text: External Assessments Our cybersecurity policies, standards, processes and practices are periodically assessed by consultants and external auditors. These assessments include a variety of activities including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. For example, in 2022, 2023 and 2024 we conducted independent cyber maturity assessments to review our controls against portions of the NIST Cybersecurity Framework. We also have achieved PCI SAQ-A Compliance every year since 2019. The results of significant assessments are reported to management, the Board and Audit Committee. Cybersecurity processes are adjusted, as appropriate, based on the information provided from these assessments.


text: Our Principal Security Engineer ("PSE") is responsible for the day-to-day assessment and management of our material cybersecurity risks. Since November 2021 until May 2025, the Principal Security Engineer (the "PSE-1") that served in this role had more than 18 years of experience in various information technology, cybersecurity and systems engineering roles. PSE-1's previous experience includes building and leading cybersecurity functions at large enterprises, startups, and research and development centers, as well as leading software teams which were acquired by Fortune 50 enterprises. PSE-1 also had expertise in building and designing secure software, scalable and resilient systems, incident response practices, privacy programs and other critical security disciplines and practice areas. The Principal Security Engineer holds a master's degree in physics and systems engineering. Since May 2025, the Company's Manager of IT ("PSE-2") has assumed the responsibilities of the Principal Security Engineer role. With more than 18 years of experience in information technology and over 12 years in IT management across technology-driven and interactive entertainment organizations, PSE-2 has frequently led both IT operations and cybersecurity initiatives, often as the sole technical lead. Responsibilities have included securing infrastructure, implementing security controls, and supporting secure business operations.

companyName: Skillz Inc.

ticker: SKLZ

secItem: Item 1C


text: To ensure robust oversight, we are establishing a Security Council, led by our Principal Security Engineer, that is comprised of senior leaders, including our Chief Executive Officer, Controller, Chief Financial Officer, and Interim General Counsel. The Security Council has primary management oversight responsibility for assessing and managing risks related to information security, fraud, vendor oversight, data protection and privacy, and our cybersecurity program, as well as responsibility for management of our information security systems.


text: The Board is responsible for overseeing the Company's enterprise risk. The Security Council reports to the Board on cybersecurity risks. In addition to our ongoing ordinary course cybersecurity oversight procedures, we also have a security incident response framework in place. We use this incident response framework as part of the process we employ to keep our management and the Board informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. The framework is a set of coordinated procedures and tasks that our incident response team, under the direction of the Security Council, executes in the event of a cybersecurity incident that is designed to provide timely and accurate information flow, escalation for remediation and consideration of public disclosures, and resolution of cybersecurity incidents. Our cybersecurity framework includes periodic compliance assessments with our policies and standards and applicable state and federal statutes and regulations. In addition, we seek to validate compliance with our internal data security controls through the use of security monitoring utilities and internal and external audits. We also conduct annual cybersecurity tabletop exercises, with the intent of validating our IR policies and procedures.


text: Risk management and strategy We have implemented and maintain information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, and our critical data, including intellectual property and confidential information that is proprietary, strategic, or competitive in nature ("Information Systems and Data").

companyName: Origin Materials, Inc.

ticker: ORGN


text: The Director of IT and General Counsel are responsible for helping to identify, assess and manage the Company's cybersecurity threats and risks by monitoring and evaluating our threat environment using, among other things, manual processes, automated tools, internal audits, threat and vulnerability assessments, evaluating threats reported to us, evaluating our and our industry's risk profile, and subscribing to reports and services that identify cybersecurity threats.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards, and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data. These include, for example, an incident response plan and team, data encryption, risk assessments, network security and access controls, physical security, asset management, tracking, and disposal, systems monitoring, employee training including tabletop exercises and other simulated cybersecurity threats, and cybersecurity insurance. In addition, to oversee and identify any risks associated with our use of third-party service providers, we review Service Organization Controls ("SOC") reports of such third-party service providers when onboarding the provider and annually thereafter. We also maintain proper essential information sharing and access controls, aiding in the secure exchange of information between us and our third-party service providers.


text: Assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, the Director of IT coordinates with our General Counsel and representatives of the Company's departments and teams to evaluate the Company's risk profile and identify and mitigate cybersecurity threats. Our General Counsel evaluates material risks from cybersecurity threats and reports to both the Company's executive management team and the Audit Committee of the Board of Directors. We also use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example cybersecurity consultants, data backup and recovery providers, cyber insurers, and legal counsel.


text: Our Board of Directors addresses the Company's cybersecurity risk management as part of its general oversight function and has delegated to the Audit Committee primary responsibility for monitoring the Company's cybersecurity risk management processes, including mitigation of cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of the Company's management. In particular, the Director of IT and General Counsel are responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel, helping prepare for cybersecurity incidents, approving cybersecurity processes and technologies, and reviewing security assessments and other security-related reports. In addition, the General Counsel provides regular reports to the Audit Committee concerning the Company's cybersecurity posture and significant threats and risks and the processes to address them.


text: Our security incident response plan ("SIRP") is designed to escalate certain cybersecurity incidents to members of the Company's executive management team depending on the circumstances. The General Counsel, Director of IT, and relevant department heads work with our incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. The SIRP provides for escalation of potentially material cybersecurity incidents to the Audit Committee.


text: Our VP of Technology and Director of IT, together with our managed service provider ("MSP"), are responsible for helping to identify, assess and manage the Company's cybersecurity threats and risks by monitoring and evaluating our threat environment using, among other things, manual processes, automated tools, internal audits, threat and vulnerability assessments, evaluating threats reported to us, evaluating our and our industry's risk profile, and subscribing to reports and services that identify cybersecurity threats.


text: Assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, the Director of IT coordinates with our VP of Technology and representatives of the Company's departments and teams to evaluate the Company's risk profile and identify and mitigate cybersecurity threats. Our General Counsel evaluates material risks from cybersecurity threats and reports to both the Company's executive management team and the Audit Committee of the Board of Directors. We also use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example cybersecurity consultants, data backup and recovery providers, cyber insurers, and legal counsel.


text: Our Board of Directors (the "Board") addresses the Company's cybersecurity risk management as part of its general oversight function and has delegated to the Audit Committee primary responsibility for monitoring the Company's cybersecurity risk management processes, including mitigation of cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of the Company's management. In particular, the VP of Technology and Director of IT are responsible for hiring appropriate personnel and helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel, helping prepare for cybersecurity incidents, approving cybersecurity processes and technologies, and reviewing security assessments and other security-related reports. In addition, the General Counsel provides regular reports to the Audit Committee concerning the Company's cybersecurity posture and significant threats and risks and the processes to address them.


text: Our security incident response plan ("SIRP") is designed to escalate certain cybersecurity incidents to members of the Company's executive management team depending on the circumstances. Our VP of Technology, Director of IT, General Counsel, and MSP, along with relevant department heads, work with our incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. The SIRP provides for escalation of potentially material cybersecurity incidents to the Audit Committee.


text: Risk Management and Strategy We have a dedicated team focused on cybersecurity and we maintain a cybersecurity program designed to protect our systems, technology infrastructure, operations and the data entrusted to us by our employees and counterparties. Our cybersecurity program is led by our Chief Technology Officer, who is a part of our senior leadership team and works closely with our team to develop and advance our cybersecurity strategy and regularly reports to our board of directors and the audit committee of our board of directors on cybersecurity matters.

