text: Oversee Third-party Risk Because we are aware of the risks associated with third-party service providers, the Company implements stringent processes to oversee and manage these risks. We conduct thorough security assessments of all third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. The monitoring includes quarterly assessments by our Vice President of Technology and Deployment (the "VP of Technology") and on an ongoing basis by our security engineers. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third parties. Risks from Cybersecurity Threats We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing.


text: The Board is acutely aware of the critical nature of managing risks associated with cybersecurity threats. The Board has established oversight mechanisms to ensure effective governance in managing risks associated with cybersecurity threats because we recognize the significance of these threats to our operational integrity and stakeholder confidence. The Board is briefed on a periodic basis as to the nature of actions taken to mitigate risks from cyberattacks.

companyName: Castellum, Inc.

ticker: CTM

secItem: Item 1C


text: Management's Role Managing Risk The VP of Technology and Deployment and the CEO play a pivotal role in informing the Audit Committee on cybersecurity risks. They provide comprehensive briefings to the Audit Committee on a semi-annual basis, with a minimum frequency of once per year. These briefings encompass a broad range of topics, including: Current cybersecurity landscape and emerging threats; Status of ongoing cybersecurity initiatives and strategies; Incident reports and learnings from any cybersecurity events; and Compliance with regulatory requirements and industry standards.


text: Oversee Third-party Risk Because we are aware of the risks associated with third-party service providers, the Company implements stringent processes to oversee and manage these risks. We conduct thorough security assessments of all third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. The monitoring includes quarterly assessments by our Cybersecurity Manager and on an ongoing basis by our security engineers. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third parties. Risks from Cybersecurity Threats We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing.


text: Management's Role Managing Risk The COO and the CEO play a pivotal role in informing the Audit Committee on cybersecurity risks. The COO was Castellum's Vice President of Technology and Deployment before becoming COO in September of 2024, and is a certified CMMC Professional. They provide comprehensive briefings to the Audit Committee on an at least an annual basis. These briefings encompass a broad range of topics, including: Current cybersecurity landscape and emerging threats; Status of ongoing cybersecurity initiatives and strategies; Incident reports and learnings from any cybersecurity events; and Compliance with regulatory requirements and industry standards.


text: Cybersecurity Risk Management and Strategy Recognizing the ever-evolving nature of cybersecurity threats, we have established a cybersecurity risk management program designed to safeguard the confidentiality, integrity, and availability of our critical systems and data. This program integrates into our overall enterprise risk management framework and draws guidance from industry standards and best practices, including the National Institute of Standards and Technology Framework. aIdentification and assessment of cybersecurity risks that could impact our operations, facilities, third-party vendors, critical systems, and information. bUtilizing threat intelligence and historical adversarial activity to inform risk assessments and readiness evaluations. aImplementing administrative, physical, and technical controls designed to protect data and systems, as established in our Cyber Security policy.

companyName: IREN Ltd

ticker: IREN


text: b Leveraging external service providers, including assessors, consultants, auditors, and other third parties, to assess, test, monitor, and respond to cybersecurity threats in an attempt to maintain robust security controls. aEstablishing processes to oversee and identify cybersecurity risks associated with third-party service providers.


text: bEvaluating third-party vendors for compliance with our cybersecurity standards and requiring them to maintain appropriate security controls to protect our data. aMaintaining a cybersecurity incident response plan that outlines procedures for responding to and managing cybersecurity incidents.


text: bConducting regular cybersecurity awareness training for all employees, contractors, interns, and any user with access to Company systems to increase the preparedness and awareness of risks and procedures.


text: aRegularly updating and improving our cybersecurity practices and policies based on changing business practices, emerging threats, new technologies, and evolving industry standards. bConducting ongoing penetration testing and benchmarking against industry practices to enhance our security posture.


text: Cybersecurity Incidents: In our fiscal year ended June 30, 2025, we did not identify any cybersecurity incidents that have materially affected our business strategy, operations, or financial condition. We continue to monitor and seek to manage these risks proactively to protect the ongoing security and resilience of our organization. A cybersecurity incident could result in (i) an interruption in our services, (ii) the loss of ability to control or operate our equipment, (iii) misappropriation of personal data and (iv) the loss of critical data that could interrupt our operations, any of which could, among other things, adversely impact our reputation and brand and expose us to increased risks of violation of applicable law, governmental and regulatory investigation and enforcement actions, or private litigation or other liability, including potentially significant financial losses.


text: Cybersecurity Governance Our cybersecurity governance structure is designed to achieve effective oversight and management of cybersecurity risks across the organization.


text: a The Board holds ultimate oversight responsibility for our cybersecurity risk management program. It receives regular updates from management on cybersecurity risks, incidents, and the overall effectiveness of the program.


text: b The Board's Audit and Risk Committee is specifically tasked with overseeing cybersecurity and information technology risks, so that risk management strategies align with the company's overall risk profile.


text: a Day-to-day responsibility for managing cybersecurity risks lies with our Chief Technology Officer (CTO) who leads a dedicated cybersecurity team. This team includes internal and external security professionals with expertise in cybersecurity management.


text: a Our Incident Response Team, led by our CTO, coordinates the Company's response to cybersecurity incidents. This team includes representatives from IT, legal, investor relations, risk & compliance, and other relevant departments (as required).


text: b The Incident Management Plan - Technology and Data, developed by our cybersecurity team, follows a structured process for escalating, assessing and categorizing cybersecurity incidents, and IREN's response process, including remediation and post-incident activities. This is designed to be a systematic and coordinated approach to managing cybersecurity incidents.


text: a Our CTO has over 15 years of experience in cybersecurity management, and has a background in security and information technology solutions.


text: bMembers of the Cybersecurity team possess a diverse range of expertise, including prior work experience in cybersecurity, and specialized knowledge and skills in cybersecurity.


text: a Management regularly informs and updates the Board and the Audit and Risk Committee on cybersecurity risks, incidents, and the effectiveness of risk management strategies.


text: b Management provides frequent informal communications to the Board between regularly scheduled meetings to keep the Board apprised of any emerging risks or incidents.


text: For further details on the cybersecurity risks we face, refer to Part I, Item 1.A. "Risk Factors" of this Annual Report on Form 10-K.


text: Governance. The Board of Directors has formally tasked the Audit Committee with oversight responsibility to review cybersecurity and data privacy risks. The Audit Committee receives regular reports from management about cybersecurity matters. In addition to regular reporting, we have procedures by which potential cybersecurity incidents are reported in a timely manner to the Chief Technology Officer, who then notifies the Chief Operating Officer and General Counsel of cybersecurity incidents and they collectively determine if a specific incident warrants escalation to the Audit Committee and the Board of Directors. Our CTO, who has more than 25 years of information security and cybersecurity experience, manages cybersecurity at the corporate segment and oversees a team of dedicated cybersecurity personnel employed in our real estate brokerage segment. Our governance procedures are generally designed to identify, assess, mitigate, prevent and, where required, respond to cybersecurity security incidents and threats in a timely manner to minimize the loss or compromise of information and assets and to facilitate incident resolution.

companyName: Douglas Elliman Inc.

ticker: DOUG


text: Cybersecurity incident identification and response. We use several processes and procedures to protect our data, systems and employees from cyber incidents, to reduce our overall cybersecurity risk profile, and to identify and respond to cybersecurity incidents in a timely manner. These processes and procedures leverage a variety of tools, including a security incident and event manager interface that uses behavioral analytics and provides live metrics and reports of attempted breaches and logs of firewalls, authentication attempts, emails, anti-malware, attempted intrusions and applications. We also conduct periodic tests to assess our processes and procedures and the threat landscape, which include, among other things, the engagement of third-party experts for external and internal penetration testing and system security assessments.


text: We have adopted an incident response plan that applies upon the occurrence of a cybersecurity incident involving a breach of our own information technology systems and applications. Pursuant to this response plan, if an incident occurs, a multi-disciplinary team is assembled that includes our CTO and General Counsel and, if appropriate, our COO and CFO, which in turn may leverage the expertise of third-party consultants, external legal counsel and other resources. The plan includes procedures designed to facilitate containment of, and responses to, a cybersecurity incident, which are based on the type of incident, the location of the incident and the breadth of the incident. The plan also establishes procedures for notifying any impacted parties, including our customers, law enforcement and regulatory authorities, third-party vendors and insurance providers. Our CTO will provide periodic updates to the Audit Committee and, when appropriate, the Board of Directors during this process.


