information systems.


text: As of the date of this Annual Report, we have not identified risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. While we continually work to safeguard the information systems we use, and the proprietary, confidential and personal information residing therein, and mitigate potential risks, there can be no assurance that such actions will be sufficient to prevent cybersecurity incidents or mitigate all potential risks to such systems, networks and data or those of our third-party providers. For additional information, refer to Part I, Item 1A, "Risk Factors—Our business is subject to cybersecurity risks."


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management team. Our Audit Committee is responsible for the Board-level oversight of risks from cybersecurity threats. Members of our Audit Committee receive updates from our management team regarding Company practices, programs, and other developments related to cybersecurity throughout the year, including quarterly updates from our Chief Legal Officer on cyber threats and our cybersecurity risk management and strategy program. Our Audit Committee is comprised of Board members with diverse expertise, including risk management and strategy, equipping each member to oversee cybersecurity risks effectively.


text: We maintain a Cybersecurity Incident Response Team composed of professionals across various functions, including information technology, legal, finance, accounting, and risk. This team is trained in managing cybersecurity incidents and is comprised of individuals with experience in various roles involving information technology, including, security, auditing, compliance, systems, and programming.


text: Cyber criminals are becoming more sophisticated and effective every day, and all companies utilizing technology are subject to threats of breaches of their cybersecurity programs. To mitigate the threat to our business, we take a comprehensive approach to cybersecurity risk management and make securing our systems and data a top priority. Our Board and our management are actively involved in our overall enterprise risk management program, of which cybersecurity represents an important component. As described in more detail below, we have established policies, procedures and processes for assessing, identifying, and managing material risks from cybersecurity threats. There can be no guarantee that our policies, procedures and processes will be properly followed in every instance or that those policies, procedures and processes will be effective. We are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, we can provide no assurance that there will not be incidents in the future or that they will not materially affect us. For more information about risks relating to cybersecurity matters see "Item 1A. Risk-Factors—General Risk Factors—We may be vulnerable to security breaches or cyber attacks which could disrupt our operations and have a material adverse effect on our financial condition and operating results."

companyName: ESSENTIAL PROPERTIES REALTY TRUST, INC.

ticker: EPRT


text: Risk Management and Strategy Our policies, procedures and processes for assessing, identifying, and managing material risks from cybersecurity threats are integrated into our overall enterprise risk management program. Our cybersecurity program in particular focuses on the following key areas: Collaboration


text: Our cybersecurity risks are identified and addressed through a comprehensive, cross-functional approach. Personnel primarily responsible for security, risk and compliance matters meet periodically to develop strategies for preserving the confidentiality, integrity and availability of Company and tenant information, identifying, preventing and mitigating cybersecurity threats, and responding to any cybersecurity incidents. We maintain controls and procedures that are designed to ensure prompt escalation of material cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can be made by management and the Board in a timely manner.


text: At least annually, we, with the assistance of an external cybersecurity consultant, conduct a cybersecurity risk assessment that takes into account information from internal personnel, known potential information security vulnerabilities and information from external sources (e.g., reported security incidents that have impacted other companies, industry trends, and evaluations by third parties and consultants). The results of the assessment are used to drive alignment on, and prioritization of, initiatives to enhance our security controls, make recommendations to improve processes, and inform a broader enterprise-level risk assessment that is presented to our Board, its Nominating and Corporate Governance Committee, and members of management.


text: Technical Safeguards We periodically assess and deploy technical safeguards designed to protect our information systems from cybersecurity threats. Such safeguards are periodically evaluated and improved based on vulnerability assessments, cybersecurity threat intelligence and incident response experience.


text: Incident Response and Recovery Planning We have established comprehensive incident response and recovery plans and continue to periodically test and evaluate the effectiveness of those plans. Our incident response and recovery plans address—and guide our employees, management and the Board on—our response to a cybersecurity incident.


text: Third-Party Risk Management We have implemented controls designed to identify and mitigate cybersecurity threats associated with our use of third-party service providers. Such providers are subject to security risk assessments at the time of engagement, contract renewal and upon detection of an increase in risk profile. We use a variety of inputs in such risk assessments, including information supplied by providers and third parties, and investigate security incidents that have impacted our third-party providers, as appropriate.


text: Education and Awareness Each of our employees is required to comply with our cybersecurity policies. We regularly remind employees of the importance of handling and protecting our data, including through annual privacy and security training to enhance employee awareness of how to detect and respond to cybersecurity threats.


text: External Assessments Our cybersecurity policies and procedures are periodically assessed by our external cybersecurity consultant. These assessments include a variety of activities including information security maturity assessments, penetration tests, and independent reviews of our information security control environment and operating effectiveness. The results of significant assessments are reported to management, the Board and its Nominating and Corporate Governance Committee. Cybersecurity processes are adjusted based on the information provided from these assessments.


text: Our Board, in coordination with its Nominating and Corporate Governance Committee, oversees our management of cybersecurity risk. They receive periodic reports from management and our external cybersecurity consultant about the identification, prevention, detection, mitigation and remediation of cybersecurity incidents, including material security risks and information security vulnerabilities. Our Nominating and Corporate Governance Committee directly oversees our cybersecurity program. The Nominating and Corporate Governance Committee receives periodic updates from management and our external cybersecurity consultant on cybersecurity risk resulting from risk assessments, progress of risk reduction initiatives, external auditor feedback, control maturity assessments, and relevant internal and industry cybersecurity incidents.


text: Management's Role Our chief financial officer ("CFO") has primary responsibility for assessing and managing material risks from cybersecurity threats. The CFO meets periodically with our external cybersecurity consultant to review security performance metrics and identify security risks. The CFO and our external cybersecurity consultant also consider and make recommendations on security policies and procedures, security service requirements and risk mitigation strategies to the Nominating and Corporate Governance Committee.