companyName: Royalty Pharma plc

ticker: RPRX


text: Cybersecurity threats are assessed as part of our enterprise risk management assessments. Our cybersecurity strategy includes procedures for identifying material cybersecurity risks, prioritizing risks and analyzing risk mitigation. Our cybersecurity strategy also includes developing and implementing policies and procedures, escalating any issues as necessary that present a material risk and ensuring that all employees have sufficient cybersecurity training. We have engaged consultants and other third parties in connection with our enterprise risk management assessments, including with respect to cybersecurity.


text: We conduct regular testing to identify vulnerabilities before they can be exploited by attackers. We examine and validate our program with third parties, measuring it against industry standards and established frameworks to help identify areas for focus, improvement and compliance. We have comprehensive plans to ensure that any non-routine events are properly escalated. These plans are validated through cyber incident exercises to consider the types of decisions that would need to be made in the event of a cyber incident. We have engaged in scenario planning exercises around cyber incidents with cybersecurity consultants in this process.


text: Our security awareness platform aims to reduce vulnerabilities in our systems if they are the target of phishing or social engineering through simulations of attacks coupled with employee training. We assess third party vendors who have access to our data or systems to measure their adherence to relevant industry practices and standards, including due diligence and monitoring compliance with security assessments.


text: In 2023, we did not identify any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. Despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurance that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors—Cybersecurity vulnerabilities or other failures in information systems could result in information theft, data corruption and significant disruption of our business operations."


text: The board of directors has adopted a Cyber Security and Personal Data Breach Policy in order to reflect the importance of appropriate security, processes and procedures to the protection of data and assets, and in an effort to establish a foundation for successful protection against cyber-crime and to minimize any potential negative impacts of a successful cyber-attack. Our cybersecurity program is overseen by our Chief Technology Officer who reports directly to our Chief Executive Officer and periodically briefs the audit committee and the board of directors on our cybersecurity program and cybersecurity issues. Our Chief Technology Officer has over 25 years of professional experience in various roles across multiple industries involving leading strategic technology initiatives. Several of our directors have experience with managing and mitigating cybersecurity and technology risks, which provides our board of directors with insight into such risks and aid in overseeing our information security, operations and systems, as well as our continuing investment in and development of our cybersecurity program. The board of directors receives updates or training, as necessary, on cybersecurity issues from management, experts and legal advisors, as required. The audit committee is responsible for overseeing our enterprise risk management program, which includes consideration of technology and cybersecurity risks. The audit committee receives updates about the results of assessments conducted by outside advisors who provide independent assessments of our technology systems.


text: In 2024 and 2023, we did not identify any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. Despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurance that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors—Cybersecurity vulnerabilities or other failures in information systems could result in information theft, data corruption and significant disruption of our business operations."


text: Our Board of Directors considers cybersecurity risk to be an important potential risk to our business. The Board of Directors has delegated to the Audit Committee oversight of cybersecurity and other information technology risks affecting the Company. The Audit Committee periodically evaluates our cybersecurity strategy to ensure its effectiveness. Management provides regular reports to the Audit Committee and the Board of Directors regarding cybersecurity and other information technology risks.

companyName: Mission Produce, Inc.

ticker: AVO


text: Our Chief Information Officer oversees our information security program. His teams are responsible for leading enterprise-wide cyber resilience strategy, policy, standards, architecture, and processes. We devote significant resources to protecting and continuing to improve the security of our computer systems, software, networks, and other technology assets. Our security efforts are designed to preserve the confidentiality, integrity, and continued availability of all information owned by, or in the care of, the Company and protect against, among other things, cybersecurity attacks by unauthorized parties attempting to obtain access to confidential information, destroy data, disrupt, or degrade service, sabotage systems, or cause other damage. Our information security program is integrated into our overall enterprise risk management program and shares common reporting channels and governance processes that apply to other legal, compliance, strategic, operational, and financial risk areas.


text: We identify and address information security risks by employing a defense-in-depth methodology that provides multiple, redundant defensive measures and prescribes actions to take in case a security control fails or a vulnerability is exploited. We leverage internal resources, along with strategic external partnerships, to mitigate cybersecurity threats to the Company. We have partnerships for Security Operations Center (SOC) services and various third-party assessments. We deploy both commercially available solutions and proprietary systems to manage threats to our information technology environment actively.


text: Certain of our information technology applications are externally audited as part of our Sarbanes-Oxley audit program and our controls include information security standards. We design and assess our information security program based on the National Institute of Standards and Technology Cyber Security Framework (NIST CSF). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. We regularly engage appropriate external resources regarding emerging threats to navigate the diverse cybersecurity landscape. In addition to ensuring adequate safeguards are in place to minimize the chance of a successful cyber-attack, the Company has established well-defined response procedures to effectively address cyber events that may occur despite these robust safeguards. These response procedures are designed to identify, analyze, contain, and remediate such cyber incidents to ensure a timely, consistent, and compliant response to actual or attempted data incidents impacting the Company. The Company devotes appropriate resources and enlists partners to adapt to the evolving threat landscape.


text: The Company takes data protection seriously and ensures employees understand their role in keeping the Company safe from cyber-attacks. We employ a robust information security and training program for our employees, including mandatory computer-based training, regular internal communications, and ongoing end-user testing to measure the effectiveness of our information security program. As part of this commitment, we require our employees to complete a Cybersecurity Awareness eCourse and acknowledge our Information Security policies. In addition, we have an established schedule and process for regular phishing awareness campaigns that are designed to emulate real-world contemporary threats and provide immediate feedback (and, if necessary, additional training or remedial action) to employees.


text: We have experienced no material information security breaches in the last three years. As such, we have not spent any material amount of capital on addressing information security breaches in the last three years, nor have we incurred any material expenses from penalties and settlements related to a material breach during this same time. We also carry third-party cybersecurity insurance.


text: Our Board of Directors addresses the Company's cybersecurity risk management as part of its general oversight function. The Board of Directors has delegated to the Audit Committee oversight of cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats, and management provides regular reports to the Audit Committee and the Board of Directors regarding cybersecurity and other information technology risks and the processes the Company has implemented to address them.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Chief Information Officer (CIO), who has 30 years of information technology experience and 15 years of cybersecurity experience, who oversees our information security program and is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Our Chief Financial Officer and other executive officers are responsible for setting budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Risk management and strategy Our Information Technology and Information Security teams, led by our CIO, are responsible for leading enterprise-wide cyber resilience strategy, policy, standards, architecture, and processes and helps identify, assess and manage the Company's cybersecurity threats and risks, including through the use of the Company's risk register. We have implemented and maintain various technical, physical, and organizational measures, processes, standards, and policies designed to protect and continue to improve the security of our computer systems, software, networks, and other technology assets. Our security efforts are designed to preserve the confidentiality, integrity, and continued availability of the critical information owned by, or in the care of, the Company, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and customer and business partner data, and protect against, among other things, cybersecurity attacks by unauthorized parties attempting to obtain access to confidential information, destroy data, disrupt, or degrade service, sabotage systems, or cause other damage. Our information security program is integrated into our overall enterprise risk management program and shares common reporting channels and governance processes that apply to other legal, compliance, strategic, operational, and financial risk areas.