text: Processes to identify material risks associated with the use of third-party service providers. In addition to internal resources, we utilize third-party service providers to supplement and maintain our information technology systems. We have procedures to oversee and identify cybersecurity risks associated with our use of these third-party service providers, including procedures that apply if a cybersecurity incident occurs at a third-party service provider that results in our systems or data or our customers' data being compromised. These processes and procedures include, among others, a diligence review conducted by our information technology team of substantially all of our external business partners and a focused review of any such third parties' cybersecurity audit attestations, such as Service Organization Controls, NIST 800 alignments, ISO certifications, PCI DSS compliance or other recognized external reviews. In the case of a cybersecurity incident affecting a third-party, these procedures also govern interactions with personnel of the impacted third-party to determine the date, scope and effects of the cybersecurity incident, review the response and remediation measures taken by the third-party and conduct an inventory of potentially compromised data. Our notification process for a cybersecurity incident affecting a third-party is the same as the notification process that applies to a cybersecurity incident that affects our own information technology systems and applications.


text: Cybersecurity risks and previous incidents. We and certain of our third-party service providers have experienced, and expect to continue to experience, internal and external cybersecurity threats and incidents, which can result, and have resulted, in the misappropriation and unavailability of critical data and confidential or proprietary information (our own and that of third parties, including personally identifiable information) and the disruption of business operations. However, we have not been subject to cybersecurity incidents that, individually or in aggregate, have been material to our operations or financial condition, but we cannot provide assurance that they will not have a material impact in the future. See Item 1A. Risk Factors.


text: Governance. The Board of Directors has formally tasked the Audit Committee with oversight responsibility to review cybersecurity and data privacy risks. The Audit Committee receives regular reports from management about cybersecurity matters. In addition to regular reporting, we have procedures by which potential cybersecurity incidents are reported in a timely manner to the Chief Technology Officer (CTO), who then notifies the Chief Executive Officer of cybersecurity incidents and they collectively determine if a specific incident warrants escalation to the Audit Committee and the Board of Directors. The acting CTO is our Executive Vice President, Chief Financial Officer, Treasurer, and Secretary, who took over responsibilities in October 2024 upon the departure of the Company's prior CTO. Our CTO manages cybersecurity at the corporate segment and oversees a team of dedicated cybersecurity personnel employed in our real estate brokerage segment, including a Chief Information Security Officer. Our governance procedures are generally designed to identify, assess, mitigate, prevent and, where required, respond to cybersecurity security incidents and threats in a timely manner to minimize the loss or compromise of information and assets and to facilitate incident resolution.


text: We have adopted an incident response plan that applies upon the occurrence of a cybersecurity incident involving a breach of our own information technology systems and applications. Pursuant to this response plan, if an incident occurs, a multi-disciplinary team is assembled that includes our CTO and the General Counsel of Douglas Elliman Realty LLC and, if appropriate, the CFO of Douglas Elliman Realty LLC, which in turn may leverage the expertise of third-party consultants, external legal counsel and other resources. The plan includes procedures designed to facilitate containment of, and responses to, a cybersecurity incident, which are based on the type of incident, the location of the incident and the breadth of the incident. The plan also establishes procedures for notifying any impacted parties, including our customers, law enforcement and regulatory authorities, third-party vendors and insurance providers. Our CTO will provide periodic updates to the Audit Committee and, when appropriate, the Board of Directors during this process.


text: Cybersecurity Risk Management and Strategy We have processes in place for assessing, identifying, and managing material risks from cybersecurity threats which have been integrated into the Company's overall risk management strategy and processes. The Company seeks to address cybersecurity risks through a comprehensive approach that is focused on implementing robust protective measures, promoting user awareness and education, continuously monitoring for potential threats, and swiftly responding to any security incidents to ensure the confidentiality, integrity, and availability of sensitive information.

companyName: Perimeter Solutions, Inc.

ticker: PRM


text: In addition, we actively engage with key vendors and industry communities as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures and have processes in place to oversee and identify the risk of cybersecurity threats associated with our use of these third-party vendors. We generally require third parties to, among other things, maintain security controls to protect our confidential information and data, and notify us of material cybersecurity threats that may impact our business.


text: In 2023, we did not identify any cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.


text: Our Board has oversight of our strategic and business risk management and has delegated the oversight of cybersecurity risk management to the Company's Audit Committee. The Company's Audit Committee is responsible for overseeing all matters relating to the security of and risks related to the Company's information technology systems and procedures, including its cybersecurity and other information technology risks. The Audit Committee is responsible for ensuring the Company has processes in place for assessing, identifying and managing material risks from cybersecurity threats.


text: The Company's information security program is managed by the Company's Chief Information Officer (the "CIO"), whose team is responsible for leading our enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. The CIO has extensive global experience in developing and executing information technology strategies. The CIO and the information security team, in collaboration with the Chief Financial Officer and the Audit Committee, monitor the prevention, detection, mitigation and remediation of cybersecurity incidents.


text: The CIO provides periodic reports to our Board, as well as our Chief Financial Officer and other members of our senior management as appropriate. These reports include updates on the Company's cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape.


text: Cybersecurity Risk Management and Strategy The Company proactively manages its cybersecurity and data privacy risks with organizational and technical controls including a comprehensive set of policies and procedures for assessing, identifying, and managing material risks from cybersecurity threats which have been integrated into the Company's overall risk management strategy and processes. The Company seeks to address cybersecurity risks through a comprehensive approach that is focused on implementing robust protective measures, promoting user awareness and education, continuously monitoring for potential threats, and swiftly responding to any security incidents to ensure the confidentiality, integrity, and availability of sensitive information.


text: The Company's Incident Response Team, which is comprised of members of the finance, legal, information technology and operations teams conduct annual tabletop exercises in which various levels of management participate in simulated data security/privacy scenarios that the Company, its customers, vendors and/or its personnel may face in the future. The Company engages external resources to refresh the subject matter of these exercises and to continually challenge the Company's management in these exercises. Annual formal training using an online platform is required for all employees. Topics include how to identify suspicious activities and occurrences related to social engineering, phishing, viruses, and insider threats.


text: In 2024, we did not identify any cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.


text: The Company's information security program is managed by the Company's Incident Response Team, which is responsible for leading our enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. Members of the Incident Response Team have extensive global experience in developing and executing information technology strategies. The Incident Response Team, which includes the Chief Financial Officer ("CFO"), in collaboration with the Audit Committee, monitor the prevention, detection, mitigation and remediation of cybersecurity incidents.


text: The CFO provides periodic reports to our Audit Committee, as well as other members of our senior management as appropriate. These reports occur at least annually and include updates on the Company's cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape.


text: Risk Management and Strategy We have adopted processes designed to identify, assess and manage material risks from cybersecurity threats. Those processes include responses to and assessments of internal and external threats to the security, confidentiality, integrity and availability of the Company's data and systems along with other material risks to firm operations, at least annually or whenever there are material changes to our systems or operations. As part of our risk management process, we engage outside providers to conduct periodic internal and external penetration testing. We use NIST Cybersecurity Framework and CIS Critical Security Controls as a guide to help us identify, assess, and manage cybersecurity relevant to our business. This does not imply that we meet any particular technical standards, specifications, or requirements. We store firm data in cloud environments with security appropriate to the data involved and have adopted controls around, among other things, vendor risk assessment, access and acceptable use and backup and recovery.

companyName: TPG Inc.

ticker: TPG


text: We have processes to oversee and identify material risks associated with the use of third-party service providers, taking into account the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider.


text: We have established an Enterprise Risk Committee ("ERC") to manage overall risk across the Company including cybersecurity risks identified by the cybersecurity team; the ERC includes representatives from relevant functions and is led by our Chief Executive Officer ("CEO"). We have also established an Operational Risk Committee ("ORC") which is responsible for applying the policy decisions of the ERC. Operational responsibility for ensuring the adequacy and effectiveness of our risk management, control and governance processes is assigned to our Chief Information Security Officer, who periodically reports, among other things, potentially material cybersecurity incidents to the ORC and, in coordination with the Chief Information Officer and Head of Operations, reports to the ERC at least annually. The Chief Information Security Officer leads the Company's cybersecurity team, which includes individuals dedicated to incident detection and response. This team is responsible for identifying threats that can impact the Company and designing controls to mitigate vulnerabilities before they are exploited and to detect and neutralize any threats that do materialize. The Chief Information Security Officer and Chief Information Officer each have more than 20 years of experience in their fields. The Chief Information Security Officer and senior members of the cybersecurity team hold industry standard certifications.