text: Our Board, in coordination with its Nominating and Corporate Governance Committee, oversees our management of cybersecurity risk. They receive periodic reports from management and our external cybersecurity consultant about the identification, prevention, detection, mitigation and remediation of cybersecurity incidents, including material security risks and information security vulnerabilities. Our Nominating and Corporate Governance Committee oversees risks arising from our cybersecurity program. The Nominating and Corporate Governance Committee receives periodic updates from management and our external cybersecurity consultant on cybersecurity risk resulting from risk assessments, progress of risk reduction initiatives, external auditor feedback, control maturity assessments, and relevant internal and industry cybersecurity incidents.


text: Management's Role Our Chief Financial Officer has primary responsibility for assessing and managing material risks from cybersecurity threats. The Chief Financial Officer meets periodically with our external cybersecurity consultant to review security performance metrics and identify security risks. The Chief Financial Officer and our external cybersecurity consultant also consider and make recommendations on security policies and procedures, security service requirements and risk mitigation strategies to the Nominating and Corporate Governance Committee.


text: There have not been any breaches at the Manager or the Fund during the year ended June 30, 2025. However, even though we take steps to employ reasonable cybersecurity efforts, not every cybersecurity incident can be prevented or detected. Therefore, while we believe there are currently no risks from any potential cybersecurity threat or cybersecurity incident that are reasonably likely to have a material effect on our results of operations or financial condition, the likelihood or severity of such risks are difficult to predict.

companyName: Grayscale CoinDesk Crypto 5 ETF

ticker: GDLC


text: Risk Management and Strategy Our cybersecurity risk management program is intended to protect the confidentiality, integrity and availability of our critical systems and information. Our program includes processes for identifying, assessing and managing material risks from cybersecurity threats that are guided by the National Institute of Standards & Technology's Cyber Security Framework, the ISO 27001 international standard for information security and other applicable industry benchmarks.

companyName: Broadcom Inc.

ticker: AVGO


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management system and processes, and includes: • a team of professionals within our Global Technology Organization team who are responsible for identifying and mitigating cybersecurity risks and managing our security controls and response activities; • risk assessment processes designed to identify cybersecurity risks to our critical systems, information, products, services and our broader enterprise IT environment; • an annual tabletop exercise to simulate a response to a cybersecurity incident; and • mandatory training annually and upon hiring for all employees on data privacy and cybersecurity topics.


text: When appropriate, we utilize independent, external service providers to assess, test or otherwise assist with certain aspects of our cybersecurity risk management program and related processes, including for penetration testing, threat monitoring and incident response. We also employ a vendor risk assessment process to mitigate risks presented by certain third-party service providers, and we require such providers to manage their cybersecurity risks in conformance to industry standards, notify us of relevant cybersecurity events and satisfy additional contractual requirements.


text: As of the date of this Annual Report on Form 10-K, we are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. See Item 1A. Risk Factors, "Cyber security threats or other security breaches, or any other impairment of the confidentiality, integrity or availability of our IT systems, or those of one or more of our corporate infrastructure vendors, could have a material adverse effect on our business" in this Annual Report on Form 10-K for additional information about our cybersecurity-related risks.


text: Cybersecurity Governance Our Board of Directors is actively involved in overseeing our cybersecurity risk management and shares oversight responsibility and processes with the Audit Committee of the Board of Directors (the "Audit Committee").


text: Our management, including our Chief Information Officer ("CIO"), in consultation with our Chief Information Security Officer ("CISO"), reviews with the Audit Committee at least quarterly our cybersecurity security policies, practices and protective measures, threat intelligence, cybersecurity incidents and related risks. At least quarterly, our CIO also provides the Audit Committee with an update on our enterprise security program that includes procedures and policies for testing vulnerabilities, responding to cybersecurity threats, and training and evaluating our employees. The Audit Committee and management also update our Board of Directors at least quarterly on our cybersecurity performance and risk profile and the effectiveness of our cybersecurity processes.


text: Our management, including our CIO and CISO, are responsible for assessing and managing material risks from cybersecurity threats. Our CIO oversees our Global Technology Organization that has primary responsibility for our overall cybersecurity risk management program. Our CIO, who reports to our Chief Executive Officer, has over 20 years of experience managing global IT operations, including strategy, applications, infrastructure, information security, support and execution. Our CISO, who reports to the CIO, has approximately 30 years of cybersecurity experience assessing and managing cybersecurity programs.


text: Our management is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents through various means, which may include, among other things, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in our IT environment.


text: Risk Management and Strategy Our cybersecurity risk management program is intended to protect the confidentiality, integrity and availability of our critical systems and information. At any given time, we face cybersecurity risks and threats, some of which are not fully mitigated, and we routinely address newly discovered vulnerabilities. We continuously work to enhance our information security program and risk management efforts. Our program includes processes for identifying, assessing and managing material risks from cybersecurity threats that are guided by the National Institute of Standards & Technology's Cybersecurity Framework, the ISO 27001 international standard for information security and other applicable industry benchmarks.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management system and processes, and includes: • a team of professionals within our Global Technology Organization who are responsible for identifying and mitigating cybersecurity risks and managing our security controls and response activities; • risk assessment processes designed to identify cybersecurity risks to our critical systems, information, products, services and our broader enterprise IT environment; • an annual tabletop exercise to simulate a response to a cybersecurity incident; and • mandatory training annually and upon hiring for all employees and contractors on data privacy and cybersecurity topics.


text: As of the date of this Annual Report on Form 10-K, we are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents. For additional information about our cybersecurity-related risks, see Item 1A. Risk Factors in this Annual Report on Form 10-K.


text: Our management, including our Chief Information Officer ("CIO"), in consultation with our Chief Information Security Officer ("CISO"), reviews with the Audit Committee quarterly, or more frequently as determined to be necessary or advisable, regarding our cybersecurity security policies, practices and protective measures, threat intelligence, cybersecurity incidents and related risks. At least quarterly, our CIO also provides the Audit Committee with an update on our enterprise security program that includes procedures and policies for testing vulnerabilities, responding to cybersecurity threats, and training and evaluating our employees. The Audit Committee and management also update our Board of Directors at least quarterly on our cybersecurity performance and risk profile and the effectiveness of our cybersecurity processes. We also have protocols in place for escalating certain cybersecurity incidents to the Audit Committee and the Board of Directors.