text: Depending on the environment, systems, and data, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our information systems and critical data, including, for example, an incident response plan, incident detection and response processes, disaster recovery plans, risk assessments, encryption of certain data, network security controls, access controls, physical security, systems monitoring, penetration testing, cybersecurity insurance, vendor risk management processes, and employee training, and employment of a defense-in-depth methodology. We leverage internal resources, along with strategic external partnerships, to mitigate cybersecurity threats to the Company. We have partnerships for Security Operations Center (SOC) services and various third-party assessments of our cybersecurity practices. We deploy both commercially available solutions, such as firewall and antivirus software, and proprietary systems to manage threats to our information technology environment actively.


text: Certain of our information technology applications are externally audited as part of our Sarbanes-Oxley audit program and our controls include information security standards. We regularly engage appropriate external resources regarding emerging threats to navigate the diverse cybersecurity landscape.


text: The Company has established well-defined response procedures to effectively address cyber events that may occur despite these robust safeguards. These response procedures are designed to identify, analyze, contain, and remediate such cyber incidents to ensure a timely, consistent, and compliant response to actual or attempted data incidents impacting the Company. Further, we also carry third-party cybersecurity insurance.


text: We employ an information security and training program for our employees, including mandatory computer-based training, regular internal communications, and ongoing end-user testing to measure the effectiveness of our information security program. As part of this commitment, we require our employees to complete a Cybersecurity Awareness eCourse and acknowledge our Information Security policies. In addition, we have an established schedule and process for regular phishing awareness campaigns that are designed to emulate real-world contemporary threats and provide immediate feedback (and, if necessary, additional training or remedial action) to employees.


text: We use third-party service providers to perform a variety of functions throughout our business, including software and cloud data service providers, for certain areas of our business, including sourcing/procurement, supply chain, manufacturing, distribution, information technology support services and administrative functions (such as payroll processing, health and benefit plan administration and certain finance and accounting functions). We have vendor management processes to manage cybersecurity risks associated with our use of certain of these providers. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "System security risks, data protection breaches, cyber-attacks (including artificial intelligence (AI)-enabled threats), AI-related operational errors, and systems integration issues could disrupt our internal operations or services provided to customers, and any such disruption could reduce our expected revenue, increase our expenses, damage our reputation and adversely affect our stock price."


text: As a global technology and services leader, our business is heavily dependent upon information technology networks and systems. Protecting our systems, data, and information, as well as the information and data of our game-changers, clients, and partners, is a key priority.

companyName: Concentrix Corp

ticker: CNXC


text: We have established and maintain a corporate-wide information security management system and an integrated risk management framework with practices that are derived from industry standards, including ISO 31000, ISO 27001, HITRUST, PCI DSS, and the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, and data privacy regulations, including the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") and the General Data Protection Regulation ("GDPR"). The data security controls from these standards and regulations are evaluated as a component of our risk management framework, based on the needs of our business and our clients, the nature of our industry, and applicable regulations.


text: Risk Management and Strategy We have implemented and maintain an Information Security Management System ("ISMS") that covers information security, data protection, cybersecurity, application security, and other areas as necessary. As a part of our ISMS, we evaluate our security risk strategy on an ongoing basis to facilitate our response to the changing cybersecurity threat landscape and build a culture of security within Concentrix, we allocate and evaluate available resources, including technology, infrastructure, and personnel, to support information security initiatives, we regularly identify security risks and prepare and continuously update mitigation and response plans, including with respect to risks related to the use of our third party service providers, we report, investigate, and respond to suspected or confirmed information security risks, and we maintain a business continuity management process to counter potential interruptions to business activities and a data privacy program to protect personal and sensitive information. We regularly evaluate the ISMS for compliance with applicable regulatory, legislative, and contractual requirements, as well as recent trends and developments in security.


text: Our management team gathers information to support our efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents from various sources, including reports from internal security personnel, threat intelligence, and other information obtained from governmental, public, or private sources, including external consultants engaged by us, and alerts and reports produced by the information security tools we utilize. Our Cyber Defense Operations Center (the "CDOC") is a security operations center that operates 24 hours a day, seven days a week and is our first line of defense against cybersecurity threats. The CDOC continually monitors our information technology security infrastructure for anomalous behavior and other indications of potential threats to protect our data and systems.


text: We regularly conduct internal and external audits, reviews, assessments, and evaluations to evaluate our compliance posture and the effectiveness of our physical, technical, and organizational measures for protecting us and our systems. Elements of our cybersecurity program are also periodically audited as part of external certification audits. Third-party managed security providers and cybersecurity experts provide us with 24x7 monitoring, threat hunting, risk assessments, penetration testing, and attack surface management to support our Cyber Security Framework. Key findings from cybersecurity audits and third-party risk assessments are summarized and communicated to our senior leadership and the Audit Committee, and remediation actions are implemented to enhance our overall cybersecurity program. We contractually require our vendors to comply with cybersecurity and data privacy requirements, and we perform risk assessments of vendors, including their ability to protect data from unauthorized access.


text: To facilitate the success of our risk management framework, multidisciplinary teams throughout the Company, including members of the legal department, operations, and senior management, are deployed to support risk mitigation and our response to threats and potential cybersecurity incidents. We also regularly conduct training and education to upgrade our game-changers' knowledge of security risks and vulnerabilities. In fiscal year 2024, our game-changers completed mandatory security awareness training, resulting in a company-wide pass percentage of 95%. In August 2024, we held a Cyber and Fraud Awareness Month, which promoted best practices and vigilance in protecting information and data to prevent cyber-attacks, and educated game-changers on how to report phishing or suspicious messages through a dedicated reporting channel.


text: We are currently not aware of any cybersecurity incidents or threats that have materially impacted us or our business, financial condition, and results of operations. However, we and our clients routinely face risks of cybersecurity incidents, and there can be no assurance that our security efforts and measures, and those of our third-party providers, will prevent or mitigate a cybersecurity threat or incident that could adversely affect our business. For a discussion of these risks and others that we face, see "Risk Factors" in this Annual Report on Form 10-K.


text: Our board of directors, directly and indirectly through its committees, has oversight responsibility for our risk management process, including risks related to cybersecurity. Our board of directors has delegated to the Audit Committee oversight responsibility for the Company's risk assessment and management activities, including with respect to information technology, cybersecurity, and privacy.


text: As part of our integrated enterprise risk management program, management reports periodically to the Audit Committee on its assessment of our risks and risk management practices, including with respect to ongoing or new cyber and information security risks. Management also reports quarterly to the Audit Committee and annually to the full board of directors on the status of our cybersecurity program, which includes key cybersecurity controls, audits, and compliance, and on any significant projects or areas of focus for the cybersecurity team.


text: Our cybersecurity risk management framework is implemented by our global security team, which is led by our EVP, Information Technology and Global Security, our SVP, Information Systems and Global Security, and our GVP, Governance, Risk, and Compliance. As the leaders of our global security efforts, these roles and their teams support the establishment and maintenance of our corporate-wide information security program to protect our information assets and to oversee our cybersecurity and insider risk and compliance teams. Our SVP, Information Systems and Global Security, and our GVP, Governance, Risk, and Compliance report to our EVP, Information Technology and Global Security, and our EVP, Information Technology and Global Security reports to our Chief Executive Officer.