text: Our Audit Committee is briefed on cybersecurity risks at least once each year and as needed in connection with any potentially material cybersecurity incidents. The Chief Information Security Officer reports at least annually, to our Audit Committee and such report may address overall assessment of the Company's compliance with this and other cybersecurity policies, including topics such as risk assessment, risk management and control decisions, service provider arrangements, test results, security incidents and responses, and recommendations for changes and updates to policies and procedures.


text: Risk Management and Strategy We have adopted processes designed to identify, assess and manage material risks from cybersecurity threats. Those processes include risk assessments of internal and external threats to confidentiality, integrity and availability of the Company's data and systems along with other material risks to firm operations.


text: These risk assessments inform our cybersecurity program and the continued development of a layered set of controls aimed at preventing, detecting and responding to threats. Our administrative, organizational, technical and physical security controls include, but are not limited to, policies and procedures, system hardening vulnerability scanning and patching, employee training and awareness, third-party risk management processes, backup and recovery processes, access controls, data encryption in transit and at rest, network perimeter controls and identity verification. We also have policies and controls in place designed to detect and respond to cybersecurity events, including an incident response plan, an incident response team with dedicated roles and responsibilities for assessing and responding to a cybersecurity event, system logging and ongoing monitoring, and periodic training exercises simulating cybersecurity events that are designed to raise awareness and test our team's response readiness capabilities.


text: The nature, scope and effectiveness of these controls are regularly reviewed through a series of internal and external processes. The Cybersecurity team performs both automated monitoring on a continuous basis and manual reviews of key controls. We also conduct annual assessments of our cybersecurity program using industry standard cybersecurity frameworks, such as the NIST Cybersecurity Framework, as benchmarks to perform our evaluation. This does not imply that we fully meet any particular industry standards, specifications or requirements. In addition, independent reviews of our cybersecurity control effectiveness are conducted by TPG's Internal Audit team on a periodic basis. We also engage external providers to conduct periodic external assessments, including penetration testing.


text: We have established an Enterprise Risk Committee ("ERC") to manage overall risk across the Company including cybersecurity risks identified by the Cybersecurity team; the ERC includes representatives from relevant functions and is led by our CEO. We have also established an Operational Risk Committee ("ORC") which is responsible for applying the policy decisions of the ERC. Operational responsibility for ensuring the adequacy and effectiveness of our risk management, control and governance processes is assigned to our Chief Information Security Officer ("CISO"), who periodically reports, among other things, potentially material cybersecurity incidents to the ORC and reports to the ERC at least annually. The Cybersecurity team also regularly coordinates with other key stakeholders within the Firm, including Compliance, Human Resources, Internal Audit and Legal.


text: The Chief Information Security Officer leads the Company's Cybersecurity team, which is responsible for implementing, maintaining and enforcing our cybersecurity program. Our CISO previously held various leadership roles within the Technology Risk department of one of the world's largest banking institutions over a 17-year period. He holds a Bachelor of Science in Electrical Engineering and Mathematics from the University of Texas at Arlington and is a Certified Information Systems Security Professional (CISSP). Our Cybersecurity team possesses a variety of cybersecurity skill sets and extensive expertise obtained through decades of experience, numerous industry certifications, and advanced degrees. The Cybersecurity team continues to take steps to maintain up-to-date knowledge of evolving cybersecurity threats and countermeasures.


text: The Audit Committee of our Board of Directors has primary oversight over the Cybersecurity program. The Chief Information Security Officer reports at least annually to the Audit Committee and such report may address overall assessment of the Company's compliance with our cybersecurity policies, including risk assessment, risk management and control decisions, service provider arrangements, test results, security incidents and responses, and recommendations for changes and updates to policies and procedures.


text: As of the date of this report, we are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. Cyber criminals do, however, target TPG and our employees and vendors. Ongoing or future attacks such as these could have impacts on TPG's operations. For additional information on these ongoing risks please refer to "Part 1. Item 1A. Risk Factors—Failure to maintain the security of our information and technology networks or data security breaches could harm our reputation and have a material adverse effect on our results of operations, financial condition, and cash flow".


text: We face cybersecurity risks that could materially affect our business, financial condition, and results of operations. Cybersecurity threats include unauthorized access, data breaches, theft, misuse, disruption, or destruction of systems, digital assets, or confidential information. These risks are heightened given our reliance on digital asset custodians, cryptocurrency wallet providers, online hosting services, and other unaffiliated third-party service providers.

companyName: C2 Blockchain, Inc.

ticker: CBLO


text: Because a substantial portion of our current and past assets are maintained in the form of digital assets such as DOG Coin, and as of June 30, 2025, Cardano (ADA) tokens, our exposure to cybersecurity threats is significant. If the systems of our third-party wallet providers, custodians, or other service providers are compromised, or if our own limited internal protections fail, we could suffer an immediate and total loss of such assets. Unlike traditional bank accounts or securities held with registered brokers, digital assets may not be recoverable if stolen or rendered inaccessible due to a cyber incident. Any such loss could have a material adverse effect on our financial condition, business prospects, and results of operations.


text: developed or implemented a formal, enterprise-wide cybersecurity risk management program due to our small size, limited personnel, and early stage of operations. Our approach to cybersecurity consists primarily of commercially available tools such as multi-factor authentication, password protection, and encryption for certain Company accounts. We also rely on third-party custodians and wallet service providers for safeguarding digital assets, and we informally monitor industry alerts and provider communications for potential risks. These measures may not be sufficient to detect or prevent sophisticated or evolving threats, and our ability to evaluate or influence the cybersecurity practices of third-party service providers is limited.


text: cybersecurity matters rests with our sole officer and director, Levi Jacobson, who evaluates service providers, monitors for potential incidents, and would be responsible for coordinating any response. We do not currently employ dedicated cybersecurity personnel or maintain outside consultants on a continuing basis, though we may engage external advisors in the event of a material incident. As we currently have only one director, board-level oversight and management responsibilities are consolidated.


text: have not experienced any known material cybersecurity incidents. However, there can be no assurance that our systems or those of our service providers will not be compromised in the future. A successful attack could result in the theft or complete loss of our DOG Coin or other digital asset holdings, disruption of planned operations, reputational harm, potential legal liability, and the diversion of resources.


text: The Company maintains a governance structure to address cybersecurity risk, which involves a dedicated Security Operations Team (the "Security Operations Team"), an executive security steering committee (the "Executive Security Steering Committee"), and the Compliance and Risk Committee of the Board and the Board.

companyName: DraftKings Inc.

ticker: DKNG


text: The Company's Security Operations Team, led by our Chief Information Security Officer, is responsible for identifying, assessing, mitigating, and reporting on material cybersecurity risks to the Company's Executive Security Steering Committee. The Company's Chief Information Security Officer holds high-level licenses and certifications relating to information security, including a Certified Information Security Manager from the Information Systems Audit and Control Association and a Certified Information Systems Security Professional and a Certified Cloud Security Professional from the International Information Security System Security Certification Consortium. The Company's Executive Security Steering Committee, chaired by the Company's Chief Information Security Officer and comprised of various cross-functional members of senior management, drives awareness and alignment across broad stakeholder groups for cybersecurity governance and risk management and reporting. The Executive Security Steering Committee receives quarterly reports from the Company's Chief Information Security Officer. The Compliance and Risk Committee receives regular reports from the Company's Chief Information Security Officer. The Compliance and Risk Committee periodically reports to the Board.


text: The Company maintains an operational Incident Response Plan ("IRP") that defines how the Company handles cyber incidents, including escalation, reporting and remediation procedures. The IRP is reviewed annually both internally and by third parties during regular audits. In addition, the Company retains a preferred partner with expertise in cyber risks and incidents to advise on cybersecurity related matters. The Company's preferred partner is also part of the Company's IRP procedures and provides independent analysis and advice during cybersecurity investigations. The Company also maintains a Security Awareness Program, which is designed, implemented, and maintained by the Company's Chief Information Security Officer. The Company's Security Awareness Program includes training that reinforces the Company's information technology risk and security management policies, standards and practices, as well as the expectation that employees comply with these policies. The Security Awareness Program engages personnel through training on how to identify potential cybersecurity risks and protect the Company's resources and information, as well as how to respond to unauthorized access to or use of Company information. The Security Awareness Program training is mandatory for all employees globally at least annually, and it is supplemented by Company-wide assessment initiatives, including periodic testing. The Company provides specialized security training for certain employee roles, such as application developers.