text: Risk management and strategy Our information security function is led by our Executive Director of Global IT Operations ("Head of IT"), whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes.

companyName: Autolus Therapeutics plc

ticker: AUTL


text: The information security function identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods including, for example, manual tools and automated tools, conducting scans of the threat environment, evaluating our and our industry's risk profile, evaluating threats reported to us, internal and external audits, leveraging third party threat assessments, and conducting vulnerabilities assessments. In addition, our employees and contractors receive periodic training under our IT security policies, including simulated intrusion attempts, and are required to certify compliance with our cybersecurity practices.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example cybersecurity consultants, cybersecurity service providers, and penetration testing services. The results of those assessments and reviews are reported to senior management and the board of directors, including the Audit Committee, by the Head of IT, as appropriate.


text: In addition, updates on our cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape may also be reported to senior management and the board of directors, including the Audit Committee, by the Head of IT, as appropriate. Our senior management team and board of directors include several members with operational experience overseeing IT operations, including risk assessment and implementation of security measures. As of the date of this report, we are not aware of any material risks from cybersecurity threats, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition.


text: We use third-party service providers to perform a variety of functions throughout our business, such as CROs, contract manufacturing organizations, and other distributors, including those who process clinical trial data on our behalf. Depending on the nature of the services provided, the sensitivity of the critical systems, information and assets at issue, and the identity of the provider, our third-party risk management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider, including, for example, a review of security assessments and imposition of contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report, including "If our information technology systems or data, or those of third parties upon which we rely, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; and other adverse consequences."


text: Management is responsible for identifying and assessing cybersecurity risks on an ongoing basis, establishing processes designed to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation and remediation measures, and maintaining cybersecurity programs. Our cybersecurity programs are managed under the direction of our Head of IT and monitors the prevention, detection, mitigation, and remediation of cybersecurity risks. Management regularly updates the board of directors on the Company's cybersecurity programs, material cybersecurity risks and mitigation strategies and provides regular cybersecurity updates.


text: Risk management and strategy Our information security function is led by our Chief Information Officer, whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes.


text: The information security function identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods including, for example, manual tools and automated tools, conducting scans of the threat environment, evaluating our and our industry's risk profile, evaluating threats reported to us, internal and external audits, leveraging third party threat assessments, and conducting vulnerabilities assessments. In addition, our employees and contractors receive periodic training under our IT security policies, including simulated intrusion attempts, and are required to certify compliance with our cybersecurity practices. In February 2025, we obtained ISO 27001 certification for our information security management systems.


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report, including "If our information technology systems or data, or those of third parties with whom we work, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; and other adverse consequences."


text: Our board of directors has overall oversight responsibility for our risk management and has charged our Audit Committee with oversight of our cybersecurity risk management program. The board and Audit Committee are responsible for ensuring that management has policies and processes in place designed to identify, monitor, assess and respond to cybersecurity, data privacy and other information technology risks to which the Company is exposed and implement processes and programs to manage cybersecurity risks and mitigate cybersecurity threats and incidents.


text: Risk Management and Strategy Cybersecurity is one of the cornerstones of our strategic business plan and the driving force behind our digital transformation journey. As a financial institution, we confront a spectrum of cyber threats, ranging from common attacks like ransomware to sophisticated, organized assaults by nation-state actors. These risks extend to our customers, shareholders, suppliers, and partners, emphasizing the critical need for a robust cybersecurity stance. In light of these challenges, maintaining resilience in our cybersecurity posture is not just a priority but a fundamental necessity to safeguard our operations, performance, and maintaining customer confidence in our banking services.

companyName: BayCom Corp

ticker: BCML


text: The Board of Directors oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk appetite with our strategic objectives. Our enterprise risk management program is designed to identify, measure, monitor and control all significant risks across various aspects of the Company. Cybersecurity risk management processes are integrated into this program, given the increasing reliance on technology and potential of cyber threats. Our Director of Information Technology leads our cybersecurity program, reporting directly to the Chief Operating Officer ("COO") and provides reports and updates to the Audit Committee, the Enterprise Risk Committee and the Chief Risk Officer ("CRO") quarterly or more frequently as required.


text: Our objective for managing cybersecurity risk is to maintain appropriate layers of safeguards to protect information systems from possible threats and to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse our systems or information. Our Information Security Program aligns with industry frameworks, such as the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, Federal Financial Institutions Examination Council (FFIEC) Information Technology Examination Handbooks, and the FFIEC Cybersecurity Assessment Tool, and is periodically reviewed and updated at least annually or more frequently upon significant changes to our operating environment. Our Information Security Program is led by our Information Security Officer in conjunction with our Director of Information Technology.


text: We maintain an Incident Response Plan ("IRP") that provides a documented framework for responding to actual or potential cybersecurity incidents. The IRP is coordinated through the Director of Information Technology, COO, CRO, and key members of management and addresses roles, responsibilities, and communication and contract strategies in the event of a compromise, including analysis of reportable events in accordance with applicable legal and compliance requirements.


text: We rely on a series of processes to identify threats, hazards, and other risks to our information assets. We employ a variety of preventative and detective tools from our Managed Security Services provider designed to monitor, detect, block, and provide alerts regarding suspicious and unauthorized activity and to report on suspected advanced persistent threats. In addition to regular risk assessments, we rely on independent assessments, audits, and cybersecurity feeds from vendors, including directly into patch and vulnerability management tools. We engage cybersecurity experts and third-party specialists to perform regular assessments of our infrastructure, software systems and network architecture. We also leverage internal and external auditors and independent external partners to periodically review our processes, systems, and controls, including with respect to our information security program, to assess their design and operating effectiveness. We have regular and ongoing security education and training for employees and recovery and resilience tests. The Bank also retains third-party experts to conduct intrusion and penetration testing on an annual basis. All risk and security assessments results are shared with the Board of Directors.