text: Our EVP, Information Technology and Global Security has over 40 years of global information technology leadership experience, including hands-on management and technology innovation experience. He provides strategic direction for the design, implementation strategy, and Governance of Concentrix Global Infrastructure, Information Security and Application development. Our SVP, Information Systems and Global Security has an undergraduate degree in Information Technology and over 24 years of global experience in cybersecurity strategy and risk management in various leadership roles at large companies and within government, with extensive experience in the development of and enforcement of security policies, protection of sensitive data, responding to cyber and fraud incidents, and integrating security across operations. Our SVP, IT Infrastructure has over 29 years of experience in managing a large, geographically dispersed team that designs, plans, implements, and maintains a complex IT infrastructure and operations. He has also played a critical role in the development of security technologies at Concentrix. Our GVP, Governance, Risk, and Compliance has over 22 years of global experience in information security with specialization in risk management, security tools and technologies, compliance, and privacy. His experience in information security spans advisory and consulting, policy, processes and standards, engineering, and operational support for clients and the internal organization.


text: We take a holistic, multi-layered approach to management and oversight of cybersecurity risks. Our board of directors has ultimate oversight responsibility but has delegated to the board's Care, Compliance, & Cybersecurity Committee focused and pertinent oversight duties, which have been integrated into our overall enterprise risk management program, as described below. Our Chief Information Officer provides quarterly reports on our cybersecurity program to the Care, Compliance, & Cybersecurity Committee. These reports include details and metrics on, among other things, our routine vulnerability assessments, internal and external threat intelligence, company-wide phishing exercises and training, device encryption, device patching, routine resilience efforts including quarterly disaster recovery exercises, tabletop incident response and business continuity exercises. The chairperson of the Care, Compliance, & Cybersecurity Committee briefs the full board of directors on such quarterly reports.

companyName: Enhabit, Inc.

ticker: EHAB


text: The Chief Information Officer and our Chief Information Security Officer also serve on management's Enterprise Risk Committee, along with our executive management team, the Chief Compliance Officer, and internal audit personnel. The Enterprise Risk Committee meets regularly during the year to assess various significant risks—including cybersecurity risks—and receives cybersecurity updates in connection with those assessments and the development and implementation of any risk mitigation plans. Our President and Chief Executive Officer presents the report of the Enterprise Risk Committee quarterly to the full board of directors.


text: We also maintain an inter-departmental privacy and security committee which oversees programs and initiatives to protect and secure patient information as well as our data and information systems. This committee reports to our executive management team and has responsibility for our IT-security incident response plan and various training and awareness programs that promote patient privacy and system security practices by employees.


text: We have structured our cybersecurity program around the National Institute of Standards and Technology ("NIST") Cybersecurity Framework as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. Our cybersecurity strategy focuses on implementing effective and efficient controls, technologies, and processes to assess, identify and manage cybersecurity risks. Key components of our strategy include annual and ongoing security awareness training for employees, advanced detection and monitoring systems, and robust incident response and containment. We actively monitor and investigate both internally discovered and externally reported issues that may compromise our information systems, permitting quick and decisive action when necessary. We also have engaged third-party service providers and have implemented cybersecurity risk management protocols for such parties. For example, all vendors are required to complete our Ongoing Monitoring Assessment Questionnaire, which helps monitor each vendor's continuing compliance, and we subject our technology vendors to a separate vetting and approval process formally assessing each vendor from a cybersecurity perspective.


text: Our Chief Information Security Officer, who reports to our Chief Information Officer, brings to bear more than two decades of experience implementing NIST cybersecurity frameworks, including most recently five years as chief information security officer for a Fortune 200 company. He also holds multiple certifications including the globally recognized Certificate Information Systems Security Professional designation since 2006. The Chief Information Security Officer leads a dedicated team of internal IT employees, along with multiple long-term third-party security vendors. Our board of directors, and the Care, Compliance, & Cybersecurity Committee of the board, supports our Chief Information Officer and Chief Information Security Officer by leveraging members' experience with information technology and management, including information technology strategy and risks associated with cybersecurity matters, as part of its oversight function.


text: Our policies and procedures concerning cybersecurity matters apply to all employees. These policies and procedures address encryption standards, antivirus protection, remote access, multi-factor authentication, confidential information, and the use of the internet, social media, email and wireless devices.


text: We have experienced threats to our data and systems, including malware and computer virus attacks from time to time. To our knowledge, these threats have not materially affected us, our business, financial position, results of operations or cash flows to date. For more information about the cybersecurity risks we face, see Item 1A, "Risk Factors—Other Operational and Financial Risks."


text: Risk Management and Strategy We regularly assess risks from cybersecurity threats; monitor our information systems for potential vulnerabilities; and test those systems pursuant to our cybersecurity policies, processes, and practices, which are integrated into our overall risk management program. To protect our information systems from cybersecurity threats, we use various security tools that are designed to help identify, escalate, investigate, resolve, and recover from security incidents in a timely manner. Our Technology Risk Management Committee, which is comprised of representatives from our business operations and support functions (e.g., legal, finance, internal audit, commercial, privacy), assesses risks based on probability and potential impact to key business systems and processes. Risks that are considered high are incorporated into our overall risk management program. A mitigation plan is developed for each identified high risk, with progress reported to the Technology Risk Management Committee and tracked as part of our overall risk management program overseen by the Audit Committee of our board of directors.

companyName: REGENERON PHARMACEUTICALS, INC.

ticker: REGN


text: Cybersecurity threats, including those resulting from any previous cybersecurity incidents, have not materially affected our Company, including our business strategy, results of operations, or financial condition. We do not believe that cybersecurity threats resulting from any previous cybersecurity incidents of which we are aware are reasonably likely to materially affect our Company. Refer to the risk factor captioned "Significant disruptions of information technology systems or breaches of data security could adversely affect our business" in Part I, Item 1A. "Risk Factors" for additional description of cybersecurity risks and potential related impacts on our Company.


text: Our board of directors oversees our risk management process, including as it pertains to cybersecurity risks, directly and through its committees. The Audit Committee of the board oversees our risk management program, which focuses on the most significant risks we face in the short-, intermediate-, and long-term timeframe. Audit Committee meetings include discussions of specific risk areas throughout the year, including, among others, those relating to cybersecurity threats, and reports from the Chief Audit Executive on our enterprise risk profile on an annual basis. The Audit Committee reviews our cybersecurity risk profile with management on a periodic basis using key performance and/or risk indicators. These key performance indicators are metrics and measurements designed to assess the effectiveness of our cybersecurity program in the prevention, detection, mitigation, and remediation of cybersecurity incidents.


text: We take a risk-based approach to cybersecurity and have implemented cybersecurity policies throughout our operations that are designed to address cybersecurity threats and incidents. The Company's Chief Information Security Officer ("CISO"), in coordination with the Chief Information Officer and the Technology Risk Management Committee, is responsible for the establishment and maintenance of our cybersecurity program, as well as the assessment and management of cybersecurity risks. The current CISO has over 35 years of experience in information security and possesses the requisite education, skills, experience, and industry certifications expected of an individual assigned to these duties. The CISO provides periodic updates on our cybersecurity risk profile to management's Technology Risk Management Committee, the Audit Committee of our board of directors, and the Audit Committee chair.


text: Risk Management and Strategy We regularly assess risks from cybersecurity threats; monitor our information systems for potential vulnerabilities; and test those systems pursuant to our cybersecurity policies, processes, and practices, which are integrated into our overall risk management program. To protect our information systems from cybersecurity threats, we use various security tools that are designed to help identify, escalate, investigate, resolve, and recover from security incidents in a timely manner. Our Technology Risk Management Committee, which is comprised of representatives from our business operations and support functions (e.g., legal, finance, internal audit, commercial, privacy), assesses cybersecurity risks based on probability and potential impact to key business systems and processes. Cybersecurity risks that are considered high are incorporated into our overall risk management program. A mitigation plan is developed for each identified high risk, with progress on risk mitigation reported to the Technology Risk Management Committee and tracked as part of our overall risk management program, which is overseen by the Audit Committee of our board of directors.