text: The Company conducts periodic tests to assess the Company's processes and procedures and the threat landscape, which are designed with the goal of implementing and maintaining a robust cybersecurity program. Where appropriate, the Company takes additional and ongoing steps intended to strengthen the Company's cybersecurity capabilities and mitigate the risk of a breach or incident. The Company's security program and IT-related controls are regularly examined by internal auditors, external auditors and various regulators. For example, each year, the Company conducts various third-party audits, including SOC 2 Type2, PCI DSS, ISO 27001. The Company also engages third-party consultants for incident responses. These third-party consultants report directly to the Chief Information Security Officer and, depending on the nature of the incident, report directly to the Executive Security Steering Committee on various topics including, effects of the incident and recommendations on how to strengthen the Company's cybersecurity capabilities and mitigate the risk of a breach or incident. In addition to assessing the Company's cybersecurity preparedness, the Company also considers and evaluates cybersecurity risks associated with its use of third-party service providers. The Company maintains a vendor onboarding program, pursuant to which the Company regularly reviews third-party hosted applications and, when available, requests its vendors to provide SOC2 and/or ISO 27001 certificates. The Company's assessment of risks associated with use of third-party providers is part of the Company's overall cybersecurity risk management program.


text: The Company maintains an operational Incident Response Plan ("IRP") that defines how the Company handles cybersecurity incidents, including escalation, reporting and remediation procedures. The IRP is reviewed annually both internally and by third parties during regular audits. In addition, the Company retains a preferred partner with expertise in cybersecurity risks and incidents to advise on cybersecurity related matters. The Company's preferred partner is also part of the Company's IRP procedures and provides independent analysis and advice during cybersecurity investigations. The Company also maintains a Security Awareness Program, which is designed, implemented, and maintained by the Company's Chief Information Security Officer. The Company's Security Awareness Program includes training that reinforces the Company's information technology risk and security management policies, standards and practices, as well as the expectation that employees comply with these policies. The Security Awareness Program engages personnel through training on how to identify potential cybersecurity risks and protect the Company's resources and information, as well as how to respond to unauthorized access to or use of Company information. The Security Awareness Program training is mandatory for all employees globally at least annually, and it is supplemented by Company-wide assessment initiatives, including periodic testing. The Company provides specialized security training for certain employee roles, such as application developers.


text: Although we have designed our cybersecurity program and governance procedures above to mitigate cybersecurity risks, we have experienced, and we may in the future experience cybersecurity risks, threats and attacks. To date, these risks, threats or attacks have not had a material impact on our operations, business strategy or financial results, but we cannot provide assurance that they will not have a material impact in the future. See the section entitled "Risk Factors" included elsewhere in this Annual Report for further information. We continuously work to enhance our cybersecurity risk management program.


text: Morgan Stanley's threat intelligence function within the Cybersecurity Program actively engages in private and public information sharing communities and leverages both commercial and proprietary products to collect a wide variety of industry and governmental information regarding the latest cybersecurity threats, which informs Morgan Stanley's cybersecurity risk assessments and strategy, including as applicable to the Company. This information is also provided to an internal Morgan Stanley cyber threat detection team, which develops and implements strategies designed to defend against these cybersecurity threats across Morgan Stanley's environment, including systems and applications that may be relied upon by the Company. Morgan Stanley's vulnerability management team, as well as Morgan Stanley's Non-Financial Risk function ("NFR") review external cybersecurity incidents that may be relevant to the Firm and the Company, to further inform the design of the Cybersecurity Program.

companyName: T Series Middle Market Loan Fund LLC


text: To assess the efficacy of Morgan Stanley's controls and defenses designed to mitigate cybersecurity risk, it utilizes internal and external testing, including penetration testing and red team engagements. The results of these assessments are used to strengthen the Cybersecurity Program. Additionally, Morgan Stanley maintains a global training program covering cybersecurity risks and requirements, including heightened security training to specialized employees, and conducts regular phishing email simulations for its employees and consultants as preventative measures.


text: Morgan Stanley's Cybersecurity Program is regularly assessed by the Morgan Stanley Internal Audit Department ("IAD") through various assurance activities, with the results reported to the Audit Committee of the MS Board ("BAC") and the BOTC and, as applicable to the Board of Directors of the Company. Annually, key elements of the Cybersecurity Program are subject to a review by an independent third-party, the results of which, including opportunities identified for improvement and related remediation plans, are reviewed with the BOTC. The Cybersecurity Program is also examined regularly by the Firm's prudential and conduct regulators within the scope of their jurisdiction.


text: Morgan Stanley and Company's Management's role in assessing and managing material risks from cybersecurity threats Morgan Stanley's Cybersecurity Program is operated and maintained by its management, including the Chief Information Officer ("CIO") of Cyber, Data, Risk and Resilience and the Chief Information Security Officer ("CISO"). These senior officers are responsible for assessing and managing the Firm's cybersecurity risks, which includes cybersecurity risks faced by the Company. Morgan Stanley's Cybersecurity Program strategy, which is set by the CISO and overseen by the Morgan Stanley's Head of Operational Cyber, Technology, and Information Security Non-Financial Risk, ("Head of NFR CTIS"), is informed by various risk and control assessments, control testing, external assessments, threat intelligence, and public and private information sharing. Morgan Stanley's Cybersecurity Program also includes processes for escalating and considering the materiality of incidents that impact the Firm and the Company, including escalation to senior management of Morgan Stanley, the MS Board, and management of the Company.


text: Board oversight of risks from cybersecurity threats Our Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. Our Board receives periodic updates from the CCO of the Company, the CIO, CISO and Operational Risk functions, regarding the overall state of Morgan Stanley's Cybersecurity Program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.


text: Currently, the security of our information is managed by Mr. Ryohei Uetaki, our sole officer and director. While Mr. Uetaki believes he can maintain adequate internal security measures at this stage, there is no guarantee that this will prevent potential breaches, disruptions to our operations, or other related issues.

companyName: Ultimate Holdings Group, Inc.

ticker: UHGI


text: CYBERSECURITY RISK MANAGEMENT We have historically been dependent on AIG's risk management, cybersecurity and privacy policies, standards and procedures to identify, monitor, mitigate and communicate to us and our Board of Directors the cybersecurity risks to which we are exposed and manage. As a result, during 2023, we primarily relied on AIG to provide cybersecurity risk management and cybersecurity services to us pursuant to the Transition Services Agreement with AIG. While we remain reliant on AIG for the provision of certain of these services, as part of our separation from, and in cooperation with, AIG, we have developed and are in the process of implementing an Information Security Program for Corebridge (the "Program") that includes, among other things, conducting periodic risk assessments designed to evaluate potential security threats, to detect potential vulnerabilities, and to mitigate identified security risks. The Program is informed by industry standards and frameworks and is designed to protect the confidentiality, integrity, and availability of Corebridge's information assets and systems that store, process, or transmit material non-public information. Where appropriate, we also engage third-parties to evaluate our Program and our cybersecurity risk management and to provide operational support for the Program.

companyName: Corebridge Financial, Inc.

ticker: CRBG


text: The Program includes the following key elements: • Network, Systems, and Data Security – Corebridge deploys technical and organizational safeguards that are designed to protect Corebridge's networks, systems, and data from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, software security assessments, and access and identity management controls; • Threat and Vulnerability Management –Corebridge maintains a threat and vulnerability management program that leverages threat intelligence to proactively identify, assess, and address cybersecurity risks. This program incorporates vulnerability scanning, risk-based remediation and mitigation, penetration testing, and threat response capabilities to safeguard our information assets and ensure business continuity; • Cybersecurity Incident Monitoring and Response – Corebridge has established and maintains incident response plans that address Corebridge's response to a cybersecurity incident, utilizing a cross-functional approach; • Third Party Assessment and Oversight – Corebridge maintains a third-party risk management program to identify and manage risks from third-party service providers, including initial due diligence, an assessment of the service provider's control environment and periodic re-assessments; and • Security Training and Awareness – Corebridge provides ongoing education and training to employees regarding information security threats, and their role and responsibility in detecting and responding to such threats.