text: Our assets are classified and protected based on the results of our risk assessment practices, which assess a variety of critical factors, including the type of data stored, system availability needs, confidentiality requirements, recovery time objectives, transactional processing, the number of users, and the volume and magnitude of transactions. Our Information Technology teams meet to ensure that risks are timely identified, patch and vulnerability requirements are monitored, and the necessary changes are implemented.


text: Our Information Technology Governance ensures alignment between the Bank's technological strategy and business goals. We strive for efficient utilization of IT resources while effectively managing IT risks within the Bank's risk appetite. Additionally, our robust Vendor Management Program ensures proper oversight during the onboarding of new products, projects, and third-party vendors.


text: State regulators have also been increasingly active in implementing cybersecurity standards and regulations. Recently, several states have adopted laws and/or regulations requiring certain financial institutions to implement cybersecurity programs and providing detailed requirements with respect to these programs, including data encryption requirements. Many such states have also recently implemented or modified their data breach notification and data privacy requirements. We expect this trend of state-level activity in those areas to continue, and we continue to monitor relevant legislative and regulatory developments.


text: In the ordinary course of business, we rely on electronic communications and information systems to conduct our operations to store and transmit sensitive data. We employ a layered, defensive approach that leverages people, processes, and technology to manage and maintain cybersecurity controls. We employ a variety of preventative and detective tools to monitor, block, and provide alerts regarding suspicious activity, as well as to report on any suspected advanced persistent threats. Notwithstanding the strength of our defensive measures, the threat from cyber-attacks is severe, attacks are sophisticated and increasing in volume, and attackers respond rapidly to changes in defensive measures. While to date we have not detected a significant compromise, significant data loss or any material financial losses related to cybersecurity attacks, our systems and those of our clients and third-party service providers are under constant threat and there can be no assurance that our cybersecurity risk management program will be fully effective in protecting the confidentiality, integrity and availability of our information systems and our solutions. Risks and exposures related to cybersecurity attacks are expected to remain high for the foreseeable future due to the rapidly evolving nature and sophistication of these threats, as well as due to the expanding use of Internet banking, mobile banking and other technology-based products and services by us and our clients. See Item 1A. Risk Factors for a further discussion of risks related to cybersecurity. See "Risks Related to Cybersecurity, Third Parties and Technology" under "Item 1A. Risk Factors" in this Form 10-K for a further discussion of risks related to cybersecurity.


text: Management and Board Oversight of Cybersecurity Risks Our Cybersecurity Program is managed by the Director of Information Technology who leads our Information Technology team responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. The Director of Information Technology provides periodic reports to the executive risk management committee and the board-level risk committees of the Company and the Bank and the Chief Executive Officer and other members of our senior management, as well as the cross-functional management team that oversees the information security and information technology programs. These reports address key cybersecurity topics, including the implementation and operation of preventative controls and the detection, mitigation, and remediation of cybersecurity incidents. The Chief Operating Officer, Chief Risk Officer, and board-level risk committees of the Bank provide comprehensive reports to the full Board of Directors regarding pertinent cybersecurity risk management topics.


text: Our Director of Information Technology has more than 20 years' experience in financial services, substantial relevant expertise and formal training in the areas of information security and cybersecurity risk management and is accountable for managing our enterprise information technology department and developing and implementing our cybersecurity and information security programs. These qualifications, certifications, and experience include a degree from the University of California, Santa Barbara with focus on Business Administration coursework, Certified Information Systems Security Professional from ISC2 Organization.


text: Risk Management and Strategy Cybersecurity is one of the cornerstones of our strategic business plan and the driving force behind our digital transformation journey. As a financial institution, we confront a spectrum of cyber threats, ranging from common attacks like ransomware to sophisticated, organized assaults by nation-state actors. These risks extend to our customers, shareholders, suppliers, and partners, emphasizing the critical need for a robust cybersecurity stance. In light of these challenges, maintaining resilience in our cybersecurity posture is not just a priority but a fundamental necessity to safeguard our operations, performance, and the maintenance of customer confidence in our banking services.


text: We rely on a series of processes to identify threats, hazards, and other risks to our information assets. We employ a variety of preventative and detective tools from our Managed Security Services provider designed to monitor, detect, block, and alert us to suspicious and unauthorized activity, including suspected advanced persistent threats. In addition to regular risk assessments, we rely on independent assessments, audits, and cybersecurity feeds from vendors, which integrate directly into our patch and vulnerability management tools.


text: We engage cybersecurity experts and third-party specialists to perform regular assessments of our infrastructure, software systems, and network architecture. We also leverage internal and external auditors and independent external partners to periodically review our processes, systems, and controls, including our information security program, to assess their design and operating effectiveness. We provide regular and ongoing security education and training for employees and conduct recovery and resilience tests.


text: The Company maintains a cyber insurance policy as part of its overall risk management strategy to mitigate financial losses in the event of a cybersecurity incident. The Bank also retains third-party experts to conduct intrusion and penetration testing on an annual basis. All risk and security assessment results are shared with the Board of Directors.


text: Identified Cybersecurity Risks Federal and state regulators have issued guidance requiring financial institutions to implement layered security controls, strengthen client authentication for online services, and address risks from compromised credentials. Institutions must also maintain business continuity plans to ensure timely recovery of operations and data following a cyber-attack. Failure to comply with these regulations may result in sanctions, including financial penalties.


text: State regulators have increasingly enacted cybersecurity laws, including requirements for cybersecurity programs, data encryption, and breach notification. Many states have recently updated their data privacy regulations, and we expect this trend to continue. We actively monitor legislative and regulatory developments to ensure compliance.