text: We collaborate with third parties to assess the effectiveness of our cybersecurity prevention and response systems and processes. These include cybersecurity assessors, consultants, and other external cybersecurity experts to assist in the identification, verification, and validation of cybersecurity risks, as well as to support associated mitigation plans when necessary. We have also developed a process to conduct due diligence on third parties with which we work to oversee and identify material risks from cybersecurity threats associated with our use of those third parties' services, including those that perform cybersecurity services.


text: To date, the Company is not aware of risks from cybersecurity threats, including those resulting from any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition. Refer to the risk factor captioned "Significant disruptions of information technology systems or breaches of data security could adversely affect our business" in Part I, Item 1A. "Risk Factors" for additional information regarding cybersecurity risks and potential related impacts on our Company.


text: We take a risk-based approach to cybersecurity and have implemented cybersecurity policies throughout our operations that are designed to address cybersecurity threats and incidents. The Company's Chief Information Security Officer ("CISO"), in coordination with the Chief Information Officer and the Technology Risk Management Committee, is responsible for the establishment and maintenance of our cybersecurity program, as well as the assessment and management of cybersecurity risks. The current CISO has over 35 years of experience in technology and information security, including operating in the role of the CISO for several large companies in the pharmaceutical and healthcare industries, and possesses the requisite education, skills, experience, and industry certifications expected of an individual assigned to these duties. The CISO provides periodic updates on our cybersecurity risk profile to management's Technology Risk Management Committee and the Audit Committee of our board of directors.


text: Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program is integrated into our broader Information Security Management System ("ISMS"), which is designed to identify, assess, prioritize, and mitigate risks across the organization and to enhance our resilience and support the achievement of our strategic security objectives. Our cybersecurity risk management program includes a cybersecurity incident response plan. The audit committee of our board of directors oversees enterprise risk management as an integral and continuous part of its oversight role. Integrated into our overall enterprise risk management framework are processes dedicated to the identification, assessment and management of material risks from cybersecurity threats. Our approach to cybersecurity risk management is both proactive and defensive, and includes the following elements: • a team dedicated solely to cybersecurity and managed by our interim chief security officer ("CSO"), who reports directly to our Chief Product Officer. The interim CSO and his team are responsible for leading enterprise-wide cybersecurity strategy, policies, standards, architecture and processes. Our interim CSO has over 25 years of information technology ("IT") and cybersecurity, including the cybersecurity architecture at 23andMe, principle cybersecurity engineering at CA Technologies, and corporate IT management, with nearly seven years in security at 23andMe. He holds industry-recognized certifications in CCSK, CCFE, and ITIL v3. • an information technology vulnerability assessment process that includes internal testing, as well as engages with outside security researchers, for identification, evaluation and management of cybersecurity risks. For example, we conduct tests to identify potential vulnerabilities, such as penetration tests, manage a bug bounty program, conduct table top and red team/purple team exercises to evaluate the effectiveness of our ISMS and cybersecurity practices. • a Security Incident Response plan pursuant to which our interim CSO and his team are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents in accordance with our defined Privacy and Security Incident Response plan, which is reviewed along with other plans relevant to our cybersecurity risk management on an annual basis. • an information technology request review process that includes cybersecurity assessments of third-party products and systems proposed to connect to our information systems environment or access our data. • a training program pursuant to which we provide staff with timely relevant security topics, which include social engineering, phishing, password protection, protecting personal data, appropriate use of assets, and • an annual certifications program by an accredited third-party auditor for compliance with ISO/IEC 27001:2013 for an ISMS, ISO/IEC 27701:2019 for a PIMS as well as the requirements and control implementation guidance within ISO/IEC 27018:2019 for cloud computing.

companyName: Chrome Holding Co.

ticker: MEHCQ


text: Cybersecurity Team and Strategy — The cybersecurity team, led by the interim CSO, is responsible for managing the day-to-day cybersecurity strategy of the organization. Including oversight of our cybersecurity tools and controls to protect company assets. We have implemented an iterative and multi-layered cybersecurity strategy that incorporates both proactive review of the evolving cybersecurity threat landscape and reactive management of cybersecurity threats. Our proactive management of cybersecurity risks includes zero trust access, data loss prevention programs, correction of potential cybersecurity risks, and programs for employee education regarding cybersecurity risks. Our reactive management of cybersecurity risks includes continuous logging and alerting, utilization of enterprise cybersecurity technology, and personnel dedicated to incident response.


text: Third-Party and Vendor Management Review Processes — We have implemented processes that establish a systematic approach to assessing the cybersecurity controls while on-boarding new third-party vendors. Additionally, we have implemented annual reviews of the cybersecurity controls for third-party vendors that provide essential services and/or store data that presents a business risk to us and/or our customers.


text: Cybersecurity Incident Response Plan — In October 2023, we experienced a cybersecurity incident in which certain information of our users was accessed and downloaded from individual 23andMe.com accounts without the account users' authorization. Following this incident, we implemented certain changes to our information systems and processes meant to provide additional protections to our environment, including enhancements to our Security Operations, reset customer passwords, required two-factor verification for new and existing customers, detection tools and capabilities, and implementation of new tools and processes, among others. However, we continue to face a heightened risk of cybersecurity threats which may materially impact our operations. For more information about our cybersecurity related risks, see "We have experienced a criminal cyber incident and could in the future experience other security breaches, disruption to our business, or reputational harm" in Part 1, Item 1A, Risk Factors of this Form 10-K.


text: Board Oversight — Our board of directors has identified the oversight of cybersecurity risks to be one of its priorities, and it receives regular reports from management, including the interim CSO, on various cybersecurity matters, including the security of the company's information systems, anticipated sources of future material cyber risks and how management is addressing any significant potential vulnerability. The board's audit committee reviews our cybersecurity program at least annually and receives regular updates on cybersecurity threats and other matters. In addition to regular updates to the audit committee, we have protocols by which we escalate certain cybersecurity incidents and, where appropriate, report on them in a timely manner to the board and the audit committee.


text: Management Oversight — We have implemented a cross functional ISMS governance committee that drives awareness and alignment across broad governance and stakeholder groups for effective cybersecurity risk management. The interim CSO and interim Data Privacy Officer ("DPO") co-chair the ISMS Governance Committee. The ISMS Governance Committee acts in alignment with the Data Protection Governance Committee, another cross-functional governance committee, which provides strategic direction and oversight over the company's program related to data protection. These governance committees have responsibility for oversight, resource allocation, capabilities and planning. Members of the ISMS committee review newly identified cybersecurity risks, evaluate the appropriate treatments, monitor the on-going status of risk remediation. The interim CSO and DPO regularly report to the audit committee on these matters.


text: At Eos, we leverage a cybersecurity model that focuses on four key areas: prevention, detection, assessment, and remediation through an array of internal and external systems, along with the expertise of third-party service providers. This model is supported internally by Eos' Information Technology Department ("ITD"), along with expertise of external cybersecurity experts. Our model is also supported through security awareness training for all employees during the onboarding process and on a regular basis thereafter.

companyName: Eos Energy Enterprises, Inc.