text: The Program is evaluated on an ongoing basis to address the evolving cyber threat landscape and to comply with applicable legal and regulatory obligations. See "Business—Regulation—U.S. Regulation—Privacy, Data Protection and Cybersecurity" for further discussion. Control adequacy and design are reviewed periodically, and periodic audits assist in identifying areas for continued focus, improvement and/or inclusion, and are designed to provide assurance that controls are appropriately designed and operating effectively. Additionally, our Internal Audit group performs testing of Corebridge's control environment, including the Program.


text: Our Chief Information Security Officer ("CISO") provides oversight and direction for the Program and coordinates with other corporate functions and business segments to address all aspects of the Program, including recommending adjustments in response to changes in technology, internal or external threats, business processes, and regulatory or statutory requirements, and communicates the information security risk posture of Corebridge to the relevant internal individuals, committees and departments, including as further described below.


text: Board Oversight and Governance As discussed above, we have historically relied upon AIG to provide oversight of cybersecurity risk management and cybersecurity services that AIG provides to us pursuant to the Transition Services Agreement. In connection with our separation from AIG we are in the process of implementing certain processes, including training and reporting, to help facilitate oversight of information security risks by Corebridge's senior management and Board of Directors. These processes will enable our operations and risk management functions that monitor cybersecurity risks and examine control performance to report and escalate cybersecurity risks to senior management and the Board of Directors, as appropriate.


text: CYBERSECURITY RISK MANAGEMENT W e have developed and implemented an Information Security Program for Corebridge (the "Program") that includes, among other things, conducting periodic risk assessments designed to evaluate potential security threats, to detect potential vulnerabilities, and to mitigate identified security risks. The Program is informed by industry standards and frameworks and is designed to protect the confidentiality, integrity, and availability of Corebridge's information assets and systems that store, process, or transmit material non-public information. The Program is managed day-to-day by technology, information security, and operational personnel. W here appropriate, we also engage third-parties to provide operational support for the Program and to evaluate our Program and our cybersecurity risk management.


text: The Program includes the following key elements: • Network, Systems, and Data Security – Corebridge deploys technical and organizational safeguards that are designed to protect Corebridge's networks, systems, and data from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, software security assessments, data leak protection, and access and identity management controls; • Threat and Vulnerability Management –Corebridge maintains a threat and vulnerability management program that leverages threat intelligence to proactively identify, assess, and address cybersecurity risks. This program incorporates vulnerability scanning, risk-based remediation and mitigation, penetration testing, and threat response capabilities to safeguard our information assets and ensure business continuity; • Cybersecurity Incident Monitoring and Response – Corebridge has established and maintains incident response plans that address Corebridge's response to a cybersecurity incident, utilizing a cross-functional approach; • Third Party Assessment and Oversight – Corebridge maintains a third-party risk management program to identify and manage risks from third-party service providers, including initial due diligence, an assessment of the service provider's control environment and periodic re-assessments; and • Security Training and Awareness – Corebridge provides ongoing education and training to employees regarding information security policies, procedures and best practices, including cyber threats, and their roles and responsibilities in identifying, reporting and responding to such threats.


text: The Program is evaluated on an ongoing basis to address the evolving cyber threat landscape and to comply with applicable legal and regulatory obligations. See "Business—Regulation—U.S. Regulation—Privacy and Cybersecurity" and Business—Regulation—International Regulation—Privacy and Cybersecurity for further discussion. Control adequacy and design are reviewed periodically, and periodic audits assist in identifying areas for continued focus, improvement and/or inclusion, and are designed to provide assurance that controls are appropriately designed and operating effectively. Additionally, our Internal Audit group performs testing of Corebridge's control environment, including the Program.


text: Our Chief Information Security Officer ("CISO") provides oversight and direction for the Program, including recommending adjustments in response to changes in technology, internal and external threats, business operations, and regulatory and statutory requirements, coordinates with other corporate functions and business segments to address various aspects of the Program managed by technology and operational personnel, an d communicates Corebridge's information security risk posture to relevant personnel, senior management and governing bodies, including as further described below.


text: Board Oversight and Governance We have implemented processes, to help facilitate oversight of information security risks by Corebridge's senior management and Board of Directors. These processes enable our operations and risk management functions that monitor cybersecurity risks and examine control performance to report and escalate cybersecurity risks to our senior management and the Board of Directors, as appropriate.


text: The Company's Board of Directors (the "Board") recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners, and employees. Together with Executive management, the Board is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach. The Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, integrity, and availability of the information that the Company collects and stores by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: BRC Inc.

ticker: BRCC


text: Risk Management and Strategy As one of the critical elements of the Company's strategy, the Company's cybersecurity program is focused on the following key areas: • Governance: As discussed in more detail under the heading "Governance," the Board's oversight of cybersecurity risk management is supported by the Audit Committee of the Board, which regularly interacts with members of senior management tasked with various risk management functions. • Collaborative Approach: The Company has implemented a comprehensive, cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management promptly. • Technical Safeguards: The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. • Incident Response and Recovery Planning: The Company has established and maintains comprehensive incident response and recovery plans that fully address the Company's response to a cybersecurity incident, and such plans are tested and evaluated regularly. • Education and Awareness: The Company provides regular, mandatory training for personnel regarding cybersecurity threats as a means to equip the Company's personnel with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes, and practices.


text: The Company engages in the periodic assessment and testing of the Company's policies, standards, processes, and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including assessments, tabletop exercises, vulnerability testing, and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. The Company also engages third parties to perform assessments on our cybersecurity measures.


text: The Board, in coordination with the Audit Committee, oversees the Company's management of risks arising from cybersecurity threats. The Board and the Audit Committee each receive quarterly presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, and information security considerations arising with respect to the Company's peers and third parties. The Board and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.


text: The Company relies on its Executive management and internal technical experts to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity risk management program, dedicated personnel are deployed with the expertise to address cybersecurity threats and to respond to cybersecurity incidents if and as they occur. The expertise of such dedicated personnel is primarily derived from prior employment and training in the information technology and/or cybersecurity space. Members of the Security leadership team have served in various leadership roles across the security, intelligence, and cybersecurity domains for over 20 years. Their previous experience spans across the military and private sector, previously leading global cybersecurity intelligence & defensive operations at a fortune 500 enterprise. They hold various security credentials, certifications, and memberships in cybersecurity leadership organizations. Their professional education includes business management, computer science, and computer applications expertise. Through ongoing communications with these teams, members of management monitor the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents in real-time, and report such threats and incidents to the Audit Committee when appropriate.


text: Risk Management and Strategy We prioritize risk management as a core component of our overall cybersecurity program. We regularly assess risks from cybersecurity threats, monitor our information systems for potential vulnerabilities and tests those systems pursuant to our cybersecurity policies, processes and practices. To protect our information systems from cybersecurity threats, we use various security tools that help us identify, escalate, investigate, resolve, and recover from security incidents in a timely manner. These efforts include: • an internal governance structure to identify, assess, and manage cybersecurity risks across the company in an integrated manner.; • cybersecurity incident management procedures designed to address the monitoring of systems for anomalous activity; identification of threats; assessment, prioritization, and escalation of incidents; response and recovery of systems; and continuous improvement; • technical controls to help ensure systems are protected from security threats and unauthorized or inappropriate access; • a vulnerability management and threat intelligence program that is designed to provide threat intelligence information to leadership and impacted business units; • monitoring and tracking key cybersecurity metrics; • a third-party risk management program designed to assess and mitigate risks associated with vendors, and other service provider organizations; and • cybersecurity awareness training for all employees, including additional training for specialized functions.

companyName: Aspen Technology, Inc.


text: We partner with third parties to assess the effectiveness of our cybersecurity prevention and response systems and processes, including through the use of cybersecurity consultants, to conduct evaluations of our security controls and provide certifications for industry-standard security frameworks, such as ISO 27001.


text: To date, we are not aware of cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. Refer to the risk factors captioned "Security or data privacy breaches, or disruptions of our information technology systems, and an increasingly complex regulatory landscape could adversely affect our business" and "Our software products are highly sophisticated and specialized, and a major product failure or similar event caused by defects, cybersecurity incidents or other failures, could adversely affect our business" in Part I, Item 1A. "Risk Factors" for additional description of cybersecurity risks and potential related impacts on us.


text: The Audit Committee of our Board reviews and oversees the implementation of our policies and procedures related to cybersecurity risk assessment and management.


text: Our Chief Security Officer ("CSO") reports to the Audit Committee periodically on significant cybersecurity incidents and risks, as well as progress made on cybersecurity roadmap initiatives. The CSO also presents to the Board at least annually to address the current threat landscape, our readiness to meet those threats, and cybersecurity priorities and focus areas for the upcoming fiscal year.