text: In the ordinary course of business, we rely on electronic communications and information systems to conduct operations and store and transmit sensitive data. We employ a layered cybersecurity approach, leveraging people, processes, and technology to monitor, detect, and mitigate threats. Our defenses include a variety of preventative and detective tools designed to block unauthorized activity and identify advanced persistent threats. Despite these measures, cyber-attacks are increasingly sophisticated and frequent, particularly in the financial services sector. While we have not experienced a material cybersecurity incident to date, a significant breach could result in financial losses, operational disruptions, reputational harm, regulatory scrutiny, or legal liability. In addition to securing our own systems, we rely on third-party service providers for various critical functions, including payment processing, cloud storage, and cybersecurity tools. Our systems, as well as those of our clients and third-party vendors, remain under constant threat, and vulnerabilities within these external providers could also pose risks to our operations.


text: Given the evolving nature of cyber threats and the expanding use of online banking and digital services, our risk exposure is expected to remain high. We continuously assess and monitor cybersecurity threats in real time, including risks associated with third-party providers, to enhance our security posture. However, there can be no assurance that our cybersecurity risk management program will fully protect the confidentiality, integrity, and availability of our information systems and solutions. See "Risks Related to Cybersecurity, Third Parties and Technology" under "Item 1A. Risk Factors" in this Form 10-K for further discussion of risks related to cybersecurity.


text: Management and Board Oversight of Cybersecurity Risks Our Cybersecurity Program is managed by our Director of Information Technology, who leads our Information Technology team responsible for implementing our enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. The Director of Information Technology provides periodic reports to the executive risk management committee, the board-level risk committees of the Company and the Bank and the Chief Executive Officer and other members of our senior management, as well as the cross-functional management team that oversees the information security and information technology programs. These reports address key cybersecurity topics, including the implementation and operation of preventative controls and the detection, mitigation, and remediation of cybersecurity incidents.


text: The Board receives formal cybersecurity updates at least quarterly from the Director of Information Technology, the Chief Operating Officer, and the Chief Risk Officer. These reports include updates on emerging threats, incident response activities, regulatory developments, and enhancements to cybersecurity frameworks. Additionally, the Board periodically conducts cybersecurity resilience reviews, including scenario planning and tabletop exercises, to evaluate preparedness for potential cyber incidents. The Chief Operating Officer, Chief Risk Officer, and board-level risk committees of the Bank also provide comprehensive reports to the full Board of Directors regarding pertinent cybersecurity risk management topics.


text: Our Director of Information Technology has more than 20 years' experience in financial services, substantial relevant expertise and formal training in the areas of information security and cybersecurity risk management and is accountable for managing our enterprise information technology department and developing and implementing our cybersecurity and information security programs. These qualifications, certifications, and experience include a degree from the University of California, Santa Barbara with a focus on business administration coursework and a Certified Information Systems Security Professional designation from ISC2 Organization.


text: We have undertaken, on an annual basis, to conduct an assessment of our cyber risk management processes and controls to identify, quantify, and categorize material cyber risks. In addition, we have developed a risk mitigation plan to address such risks, and where necessary, remediate potential vulnerabilities identified through the annual assessment process.

companyName: Forza X1, Inc.


text: Our management team is responsible for oversight and administration of our cyber risk management protocol, and for informing senior management and other relevant stakeholders regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our Audit Committee also provides oversight of risks from cybersecurity threats.


text: As part of its review of the adequacy of our system of internal controls over financial reporting and disclosure controls and procedures, the Audit Committee is specifically responsible for reviewing the adequacy of our computerized information system controls and security related thereof. The cybersecurity stakeholders, including member(s) of management assigned with cybersecurity oversight responsibility and/or third-party consultants providing cyber risk services, brief the Audit Committee on cyber vulnerabilities identified through the risk management process, the effectiveness of our cyber risk management program, and the emerging threat landscape and new cyber risks on at least an annual basis. This includes updates on Forza's processes to prevent, detect, and mitigate cybersecurity incidents. In addition, cybersecurity risks are reviewed by our Board of Directors at least annually, as part of the Company's corporate risk oversight processes.


text: We face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition, results of operations, cash flows or reputation. Forza acknowledges that the risk of cyber incidents is prevalent in the current threat landscape and that a future cyber incident may occur in the normal course of its business. To date, we have not had a cybersecurity incident. We proactively seek to detect and investigate unauthorized attempts and attacks against our IT assets, data, and services, and to prevent their occurrence and recurrence where practicable through changes or updates to internal processes and tools and changes or updates to service delivery; however, potential vulnerabilities to known or unknown threats will remain. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, investors, and additional stakeholders, which could subject us to additional liability and reputational harm. See Item 1A. "Risk Factors" for more information on cybersecurity risks.


text: We face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition, results of operations, cash flows or reputation. We acknowledge that the risk of cyber incidents is prevalent in the current threat landscape and that a future cyber incident may occur in the normal course of its business. To date, we have not had a cybersecurity incident. We proactively seek to detect and investigate unauthorized attempts and attacks against our IT assets, data, and services, and to prevent their occurrence and recurrence where practicable through changes or updates to internal processes and tools and changes or updates to service delivery; however, potential vulnerabilities to known or unknown threats will remain. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, investors, and additional stakeholders, which could subject us to additional liability and reputational harm. See Item 1A. "Risk Factors" for more information on cybersecurity risks.

companyName: Twin Vee PowerCats, Co.

ticker: VEEE


text: BioCrude utilizes the specialized services of an IT professional, to protect its internet-connected systems, such as hardware, software and data from unauthorized access to its data centers and other computerized systems. We deploy collective methods, technologies, and processes to help protect the confidentiality, integrity, and availability of computer systems, networks and data. Part and parcel of our cybersecurity is, continuously updating our licensed/purchased software, running up-to-date antivirus software, having firewalls (Secure for BioCrude's website provided by its website hosting agent, and Watchguard systems as a gatekeeper to the internet), as well as being prudent on continuously changing usernames and passwords and being cognizant and suspicious of unexpected emails (Phishing emails are currently one of the most prevalent risks to the average user).

companyName: BioCrude Technologies USA, Inc.