ticker: EOSE


text: Our Board of Directors has overall oversight responsibility for our cybersecurity model. Our overarching cybersecurity programs are under the direction of the Eos leadership team, and directly supported by the efforts of the ITD. The ITD, led by the Director of ITD, reports to the Chief Financial Officer ("CFO") of the Company. With over 7 years of experience leading cybersecurity teams and programs, our Director of ITD leverages a combination of internal and external systems and security experts to keep our CFO informed of potential risks to the organization. The Director of ITD is responsible for identifying, considering, and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and maintaining cybersecurity programs and systems. Management reports material cybersecurity risks to our Board of Directors on an annual basis. In addition, our management follows a risk-based escalation process to notify the Board of Directors outside of the regular reporting cycle when they identify an emerging risk or material issue.


text: In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see Part I, Item 1A- Risk Factors in this Annual Report on Form 10-K.


text: Our Board of Directors has overall oversight responsibility for our cybersecurity model. Our overarching cybersecurity programs are under the direction of the Eos leadership team and directly supported by the efforts of the ITD. The ITD, led by the Director of ITD, reports to the Chief Financial Officer ("CFO") of the Company. With over 8 years of experience leading cybersecurity teams and programs, our Director of ITD leverages a combination of internal and external systems and security experts to keep our CFO informed of potential risks to the organization. The Director of ITD is responsible for identifying, considering, and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and maintaining cybersecurity programs and systems. Management reports material cybersecurity risks to our Board of Directors on an annual basis. In addition, our management follows a risk-based escalation process to notify the Board of Directors outside of the regular reporting cycle when they identify an emerging risk or material issue.


text: In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see Part I, Item 1A- Risk Factors in this Annual Report on Form 10-K.


text: Cybersecurity Risk Management and Strategy Safeguarding information by securing our systems, data, and networks is a key priority for our business. Rocket Companies relies on our technology networks and systems, as well as those of certain third parties and affiliates, to collect, process, transmit and store information. We require the secure, efficient, and uninterrupted operation of those networks and systems to provide our clients with the best possible experience. With this in mind, we maintain an Information Security Program to protect the confidentiality, integrity, and availability of client information.

companyName: Rocket Companies, Inc.

ticker: RKT


text: The Rocket Companies Information Security Program ("Program") is managed by the Rocket Companies Chief Information Security Officer ("CISO"), who is responsible for the creation and execution of our information security strategy. The CISO has more than 30 years' experience managing business risk and developing and implementing information security strategy.


text: Rocket Companies aligns its Program to the National Institute of Standards (NIST) Cyber Security framework. The Program is reviewed and updated by regular risk assessments, which identify reasonable and foreseeable internal and external risks. Rocket performs ongoing assessments of its Program to measure both the sufficiency of the safeguards to control risk and the design and operating effectiveness of our security requirements and controls. We implement information security policies throughout our operations, and our enterprise risk management ("ERM") process considers information security risks alongside other company risks as part of our overall risk assessment process.


text: The Rocket Companies Vendor Risk Management Program extends our safeguards to third-party service providers. Our Vendor Risk Management Program includes a robust due diligence process to review and affirm on an initial and periodic basis that our third-party service providers protect our information with the same rigor we require of ourselves.


text: As far as internal training and compliance, we spend significant time and resources to communicate the Program to all team members via annual trainings, ongoing communications, and periodic testing of team member capabilities.


text: The CISO is charged with the continuous evolution of the Program to address emerging threats and new technologies, ensuring that we can adapt to the everchanging risk environment and those who seek to compromise our information. As such, the Program is regularly evaluated by both internal and external assessors to ensure its effectiveness by measuring its ability to prevent risk realization.


text: Cybersecurity Governance Our Board oversees our Information Security Program and cybersecurity risks, this includes receiving periodic management reports on cybersecurity and information security trends and regulatory updates, technology risks, and the implications for our business strategy.


text: On a periodic basis, the CISO provides reports and presentations to the Board, Audit Committee, and Rocket Senior Leadership, including the Rocket Risk Council. These CISO updates include recent industry developments, evolving standards, vulnerability assessments and technological trends. During 2023, the CISO updates included information regarding areas of increasing cybersecurity threats, the ongoing enhancements to our information security framework, processes to mitigate threats, and the results of a simulated cybersecurity incident tabletop exercise.


text: As of the date of this report, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect Rocket Companies. However, there is no guarantee that we will not be subject to future threats or incidents. We deploy a monitoring program to detect potential threats and keep an incident response plan in place to respond if a security incident occurs. Additional information on cybersecurity risks we face can be found in Item 1A, Risk Factors, which should be read in conjunction with the foregoing information.


text: Rocket Companies aligns its Program to the National Institute of Standards (NIST) Cyber Security framework. The Program is reviewed and updated by regular risk assessments, which identify reasonable and foreseeable internal and external risks. The Company performs ongoing assessments of its Program to measure both the sufficiency of the safeguards to control risk and the design and operating effectiveness of our security requirements and controls. We implement information security policies throughout our operations, and our enterprise risk management ("ERM") process considers information security risks alongside other company risks as part of our overall risk assessment process.


text: The Rocket Companies Vendor Risk Management Program performs initial and ongoing information security safeguards of our third-party service providers. Our Vendor Risk Management Program includes a robust due diligence process to review and affirm on an initial and periodic basis that our third-party service providers protect our information with the same rigor we require of ourselves.


text: On a periodic basis, the CISO provides reports and presentations to the board of directors, Audit Committee, and Rocket Senior Leadership, including the Rocket Risk Council. These CISO updates include recent industry developments, evolving standards, vulnerability assessments and technological trends. During 2024, the CISO updates included information regarding areas of increasing cybersecurity threats, the ongoing enhancements to our information security framework, deployment of security tools, processes to mitigate threats, and the results of a simulated cybersecurity incident tabletop exercise.


text: Cybersecurity Risk Management and Strategy We identify and assess cybersecurity risk in connection with our enterprise risk management ("ERM") process, which is directly tied to our management's strategic planning process.

companyName: Open Lending Corp

ticker: LPRO


text: We have implemented a variety of measures to assess, identify and manage material risks from cybersecurity threats. These measures include automated source code testing to help align our security infrastructure with application security best practices, and automated scanning and alerts to assess compliance against established security baselines. Our cybersecurity risk management process also includes defined timeframes for addressing vulnerabilities or other gaps identified by our automated detection and scanning tools. We also perform an annual evaluation of our alignment with the U.S. Commerce Department's National Institute of Standards and Technology framework. In addition, our Information Security team, which reports directly to our Chief Information Officer ("CIO"), performs regular internal vulnerability scans across our information technology systems, and we use an independent third-party service provider for the completion of bi-annual penetration testing to maintain our SOC II compliance.


text: Our employees are a key element of our cybersecurity and data privacy defenses. We administer mandatory and regular awareness programs for employees on cybersecurity. We require all new employees to complete security awareness training upon hire, and existing employees must complete security awareness training annually thereafter. We also conduct internal incident response tests, phishing test campaigns and other security-enhancing exercises throughout the year. In addition, we established measures to help mitigate the risk of exposure of personally identifiable information ("PII"). We have also implemented phishing protection and data loss prevention tools designed to enhance our cybersecurity throughout our information technology systems.


text: As part of our cybersecurity risk management processes, we regularly engage third-party service providers to assess our internal cybersecurity programs and compliance with applicable practices and standards.