text: The CSO may provide more frequent updates to the Board or the Audit Committee if necessitated by a security incident or other developments. The Audit Committee reports regularly to the Board regarding the committee's oversight of cybersecurity risk matters.


text: We take a risk-based approach to cybersecurity and have implemented cybersecurity policies throughout our operations that are designed to address cybersecurity threats and incidents. In particular, the interim Chief Legal Officer and the CSO co-chair a periodic Cybersecurity Steering Committee (the "Steering Committee") meeting to help ensure a strategic approach to assessing and mitigating cybersecurity risks. The Steering Committee is charged with: • providing ownership, oversight, and review of current and future information security risks; • reviewing, approving, and communicating information security policies, exceptions, standards, and processes to the relevant teams and employees and helping ensure business requirements are represented in Steering Committee discussions; • reviewing our approach to security initiatives to assess whether it is designed to meet appropriate risk thresholds and regulatory guidelines; and • providing strategic direction and sponsorship for cybersecurity investments, projects, and services.


text: The CSO, the interim Chief Legal Officer and the Chief Research & Software Development Officer are responsible for leading the assessment and management of cybersecurity risks. The current CSO has over 20 years of experience in information security.


text: Risk Management Strategy The Company has implemented a cybersecurity program intended to assess, identify, manage and reduce cybersecurity risk. Through our partnership with Harley-Davidson we maintain an IT incident response plan that is designed to protect against, identify, evaluate, respond to, and recover from an incident. The plan is designed to be flexible so it may be adapted to an array of potential scenarios and includes a cybersecurity incident response team in the event of a cyber incident. The incident response team is a cross-functional group that is composed of both Company and Harley-Davidson personnel and external service providers, and which is tailored to a particular incident so that individuals with appropriate experience and expertise are available. Currently the Company contracts for such cybersecurity services through the Master Services Agreement with Harley-Davidson, in addition to leveraging its own information technology and security tools and teams.

companyName: LiveWire Group, Inc.

ticker: LVWR


text: We have invested in tools and technologies intended to protect our data and business systems, and we monitor our computing environment on an ongoing basis to help identify and assess risk. In addition, we have implemented a cybersecurity training program designed to educate and train employees how to identify, potentially avoid and report cybersecurity threats. It is focused on helping our workforce recognize, avoid falling victim to and raise the visibility of potential cyber threats and scams. In addition, periodic cybersecurity awareness messages are posted to employees on the Company portal as new threats and scams develop throughout the year.


text: Through the Master Services Agreement with Harley-Davidson, we take measures to regularly update and improve our cybersecurity program, including conducting assessments, performing penetration testing and scanning of our systems for vulnerabilities using external third-party tools and techniques to test security controls, auditing applicable data policies, and monitoring emerging laws and regulations related to information security. We design our program based on the National Institute of Standards and Technology (NIST) Cybersecurity Framework. However, this does not imply that we meet any particular technical standards, specifications or requirements, only that we use the NIST Cybersecurity Framework as a guide to help us identify, assess and manage cybersecurity risks relevant to our business. In addition, we periodically engage third-party advisors to assess the effectiveness of our cybersecurity program, policies and practices. We rely on Harley-Davidson to regularly consult with external advisors and cybersecurity providers regarding opportunities and enhancements to strengthen our policies and practices.


text: With respect to third-party service providers, our cybersecurity program includes conducting due diligence of relevant and material service providers' information security programs prior to onboarding. In general we also contractually require material third-party service providers with access to our information technology systems, sensitive business data or personal information to implement and maintain reasonably appropriate security controls and to use our personal information only to provide services to us, except as required by law.


text: While the Company has experienced, and may in the future experience, cybersecurity incidents, prior incidents have not materially affected the Company's business, results of operations or financial condition. Although the Company has invested in the protection of its data and information technology and monitors its systems on an ongoing basis, there can be no assurance that such efforts will in the future prevent material compromises to Company information technology systems that could have a material adverse effect on the Company's business. See Item 1A. Risk Factors, which are incorporated by reference into this Item 1C.


text: Our Board of Directors has risk oversight responsibility for the Company and administers this responsibility both directly and with assistance from the Audit and Finance Committee, which periodically reports to the Board of Directors on its risk oversight activities. Cybersecurity is a critical component of our overall risk management program. Our Board of Directors is actively involved in reviewing our information security and technology risks and opportunities (including cybersecurity) and discusses these topics on a regular basis.


text: The Audit and Finance Committee, comprised solely of independent directors, oversees our enterprise risk management program and assists the Board of Directors in fulfilling its oversight responsibility with respect to our information security and technology risks (including cybersecurity), which are fully integrated into our enterprise risk management systems. The Audit and Finance Committee reviews and discusses our information security and technology risks (such as cybersecurity), including our information security and risk management programs.


text: Our cybersecurity program is contracted through and led by Harley-Davidson's Chief Information Security Officer (CISO) who is responsible for assessing and managing the Company's information security and technology risks (including cybersecurity). On December 15, 2023, the Harley-Davidson CISO announced his retirement from Harley-Davidson, and since that time, Harley-Davidson's Chief Digital and Operations Officer is serving as the acting Harley-Davidson CISO, executing all of the responsibilities of the CISO while Harley-Davidson conducts a search to fill the position. Harley-Davidson's Chief Digital and Operations Officer has extensive experience in leading information systems management, strategy and operational execution, including information security and incident management, prevention and response.


text: The Harley-Davidson CISO meets regularly with our Head of Digital to review and discuss our cybersecurity and other information technology risks and opportunities. Our cybersecurity incident response plan sets forth a security incident management and reporting protocol, with escalation timelines and responsibilities.


text: The Audit and Finance Committee receives periodic updates from the Harley-Davidson CISO or his designee on our cybersecurity program, including industry trends, the current state of our business systems, and any current known risks or concerns related thereto. The Audit and Finance Committee is involved in reviewing our information security and technology risks, including with respect to cybersecurity and reports on such matters to the Board as necessary, and at least annually.


text: Our cybersecurity program is contracted through and led by Harley-Davidson's Chief Information Security and Privacy Officer (CISO) who is responsible for assessing and managing the Company's data privacy function and information security and technology risks (including cybersecurity). The CISO has over 20 years of cyber industry and compliance experience, serving in a CISO capacity for over ten of those years. The CISO reports to Harley Davidson's Chief Digital and Operations Officer, who has extensive experience in leading information systems management, strategy and operational execution, including information security and incident management, prevention and response.


text: The Harley-Davidson CISO meets regularly with the appropriate management to review and discuss our cybersecurity and other information technology risks and opportunities. Our cybersecurity incident response plan sets forth a security incident management and reporting protocol, with escalation timelines and responsibilities.


text: Risk Management and Strategy The Company's cybersecurity is overseen by the Chief Executive Officer, who receives reports directly from other officers and individuals who perform services for the Company, including, but not limited to, the Manager's Information Security Steering Committee ("ISSC"), employing a risk-based methodology designed to safeguard the security, confidentiality, integrity, and availability of its information. The ISSC is tasked with developing an effective cyber strategy, establishing policies, and managing cyber risks within the organization. The Manager's Chief Financial Officer and General Counsel, along with the Chief Operating Officer, Chief Human Resources Officer, Chief Compliance Officer, Chief Technology Officer, Chief Information Security Officer and Chief of Intelligence collaborate with Company management to formulate, implement, and enforce these policies. They help ensure that the ISSC considers best practices in its decision-making, and convenes quarterly or as needed to assess cybersecurity issues and supervise matters related to information security, fraud, vendors, data protection, and privacy risks.

companyName: FTAI Infrastructure Inc.

ticker: FIP


text: To help identify and assess risks, we and our Manager engage third-party advisors to conduct assessments, which leverage standards such as the National Institute of Standards and Technology security framework ("NIST"). The results of these assessments inform the development of cybersecurity controls and risk mitigation strategies, which are then implemented throughout the Company.


text: To date, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and we believe are not reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. Refer to the risk factor captioned "A cyberattack that bypasses our information technology ("IT") security systems or the IT security systems of our third-party providers, causing an IT security breach or cybersecurity incident, may lead to a disruption of our IT systems and the loss of business information which may hinder our ability to conduct our business effectively and may result in lost revenues and additional costs." in Part I, Item 1A. "Risk Factors" for additional description of cybersecurity risks and potential related impacts on the Company.