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the President who reports to our Chief Executive Officer, to manage the risk assessment and mitigation process.

companyName: SPLASH BEVERAGE GROUP, INC.

ticker: SBEV


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including the information technology team at the direction of our President. Our executive team including our Chief Executive Officer, and Chief Financial Officer are responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. This executive team is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Cybersecurity and Data Privacy Risks We are subject to cybersecurity and data privacy risks. Cyberattacks and security vulnerabilities could lead to increased costs, liability claims, or harm to our competitive position.

companyName: Bannix Acquisition Corp.


text: Cybersecurity Risks Our operations and the operations of our and partners involve the storage, transmission, and processing of third parties' and our data, including personal, confidential, or proprietary information. This data is subject to privacy and security laws, regulations, and customer-imposed controls. Cybercriminals use a variety of methods to exploit potential vulnerabilities in our systems, products, and services. Sophisticated attacks could result in unauthorized access, loss, misuse, disclosure, modification, or destruction of this data.


text: We are committed to protecting our third parties' and our data. Despite efforts, our systems, products, and services remain vulnerable to attacks.


text: Data privacy issues are becoming increasingly significant due to the rapidly changing legal and regulatory landscape. Compliance with global and local data privacy laws requires ongoing investment in our information technology and employee training, and will continue to impact our business.


text: Governance and Oversight We should have a formal risk management program that addresses cybersecurity and data privacy risks. This program should include regular reporting to our senior management and Board of Directors, who provide oversight and direction. We have not established an enterprise risk management framework to assess and prioritize these risks.


text: Incident Response We maintain an incident response plan that includes policies and procedures for notifying affected third parties and complying with applicable laws.


text: Investments in Cybersecurity We will continually invest in our cybersecurity capabilities to protect our assets and those of our third parties. This potentially will include investment in advanced threat detection, encryption, and other security measures. Recent Cybersecurity Incidents During the last fiscal year, we did not experienced cybersecurity incidents.


text: At this time, the Company does not have formal processes in place for assessing, identifying, and managing material risks from cybersecurity threats. Our approach to cybersecurity is currently informal and primarily reactive, involving basic security measures such as: Basic Security Software: We use standard antivirus and anti-malware software for protection against common threats. Policies: Simple password policies are in place to protect access to our systems.

companyName: Global Innovative Platforms Inc.

ticker: GIPL


text: However, we recognize the importance of cybersecurity and are in the process of developing more robust strategies. We plan to: Develop a Cybersecurity Framework: Establish a formal risk assessment process to identify vulnerabilities. Cybersecurity Expertise: Consider hiring or consulting with cybersecurity professionals to guide our strategy. Training: Begin employee training on cybersecurity awareness to prevent common threats like phishing.


text: Oversight: Currently, our sole director does not have a formal structure for overseeing cybersecurity risks. We plan to review this oversight in the near future to ensure appropriate governance is established.


text: Role: Day-to-day management of cybersecurity is handled by our IT staff, who do not have specialized training in cybersecurity. We are considering enhancing this role or outsourcing to professionals with specific cybersecurity expertise.


text: Our current management and Board do not have in-depth cybersecurity expertise. We are considering educational opportunities or consulting to address this gap.


text: from Cybersecurity Threats To date, no known cybersecurity incidents have materially affected our business strategy, results of operations, or financial condition. However, due to our limited cybersecurity measures, we acknowledge that our company could be at higher risk of material impact from cybersecurity threats. We are actively working to mitigate these risks.


text: Cybersecurity Risk Management and Strategy Our company recognizes the critical importance of cybersecurity in our digital operations and has established a risk management program to address both internal and external cybersecurity threats. We acknowledge the challenges posed by the evolving nature of cyber threats and the limitations in fully mitigating these risks.

companyName: Kaival Brands Innovations Group, Inc.

ticker: KAVL


text: We have not observed any significant impacts from known cybersecurity threats or previous incidents on our operational, strategic, or financial aspects. Nevertheless, given the unpredictable nature of cyber threats, we cannot assure complete immunity against potential future impacts.


text: Criteria used to determine the materiality of an incident includes, but is not limited to, evaluating the scope, nature, type, systems, data, operational impact, and pervasiveness of the incident.


text: This approach involves continuous oversight and improvement based on evolving cyber threats. Materiality also considers both quantitative and qualitative factors in determining impact.


text: Cybersecurity Governance Our Board of Directors plays a pivotal role in overseeing the organization's preparedness for cyber threats. This involves a comprehensive understanding of our risk profile and ensuring appropriate cybersecurity controls are in place.


text: W e do not maintain any information systems that would be subject to a cybersecurity threat. Our credit card processing is outsourced to a third party that uses a double authentication protocol.

companyName: INNOVATIVE DESIGNS INC

ticker: IVDN


text: Risk Management and Strategy We are a pre-clinical-stage biopharmaceutical company, focused on developing novel and proprietary drug delivery systems across various pain indications and treatments for CNS disorders. We have conducted a cyber security risk assessment performed by a third-party consultant and are in the process of developing a formal cybersecurity risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. The risk assessment was performed against the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF") standards.

companyName: Virpax Pharmaceuticals, Inc.

ticker: VRPX


text: we are not aware of any cybersecurity threats, and have not experienced any cybersecurity incidents, that have materially affected us, including our business strategy, results of operations or financial condition.


text: Management is responsible for the day-to-day management of the risks we face, while our Board of Directors has responsibility for the oversight of risk management, including as to risks from cybersecurity threats. In its risk oversight role, our Board of Directors has the responsibility to satisfy itself that the risk management processes designed and implemented by management are appropriate and functioning as designed. The Board of Directors has delegated to the Audit Committee of the Board of Directors the responsibility for the oversight of information technology, including cybersecurity risks. Member(s) of management assigned with cybersecurity oversight responsibility and/or third-party consultants providing cyber risk services brief the Audit Committee on cyber vulnerabilities identified through the risk management process, emerging threat landscape and new cyber risks, and provide updates on our processes to prevent, detect, and mitigate cybersecurity incidents.