text: Our cybersecurity risk management processes include assessing third-party risks and we regularly perform third-party risk assessments to help us identify and mitigate risks arising from our use of or partnership with third parties, such as vendors, suppliers, and other business partners. Third-party cybersecurity risks are also evaluated as part of our initial due diligence assessments upon engaging third-party providers, inclusive of potential fourth-party risks related to the handling and processing of employee, business, or customer data. In addition to due diligence procedures conducted during onboarding of new third-party providers, we perform annual risk assessments of key third-party providers, along with real-time assessments in accordance with our Incident Response Plan and procedures, as needed, to help us determine any potential impact to the Company from third-party cybersecurity incidents that come to our attention.


text: Our business necessitates the collection and storage of consumers' PII. As such, cybersecurity and data privacy are a top concern for us. As a preventative measure, we have implemented certain policies and procedures that guide our day-to-day operations in these areas.


text: To date, the Company is not aware of risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our business, business strategy, results of operations or financial condition. For additional information, see "Item 1A—Risk Factors—Risks Related to Our Business—Cyber-attacks and other security breaches could have an adverse effect on our business" and "Item 1A—Risk Factors—Risks Related to Our Business—Disruptions in the operation of our computer systems and third-party data centers could have an adverse effect on our business."


text: Cybersecurity Governance Cybersecurity is an area of focus for our Board of Directors and our management. The Audit Committee of our Board of Directors is primarily responsible for the oversight of risks from cybersecurity threats and is informed about cybersecurity risks through presentations from our CIO and our Chief Technology Officer ("CTO"), and other members of our management responsible for day-to-day management and mitigation of cybersecurity risks, as well as through its direct participation in our ERM process, which holistically addresses risks faced by us, including cybersecurity risk.


text: Our cybersecurity risk management processes are led by members of our management team, including our CIO and our CTO, who hold degrees in Management Information Systems and Computer Science, respectively, along with an average of 21 years of prior work experience in various roles involving information technology, including cybersecurity, compliance, systems, and programming. These individuals are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategic processes described above, including the operation of our Incident Response Plan. The CIO and CTO report and provide updates to the Audit Committee on risks from cybersecurity threats quarterly or as needed.


text: We have implemented a variety of measures to assess, identify and manage material risks from cybersecurity threats. These measures include automated source code testing to help align our security infrastructure with application security best practices, and automated scanning and alerts to assess compliance against established security baselines. Our cybersecurity risk management process also includes defined timeframes for addressing vulnerabilities or other gaps identified by our automated detection and scanning tools. We also perform an annual evaluation of our alignment with the U.S. Commerce Department's National Institute of Standards and Technology framework. In addition, our Information Security team performs regular internal vulnerability scans across our information technology systems, and we use an independent third-party service provider for the completion of bi-annual penetration testing to maintain our SOC II compliance.


text: Cybersecurity Governance Cybersecurity is an area of focus for our Board of Directors and our management. The Audit Committee of our Board of Directors is primarily responsible for the oversight of risks from cybersecurity threats and is informed about cybersecurity risks through presentations from members of our management responsible for day-to-day management and mitigation of cybersecurity risks, as well as through its direct participation in our ERM process, which holistically addresses risks faced by us, including cybersecurity risk.


text: Our cybersecurity risk management processes are led by members of our management team, who are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through management of, and participation in, the cybersecurity risk management and strategic processes described above, including the operation of our Incident Response Plan. Our management team reports and provides updates to the Audit Committee on risks from cybersecurity threats quarterly or as needed.


text: Cybersecurity Processes and Risk Assessment We rely on the cybersecurity program implemented by Blue Owl, the indirect affiliate of our Adviser. Blue Owl has implemented a cybersecurity program, which is focused on (i) protecting the confidentiality of business, client, investors in its funds and its employee information; (ii) maintaining the security and availability of its systems and data; (iii) supporting compliance with applicable laws and regulations; (iv) documenting cybersecurity incidents and its responses; and (v) notification of cybersecurity incidents to, and communications with, appropriate internal and external parties.

companyName: Blue Owl Capital Corp III


text: GoHealth's services involve the collection, processing, use, storage and transmission of confidential and personal information of consumers and employees. Maintaining the integrity, confidentiality and availability of this information as well as the information technology systems in which the information resides is critical to the Company's operations and business strategy.

companyName: GoHealth, Inc.

ticker: GOCO


text: The Company takes a comprehensive, cross-functional approach to developing strategies for identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents. The Company maintains a business continuity and disaster recovery plan as well as a cybersecurity insurance policy.


text: Risk Management and Strategy Cybersecurity risk management is integrated into the Company's broader enterprise risk management ("ERM") program. The ERM program, led by the Company's Internal Audit and Legal teams, consolidates the collective input of executive management to prioritize enterprise-level risks, develop risk mitigation initiatives and establish monitoring functions. The Internal Audit and Legal teams perform an enterprise risk assessment annually and present the results to the Audit Committee of the Board of Directors. Further, our Chief Technology Officer ("CTO") and Chief Information Security Officer ("CISO") actively participate in the ERM program, including through diligence conducted as part of the broader ERM program.


text: Our CISO, who reports to our CTO, leads the cybersecurity program, strategy, policy, standards and processes. Our CISO has over a decade of experience working in information technology and security and earned a Certified Information Security Manager (CISM) certification. Our CTO has over twenty-five years of experience working in engineering and technology. The CISO is supported by a cybersecurity team comprised of experienced information security professionals. The CISO provides the CTO with bi-weekly updates on security and compliance risks and initiatives. Each quarter, the CTO presents a cyber risk and incident review to GoHealth's internal Compliance Committee, comprised of cross-functional senior leadership members including C-suite level executives and personnel from the Legal, Compliance and Internal Audit teams.


text: The Company's cybersecurity risk management program is based on industry standards and best practices and aligns with the Center for Internet Security and National Institute of Standards and Technology ("NIST") cybersecurity frameworks. On an annual basis, GoHealth engages a third-party vendor to assess the maturity of its cybersecurity processes, which assigns the Company an NIST Cyber-Security Framework implementation tier score upon completion of the assessment. A third-party vendor is also currently conducting a qualitative assessment of GoHealth's cybersecurity controls, policies and programs, the output of which will be a comprehensive report issued to the Company.


text: GoHealth engages with a range of additional third-party cybersecurity service providers, assessors and auditors to evaluate and enhance the effectiveness of its cybersecurity program. Services provided by these third parties include endpoint and network monitoring, vulnerability scanning, penetration testing and security and compliance posture assessments. To mitigate risks associated with third-party sources, the Company requires third parties with access to personal, confidential or proprietary information to implement and maintain cybersecurity practices consistent with applicable legal standards and industry best practices and to enter into business associate agreements containing contractual provisions with respect to the handling of such information. GoHealth also conducts information security assessments of these third parties prior to engaging with them.


text: The Company has established cybersecurity and information security awareness training programs. Formal training on topics relating to the Company's cybersecurity, data privacy and information security policies and procedures is mandatory at least annually for all employees and contractors with access to the Company's network. In addition to the annual security training requirement, employees participate in monthly phishing tests, and where appropriate, additional security awareness follow-up training in response to such tests. Training is supplemented through periodic Company communications encouraging all employees and contractors to promptly report security events, incidents and abnormal system behavior.


text: As of the date of this 2023 Annual Report on Form 10-K, the Company is not aware of any material risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected the Company, its business strategy, results of operations or financial condition; however, we cannot provide assurance that these threats will not result in such an impact in the future, as discussed in the risk factors entitled "Risks Related to Our Business" and "Risks Related to Our Intellectual Property and Technology" in Part I, Item 1A. of this 2023 Annual Report on Form 10-K.