text: Risk Management and Strategy The Company's cybersecurity is overseen by the Chief Executive Officer, who receives reports directly from other officers and individuals who perform services for the Company, including, but not limited to, the Manager's Information Security Steering Committee ("ISSC"), employing a risk-based methodology designed to safeguard the security, confidentiality, integrity, and availability of its information. The ISSC is tasked with developing an effective cyber strategy, establishing policies, and managing cyber risks within the organization. The Manager's Chief Financial Officer and General Counsel, along with the Chief Operating Officer, Chief Human Resources Officer, Chief Compliance Officer, Chief Technology Officer, Chief Information Security Officer and Chief of Intelligence collaborate with Company management to formulate, implement, and enforce these policies. They help ensure that the ISSC considers best practices in its decision-making, and convenes quarterly or as needed to assess cybersecurity issues and supervise matters related to information security, fraud, vendors, data protection, and privacy risks. The Manager's Chief Technology Officer and Chief Information Security Officer have extensive knowledge and skills, and collectively bring decades of experience in the cybersecurity industry.


text: We have taken proactive measures intended to minimize the likelihood of successful cyberattacks, including the establishment of incident response procedures designed to address potential cyber threats that may arise. These response procedures are structured with the aim to identify, analyze, contain, and remediate any cyber incidents that occur. We also have risk management processes to oversee and help identify risks from cybersecurity threats associated with our use of third-party providers. The Company's cybersecurity risk management processes are an integrated and key component of the Company's overall risk management strategy.


text: To date, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and we believe are not reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. Refer to the risk factor captioned "A cyberattack that bypasses our information technology ("IT") security systems or the IT security systems of our third-party providers, causing an IT security breach or cybersecurity incident, may lead to a disruption of our IT systems and the loss of business information which may hinder our ability to conduct our business effectively and may result in lost revenues and additional costs." in Part I, Item 1A, "Risk Factors" for additional description of cybersecurity risks and potential related impacts on the Company.


text: The CFO and CCO of the Company oversee the Company's oversight function generally and rely on GC Advisors' CIO and cybersecurity team to assist with assessing and managing material risks from cybersecurity threats. The Company's CFO has been responsible for this oversight function as CFO to the Company since the Company commenced operations on April 1, 2022 and has worked in the financial services industry for more than eighteen years, during which time the CFO has gained expertise in assessing and managing risk applicable to the Company. The Company's CCO has been responsible for this oversight function as CCO to the Company since the Company commenced operations on April 1, 2022 and has worked in the financial services industry for more than twenty years, during which time the CCO has gained expertise in assessing and managing risk applicable to the Company. The Advisors' CIO has been responsible for her function for over four years and has worked in the financial services industry for more than fifteen years, during which time the CIO has gained expertise in assessing and managing risk applicable to the Company.

companyName: Golub Capital Direct Lending Unlevered Corp


text: The Company has processes in place to assess, identify, and manage material risks from cybersecurity threats. The Company's business is dependent on the communications and information systems of GC Advisors and other third- party service providers. GC Advisors manages the Company's day-to-day operations and has implemented a cybersecurity program that applies to the Company and its operations.


text: The CFO and CCO of the Company oversee the Company's oversight function generally and rely on GC Advisors' CIO and cybersecurity team to assist with assessing and managing material risks from cybersecurity threats. The Company's CFO has been responsible for this oversight function as CFO to the Company since the Company commenced operations on April 1, 2022 and has worked in the financial services industry for more than nineteen years, during which time the CFO has gained expertise in assessing and managing risk applicable to the Company. The Company's CCO has been responsible for this oversight function since assuming her role as CCO to the Company and has worked in the financial services industry for more than 15 years, during which time the CCO has gained expertise in assessing and managing risk, including those applicable to the Company. The Advisors' CIO has been responsible for her function for over five years and has worked in the financial services industry for more than sixteen years, during which time the CIO has gained expertise in assessing and managing risk applicable to the Company.


text: nCino's Enterprise Risk Management Program includes a cybersecurity risk management process and a formal Information Security Management System ("ISMS") as foundational components of the program. We routinely assess risks that could affect the organization's ability to meet its business objectives and provide reliable services to our customers. nCino's Chief Information Security Officer ("CISO") is responsible for identifying, assessing, and managing material cybersecurity risks. nCino's CISO brings over 25 years of experience in security and risk management to the company and takes the lead on reporting risk to senior management and nCino's Board of Directors.

companyName: nCino, Inc.

ticker: NCNO


text: nCino conducts annual cybersecurity risk and threat assessments which include detailed control analyses for measuring both inherent and residual risk factors. These assessments are performed by nCino Information Security as part of the ISO 27001 ISMS requirements. Our annual risk assessment is performed by using the nCino ISO 27001 risk assessment as a basis for risk identification, with additional assessments to address risks that threaten the achievement of the control objectives as appropriate. Threats to security, confidentiality, and availability are identified and assessed as part of our annual and routine risk assessments.


text: nCino's CISO reports cyber security risk assessment results at Disclosure Committee Meetings, Board and Audit Committee Meetings, and executive subcommittees specializing in cyber security risk management (Risk Information Security Committee). nCino maintains a documented process for when and by whom senior management is informed of a cybersecurity incident and when such information will be reported to affected parties. These processes are detailed within our Incident Response Plan which is regularly reviewed and updated by the information security team.


text: nCino has implemented a variety of cybersecurity processes, technologies, and controls to aid in our efforts to identify, assess and manage material risks. Our approach includes (i) nCino's Enterprise Risk Management Program, as managed by the Internal Audit & Enterprise Risk Management Department and overseen by the Audit Committee of the Board; (ii) cybersecurity risk and threat assessments; (iii) vulnerability management programs designed to identify hardware and software vulnerabilities; (iv) variety of tools designed to monitor our networks and systems for suspicious activity; and (v) incident response plans and trainings. The Enterprise Risk Management Program includes a cybersecurity risk management process and a formal Information Security Management System ("ISMS") as foundational components of the program covering cybersecurity. Within this process, we routinely assess risks that could affect the organization's ability to meet its business objectives and provide reliable services to our customers. nCino's Chief Information Security Officer ("CISO") is responsible for identifying, assessing, and managing material cybersecurity risks. nCino's CISO brings over 25 years of experience in security and risk management to the Company, reporting to executive leadership, cybersecurity-focused committees, and nCino's Board of Directors.


text: nCino conducts annual cybersecurity risk and threat assessments which include detailed control analyses for measuring both inherent and residual risk factors. These assessments are performed by nCino Information Security as part of ISO 27001 ISMS requirements, framework and certification. Our annual risk assessment, aligned to ISO 27001 and National Institute of Standards and Technology ("NIST"), is the basis for security risk identification, with additional assessments to address risks that threaten the achievement of established control objectives. Threats to security, confidentiality, and availability are identified and assessed as part of our annual and routine risk assessments. Additional information on the cybersecurity risks we face is discussed in Part I, Item 1A of this Annual Report on Form 10-K, "Risk Factors."


text: nCino's CISO reports cyber security risk assessment results at the Enterprise Risk Management Committee, Information Security, and Board and Audit Committee Meetings. nCino uses formal and informal education and training efforts to identify and mitigate cybersecurity risk, which includes external collaboration with peers and industry groups. nCino maintains a documented process for when and by whom senior management is informed of a cybersecurity incident and when such information will be reported to affected parties. These processes are detailed within our Incident Response Plan which is regularly reviewed and updated by the information security team.


text: maintain an information security and cybersecurity program, as well as a cybersecurity governance framework, which are designed to protect our information systems against operational risks related to cybersecurity.

companyName: Expion360 Inc.

ticker: XPON


text: Risk Management and Strategy recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats which include, among other things, operational risks, intellectual property theft, fraud or extortion, harm to employees or customers, violation of privacy or security laws and related litigation and legal risk, and reputational risks.


text: have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information, and detect and contain any cybersecurity incidents that impact us. We regularly engage with third-party consultants in connection with our cybersecurity risk management program, which is overseen by our Chief Operating Officer.


text: The program is integrated into our overall risk management systems and processes, and includes a cybersecurity risk assessment process that routinely evaluates potential impacts of cybersecurity risks on our business, including our operations, financial stability, and reputation. These assessments inform our cybersecurity risk mitigation strategies. The results are regularly shared with management and the Audit Committee of our Board as part of the committee's involvement in managing and overseeing cybersecurity risks.