text: The underlying processes and controls of our cyber risk management protocol incorporate recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF"). We have undertaken an assessment of our networking risk management processes and controls to identify, quantify, and categorize material risks. In addition, we have developed a risk mitigation plan to address such risks, and where necessary, remediate potential vulnerabilities identified through the annual assessment process.


text: As part of its review of the adequacy of our system of internal controls over financial reporting and disclosure controls and procedures, the Audit Committee is specifically responsible for reviewing the adequacy of our computerized information system controls and security related thereof. The cybersecurity stakeholders, including member(s) of management assigned with cybersecurity oversight responsibility and/or third-party consultants providing cyber risk services, brief the Audit Committee on cyber vulnerabilities identified through the risk management process, the effectiveness of our cyber risk management program, and the emerging threat landscape and new cyber risks on at least an annual basis. In addition, cybersecurity risks are reviewed by our Board of Directors at least annually, as part of the Company's corporate risk oversight processes.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including the information technology team at the direction of our President.


text: Our executive team including our Chief Executive Officer, and Chief Financial Officer are responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. This executive team is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Risk Management and Strategy Our Cybersecurity Risk Management Strategy includes a myriad of tools and resources that are designed to ensure the integrity of our information systems. We place particular emphasis on protecting the privacy of our patient data pursuant to the HIPAA Security Rule. Our cybersecurity risk management process is integrated with our larger risk management system and is considered a core function of our overall risk management strategy.

companyName: FONAR CORP

ticker: FONR


text: Our strategy is based around identification, mitigation, avoidance and response to material cybersecurity risks. We employ physical and electronic safeguards to control access to our systems. We employ additional electronic safeguards to control/limit access to the data contained in those systems. We review and re-assess these processes on a rolling basis with the assistance of both internal staff and outside vendors, including assessors, consultants, auditors, and other third parties. Some steps we take include the use of standard security protocols such as password maintenance, multi-factor identification, and penetration testing. We take other steps as may be situationally appropriate for the specific risk presented.


text: For the fiscal year ended June 30, 2025, management has identified a material weakness in our internal controls over our information technology systems, as described in greater detail in Item 9A. In response, we have taken several steps to enhance our cybersecurity efforts. Those steps include increasing the scope of our Multi-Factor Authentication requirement to include additional tertiary information systems, improving password security, upgrading our anti-virus software, upgrading our threat detection tools, implementing additional threat detection tools, and replacing and/or decommissioning hardware that has known vulnerabilities.


text: Our Information Technology department works collaboratively with our third-party vendors to coordinate a mutually beneficial approach to cybersecurity in the specific context in which risk is presented. These collaborations sometimes take place on a rolling basis, and sometimes take place on a semi-annual or annual basis.


text: Cybersecurity threats, including previous cybersecurity incidents, have not materially affected our results of operations or financial condition. However, cybersecurity threats have the potential to significantly impair our operations and the operations of the various third parties upon whom we rely.


text: Our General Counsel oversees and manages our cybersecurity program. Our General Counsel acts as the coordinator of our cybersecurity team, which includes representatives from our Information Technology department and Compliance department. In addition, he regularly interacts with various department heads from both our New York and Florida regions regarding the prevention, detection, mitigation and remediation of cybersecurity risks. Our General Counsel has an educational background in computer science and has relevant work experience in cybersecurity insurance and risk management.


text: Our cybersecurity risks are identified and addressed through a comprehensive, cross-functional approach. Key security, risk, and compliance stakeholders, including a member of the Board meet at least monthly to develop strategies for preserving the confidentiality, integrity and availability of our company and customer information, identifying, preventing and mitigating cybersecurity threats, and effectively responding to cybersecurity incidents. We maintain controls and procedures that are designed to ensure prompt escalation of certain cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can be made by management and the Board in a timely manner.

companyName: VisionWave Holdings, Inc.

ticker: VWAV


text: External Assessments Our cybersecurity policies, standards, processes and practices are regularly assessed by consultants and external independent auditors. These assessments include a variety of activities including information security assessments, audits and independent reviews of our ISMS, control environment and operating effectiveness. For example, in 2023 and 2024, we conducted independent audits to assess our ISMS against the ISO/IEC 27001:2013 standard and received certification of compliance with the standard. We also undertake regular penetration testing of our systems. The results of significant assessments are reported to management and the Board. Cybersecurity processes are adjusted based on the information provided from these assessments.


text: We have also obtained industry certifications and attestations that demonstrate our dedication to protecting the data our customers entrust to us.


text: Our Board oversees our management of cybersecurity risk. They receive regular reports from management about the prevention, detection, mitigation, and remediation of cybersecurity incidents, including material security risks and information security vulnerabilities. Our Security Committee directly oversees our cybersecurity program. The Board receives periodic updates from management on cybersecurity risk resulting from risk assessments, progress of risk reduction initiatives, external auditor feedback, control maturity assessments, and relevant internal and industry cybersecurity incidents.


text: Management's Role Our Chief Technology Officer ("CTO") and Chief Operating Officer ("COO") have primary responsibility for assessing and managing material cybersecurity risks. Our CTO and COO are both seasoned computer scientists and technology entrepreneurs with over 25 years of experience.


text: During the year ended June 30, 2025, we did not identify any cybersecurity threats at the Sponsor or the Trust that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, even though we take steps to employ reasonable cybersecurity efforts, not every cybersecurity incident can be prevented or detected. Therefore, while we believe there are currently no risks from any potential cybersecurity threat or cybersecurity incident that are reasonably likely to have a material effect on our results of operations or financial condition, the likelihood or severity of such risks are difficult to predict.