text: cybersecurity risk management program also includes processes to triage, assess the severity of, escalate, contain, investigate, and remediate an incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage.


text: If a cybersecurity incident is determined to be a potentially material cybersecurity incident, our disclosure controls and procedures define the steps to determine materiality and disclose such a material cybersecurity incident.


text: we do not believe that our business strategy, results of operations or financial condition have been materially adversely affected by any cybersecurity incidents, cybersecurity threats are pervasive and, similar to other global financial institutions, we, as well as our employees, customers, regulators, service providers, and other third parties have experienced a significant increase in information security and cybersecurity risk in recent years and will likely continue to be the target of cyber attacks. We continue to assess the risks and changes in the cyber environment, invest in enhancements to our cybersecurity capabilities, and engage in industry and government forums to promote advancements in our cybersecurity capabilities, as well as the broader financial services cybersecurity ecosystem. For more information on risks to us from cybersecurity threats, see the section entitled " Risk Factors — If our electronic data is compromised, or we experience a failure in our information technology or storage systems, our business could be significantly harmed. " included within this Annual Report.


text: Board is actively involved in overseeing risks from cybersecurity threats. At least once a year, our Board discusses our programs and policies related to cybersecurity and risk initiatives and considers them closely both from a risk management perspective and as part of our business strategy. Our Audit Committee has the authority to oversee and review the adequacy of our cybersecurity, information and technology security, and data privacy programs, procedures, and policies.


text: Audit Committee regularly receives updates from management with respect to our efforts to manage data protection, cybersecurity, and information and technology risks, and assesses the results of reviews from internal audits. Materials presented to our Audit Committee include updates on our data security posture, results from internal audit and third-party assessments, our incident response plan, and certain cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. The Audit Committee also regularly engages with Management on technology risk-related topics.


text: processes also allow for our Board and the Audit Committee to be informed of key cybersecurity risks outside the regular reporting schedule.


text: While regular meetings of the Audit Committee are scheduled on a quarterly cadence, the Audit Committee is authorized to meet with management or individual directors at any time it deems appropriate to discuss matters relevant to the committee. Our policy is for the Board and the Audit Committee to receive prompt and timely information regarding any cybersecurity risk (including any incident) that meets reporting thresholds, as well as ongoing updates regarding any such risk.


text: Our information systems consist of computer systems used by the Company's Chief Executive Officer and chief financial officer. They actively monitor our threat environment for cybersecurity threats using various methods, including automated detection tools, scans of the threat environment, investigations of potential threats they discover or that are reported to them, and reports and services that identify threats. They monitor our information systems for vulnerabilities using internal and third-party penetration testing, intelligence feeds, and vulnerability databases.

companyName: CAPSTONE COMPANIES, INC.

ticker: CAPC


text: computer systems involve the use of third-party technology or service providers, or vendors, such as hosting platforms, open-source software, and application providers. Employees are provided specific guidance to mitigate the risk of a cybersecurity attack. This guidance includes safeguards over confidential data, being aware of suspicious emails, choosing passwords, protection of Company issued and use of personal devices, managing large data transfers. Employees are directed to immediately contact the Chief Executive Officer if they encounter any suspicious activity.


text: If a cybersecurity risk is identified, Company's policy is to use vendors to assist the Company to identify, assess, and manage material risks from cybersecurity threats to corporate systems, which consulting firms may include consulting firms, external legal counsel, incident response vendors, auditors, monitoring technology, and cybersecurity data providers.


text: The Company's Chief Executive Officer is tasked with reporting on cybersecurity measures and issues to the entire board of directors. In the event of a cybersecurity incident, Company policy is for the Company Chief Executive Officer to report the cybersecurity incident to the Company's board of directors and take remedial actions to mitigate and remediate cybersecurity incidents.


text: the normal course of business, we may collect and store personal information and other sensitive information, including proprietary and confidential business information, trade secrets, intellectual property, patient information, sensitive third-party information and employee information. To protect this information, our existing cybersecurity policies require continuous monitoring and detection programs, network security precautions, encryption of critical data and in-depth security assessments of vendors. We maintain various protections designed to safeguard against cyberattacks, including firewalls and virus detection software. Our information technology (" IT ") team (In-house and outside consultants) s responsible for these ongoing monitoring and detection activities.

companyName: Kaya Holdings, Inc.

ticker: KAYS


text: governance of our cybersecurity risks involves active and informed participation from our management team, our IT team and our board of directors. This oversight includes briefings by our IT team on the nature of the risks we face and the steps we are taking to mitigate these risks, as well as immediately reporting any significant cybersecurity incident that occurs to management and the board of directors.


text: have not experienced a cybersecurity incident that had a material impact on our business strategy, results of operations, or financial condition. We continue to monitor potential cybersecurity threats and incorporate findings into our risk management strategies.


text: We have developed and maintain a cybersecurity risk management methodology intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management methodology is integrated into our overall enterprise risk management, and shares common methodologies, reporting channels and governance processes that apply across the Company to other legal, compliance, strategic, operational, and financial risk areas. As part of our overall risk management processes and procedures, we have instituted a cybersecurity awareness designed to identify, assess and manage material risks from cybersecurity threats, including by engaging a third-party cybersecurity service provider, which communicates directly with our management and compliance personnel. The cyber risk management methodology involves risk assessments, implementation of security measures and ongoing monitoring of systems and networks, including networks on which we rely. Through our cybersecurity awareness, the current threat landscape is actively monitored in an effort to identify material risks arising from new and evolving cybersecurity threats. We may engage external experts, including cybersecurity assessors, consultants and auditors to evaluate cybersecurity measures and risk management processes as needed. We also depend on and engage various third parties, including suppliers, vendors and service providers in connection with our operations. Our risk management, legal, and compliance personnel oversee and identify, including through a third-party cybersecurity service provider, material risks from cybersecurity threats associated with our use of such entities.

companyName: Clean Vision Corp

ticker: CLNV


text: Management and Strategy Our information systems consist of computer systems used by the Company's Chief Executive Officer and Chief Financial Officer. They actively monitor our threat environment for cybersecurity threats using various methods, including automated detection tools, scans of the threat environment, investigations of potential threats they discover or that are reported to them, and reports and services that identify threats. They monitor our information systems for vulnerabilities using internal and third-party penetration testing, intelligence feeds, and vulnerability databases.


text: Company's computer systems involve the use of third-party technology or service providers, or vendors, such as hosting platforms, open-source software, and application providers. Employees are provided specific guidance to mitigate the risk of a cybersecurity attack. This guidance includes safeguards over confidential data, being aware of suspicious emails, choosing passwords, protection of Company issued and use of personal devices, managing large data transfers. Employees are directed to immediately contact the Chief Executive Officer if they encounter any suspicious activity.


text: Company's Chairman of the Board of Directors is tasked with reporting on cybersecurity measures and issues to the entire board of directors. In the event of a cybersecurity incident, Company policy is for the Company Chairman of the Board of Directors to report the cybersecurity incident to the Company's Board of Directors and take remedial actions to mitigate and remediate cybersecurity incidents.


text: Risk Management and Strategy We maintain an information security and cybersecurity program, as well as a cybersecurity governance framework, which are designed to protect our information systems against operational risks related to cybersecurity.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information, and detect and contain any cybersecurity incidents that impact us. We regularly engage with third-party consultants in connection with our cybersecurity risk management program, which is overseen by our Chief Operating Officer. The program is integrated into our overall risk management systems and processes, and includes a cybersecurity risk assessment process that routinely evaluates potential impacts of cybersecurity risks on our business, including our operations, financial stability, and reputation. The Audit Committee also reviews with management the implementation and effectiveness of the Company's controls to monitor and mitigate cybersecurity risks.


text: While we do not believe that our business strategy, results of operations or financial condition have been materially adversely affected by any cybersecurity incidents, cybersecurity threats are pervasive and, similar to other global financial institutions, we, as well as our employees, customers, regulators, service providers, and other third parties have experienced a significant increase in information security and cybersecurity risk in recent years and will likely continue to be the target of cyber attacks. We continue to assess the risks and changes in the cyber environment, invest in enhancements to our cybersecurity capabilities, and engage in industry and government forums to promote advancements in our cybersecurity capabilities, as well as the broader financial services cybersecurity ecosystem. For more information on risks to us from cybersecurity threats, see the section titled " Risk Factors—If our electronic data is compromised, or we experience a failure in our information technology or storage systems, our business could be significantly harmed " included within this Annual Report.