companyName: Grayscale Litecoin Trust (LTC)

ticker: LTCN


text: Processes of Addressing Cybersecurity Threats Cybersecurity is critical to our business. As an energy infrastructure company, we face a variety of cybersecurity threats that range from attacks common to most industries, such as ransomware and denial-of-service, to attacks from more advanced and persistent, highly organized adversaries, including nation state actors, that target critical infrastructure sectors. We recognize the critical importance of maintaining the safety and security of our systems and data and have a holistic process for overseeing and managing cybersecurity and related risks. The process is supported by management and overseen by our board of directors.

companyName: Northwest Natural Holding Co

ticker: NWN


text: One of the tools used by management and our Board of Directors in managing business risks is an annual enterprise risk management (ERM) assessment to identify and manage key existing and emerging risks our company faces. Our ERM process is designed to identify significant risks relevant to the company and assess the characteristics and circumstances of the risks to identify both the potential impacts to our company of a particular risk and the velocity with which the risk may manifest. Cybersecurity is among the risks identified in our ERM assessment and has been embedded in the Company's operating procedures, internal controls and information systems. In addition to our overall ERM process, we have developed and implemented a cybersecurity risk management program and processes intended to detect, assess, manage, and develop resiliency against material risks from cybersecurity threats. Our cybersecurity program utilizes a risk-based approach and includes written cybersecurity and information technology processes and procedures, including a cybersecurity incident response plan that involves procedures for responding to cybersecurity incidents. We design and assess our program informed by various cybersecurity frameworks, such as the National Institute of Standards and Technology (NIST) and leverage a widely-adopted risk assessment model to identify, measure and prioritize cybersecurity and technology risks. The goal of our program is to prevent, identify, escalate, investigate, resolve and recover from identified incidents and security incidents in a timely manner.


text: Our cybersecurity program also incorporates intelligence sharing capabilities about emerging threats within the utility industry and other industries through collaboration with peer companies and specialized consultants and advisors, public-private partnerships with government intelligence agencies, including the FBI, CISA, and the Department of Energy Office of Cybersecurity, Energy Security and Emergency Response, and geopolitical briefings. We also leverage third-party benchmarking, the results from regular internal and third-party audits, technology partner resources, threat intelligence feeds, and other similar resources to inform our cybersecurity processes and allocate resources.


text: Beginning in May 2021, the Department of Homeland Security's (DHS) Transportation Security Administration (TSA) released two directives, with several updates, applicable to certain owners and operators of pipeline facilities, including NW Natural. These directives cumulatively required owners and operators to implement cybersecurity incident reporting to the DHS, designate two cybersecurity coordinators, and perform a gap assessment of current entity cybersecurity practices against certain voluntary TSA security guidelines and report relevant results and proposed mitigation to applicable DHS agencies; implement a significant number of specified cyber security controls and processes; and clarifying Operational Technology (OT) scope and providing a risk- and outcome-based framework. We made significant additional and accelerated investments in cybersecurity in response to the TSA directives.


text: Our cybersecurity program has several fundamental tenants, including security governance, cybersecurity risk management, compliance, defensibility, zero-trust architecture and cloud security. We utilize multilayered defenses and continuous monitoring with data analytics to detect anomalies and search for cyber threats in our system.


text: Key components of our cybersecurity risk management program include: • risk assessments designed to help identify cybersecurity risks to our critical systems, information, services, and our broader technology environment; • the use of external service providers with specific expertise, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, incident response personnel and senior management, as well as periodic experiential learning through "phishing simulations"; • segmentation of, and back-ups for, certain of our sensitive systems and data; • third-party cyber risk management process for vendors including, among other things, a security assessment, contracting program, and ongoing monitoring for vendors based on their risk profile; • physical security around our sensitive infrastructure and cybersystems.


text: In accordance with our program and processes, we regularly assess risks from cybersecurity and technology threats and monitor our information systems for potential vulnerabilities. We conduct regular reviews and tests of our information security program and also utilize audits by our internal audit team and third-party consultants, table-top exercises, penetration and vulnerability testing, data recovery testing, simulations, and other exercises to evaluate the effectiveness of our information security program and improve our security measures and planning. We are continuously working to evolve our oversight processes to mature how we identify and manage cybersecurity risks, and we perform periodic maturity assessments to measure our progress.


text: As a regulated energy infrastructure company, for decades we have used an incident command system (ICS) as a standardized approach to the command, control and coordination of a variety of emergency situations. In the event of emergencies, including cybersecurity events, we stand up an Incident Command Team to respond to the emergency. We exercise and train the ICT for a variety of emergencies, including, cyber events on a regular basis.


text: At this time, we have not identified any risks from known previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition. With a majority of our business in energy and infrastructure, we face sophisticated and rapidly evolving attempts to overcome our security measures and protections. The occurrence of both intentional and unintentional incidents could occur in the future. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See Item 1A, "Risk Factors" above for additional information on risks related to our business, including for example risks related to cyber attacks, information and system breaches, and technology disruptions and failures, our reliance on technology.


text: The Audit Committee receives regular reports from management on our cybersecurity risks. Additionally, management updates the Audit Committee as necessary, regarding any cybersecurity incidents. The Audit Committee reports to the full Board regarding the Audit Committee's areas of oversight, including those related to cybersecurity. The full Board also receives briefings from management on our cybersecurity risk management program periodically. Additionally, our Board receives presentations on cybersecurity topics from our IT management team or external experts as part of the Board's ongoing education.


text: Our management team, including our Cybersecurity management team, has primary responsibility for our overall cybersecurity risk management program, and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Cybersecurity management team has been led, since 2017, by our Vice President, Chief Information Officer, who also functions as our Chief Information Security Officer and reports to our CEO. Mr. Downing has an extensive career of 29 years in information technology services in the energy sector, including at WorleyParsons, British Petroleum and Schlumberger. He holds a degree in Information Systems as well as a Masters of Business Administration.