text: The Board of Directors recognizes the importance of cybersecurity in safeguarding the Company's sensitive data. The Board of Directors is responsible for overseeing overall risk management for the Company, including review and approval of the ERM approach and processes implemented by management to identify, assess, manage and mitigate risk. The Audit Committee is central to the Board of Director's oversight of cybersecurity risks and bears the primary responsibility for assessing and managing the Company's material risks from cybersecurity threats.


text: Cybersecurity risk oversight is also a key area of focus for management. As discussed above, the CISO is the primary management team member responsible for the cybersecurity program, strategy, policy, standards and processes. On a quarterly basis, or more frequently if a need arises, the CTO and CISO present a briefing to the Audit Committee regarding the Company's cybersecurity program. The presented topics include, but are not limited to, the status of ongoing cybersecurity initiatives, incident reports and compliance with industry standards. Potentially material cybersecurity matters are escalated to the Audit Committee and/or the full Board of Directors, as appropriate, for risk oversight.


text: Risk Management and Strategy Cybersecurity risk management is integrated into the Company's broader enterprise risk management ("ERM") program. The ERM program, led by the Company's Internal Audit and Legal teams, consolidates the collective input of executive management to prioritize enterprise-level risks, develop risk mitigation initiatives and establish monitoring functions. The cybersecurity program includes the development of a structured control framework and risk taxonomy that aligns with anticipated business risk. The Internal Audit and Legal teams perform an enterprise risk assessment annually and present the results to the Audit Committee of the Board of Directors. Further, our Chief Technology Officer ("CTO") actively participates in the ERM program, including through diligence conducted as part of the broader ERM program.


text: Our CTO has direct responsibility for cybersecurity and overseeing the Company's cybersecurity strategy, policies, standards and processes. Our CTO has more than 25 years of experience developing user-centric consumer marketplaces and artificial intelligence products and has held various leadership roles in product development, product design and data science. The CTO is supported by two senior risk, compliance, and security leaders who engage regularly with the CTO to manage cybersecurity and compliance risks. Additionally, the Company's cybersecurity team is comprised of experienced information security professionals dedicated to protecting the company's assets. The CTO receives regular updates on security, compliance risks and initiatives and provides a quarterly cybersecurity risk and incident review to GoHealth's Internal Compliance Committee. This committee includes cross-functional senior leadership members, including C-suite executives and personnel from legal, compliance and internal audit.


text: GoHealth's cybersecurity risk management program is based on industry standards and best practices, aligning with the Center for Internet Security and the National Institute of Standards and Technology (NIST) Cybersecurity Frameworks. The Company conducts control self-assessments and risk assessments in collaboration with assigned control owners and risk owners to evaluate the maturity and effectiveness of its cybersecurity processes. Based on prior third-party assessments, GoHealth has completed the majority of its Governance, Risk and Compliance (GRC) roadmap initiatives and is currently deploying various comprehensive security tools and programs to further strengthen its cybersecurity posture.


text: GoHealth engages with a range of additional third-party cybersecurity service providers, assessors and auditors to evaluate and enhance the effectiveness of its cybersecurity program. Services provided by these third parties include endpoint and network monitoring, vulnerability scanning, penetration testing and security and compliance posture assessments. To mitigate risks associated with third-party sources, the Company requires third parties with access to personal, confidential or proprietary information to implement and maintain cybersecurity practices consistent with applicable legal standards and industry best practices and to enter into business associate agreements containing contractual provisions with respect to the handling of such information. GoHealth also conducts risk-based information security assessments of these third parties prior to engaging with them.


text: As cybersecurity incidents occur, the Company's cybersecurity team focuses on responding to and containing the threat and minimizing any business impact, as appropriate. In the event of an incident, the cybersecurity team assesses, among other factors, safety impact, data and personal information loss, business operations disruption, projected cost and potential for reputational harm, with support from external technical, legal and law enforcement support, as appropriate.


text: As of the date of this 2024 Annual Report on Form 10-K, the Company is not aware of any material risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected the Company, its business strategy, results of operations or financial condition; however, we cannot provide assurance that these threats will not result in such an impact in the future, as discussed in the risk factors entitled "Risks Related to Our Business" and "Risks Related to Our Intellectual Property and Technology" in Part I, Item 1A. of this 2024 Annual Report on Form 10-K. GoHealth, Inc.


text: Cybersecurity risk oversight is also a key area of focus for management. As discussed above, the CTO is primarily responsible for the cybersecurity program, strategy, policy, standards and processes. On a quarterly basis, or more frequently if a need arises, the CTO presents a briefing to the Audit Committee regarding the Company's cybersecurity program. The presented topics include, but are not limited to, the status of ongoing cybersecurity initiatives, incident reports and compliance with industry standards. Potentially material cybersecurity matters are escalated to the Audit Committee and/or the full Board of Directors, as appropriate, for risk oversight.


text: In the ordinary course of our business, we collect, use, store, and transmit digitally large amounts of confidential, sensitive, proprietary, personal, and health-related information. The secure maintenance of this information and our information technology systems is important to our operations and business strategy. To this end, we have implemented processes designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein. These processes are managed and monitored by a third-party information technology team, which reports to our Senior Vice President of Human Resources and Administration, and includes mechanisms, controls, technologies, systems, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data while also maintaining a stable information technology environment. For example, we conduct penetration and vulnerability testing, data recovery testing, security audits, and ongoing risk assessments, including due diligence on and audits of our key technology vendors, contract research organizations, and other contractors and suppliers. We have an incident response plan designed to mitigate and remediate identified cybersecurity incidents and escalate certain incidents as appropriate to management and the Audit Committee. We also conduct periodic employee trainings on cyber and information security, among other topics. As needed, we consult with outside advisors and experts to assist with assessing, identifying, and managing cybersecurity risks in order to anticipate future threats and trends, and their impact on the Company's risk environment.

companyName: Assertio Holdings, Inc.

ticker: ASRT


text: Our Senior Vice President of Human Resources and Administration, who reports directly to our interim Chief Executive Officer, is responsible for overseeing the assessment and management of cybersecurity risks. We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. In the last fiscal year, we have no identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, but we face certain ongoing cybersecurity risks threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the heading "Data breaches and cyber-attacks can compromise our intellectual property or other sensitive information and cause significant damage to our business."


text: The Board of Directors, as a whole and at the committee level, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate those risks. The Audit Committee, which is comprised solely of independent directors, has been designated by our Board of Directors to oversee cybersecurity risks. The Audit Committee receives, at a minimum, quarterly updates on cybersecurity and information technology matters and related risk exposures from our Senior Vice President of Human Resources and Administration as well as other members of the senior leadership team, including, if necessary, the Chief Financial Officer. The Board also receives updates from management and the Audit Committee on cybersecurity risks on at least an annual basis.


text: Risk Management and Strategy In the ordinary course of our business, we collect, use, store, and transmit digitally large amounts of confidential, sensitive, proprietary, personal, and health-related information. The secure maintenance of this information and our information technology systems is important to our operations and business strategy. To this end, we have implemented processes designed to assess, identify, and manage risks arising from internal and external cybersecurity threats and vulnerabilities from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein. These processes are managed and monitored by a third-party information technology team, which reports to our Senior Vice President of Human Resources and Administration, and includes mechanisms, controls, technologies, systems, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data while also maintaining a stable information technology environment. For example, we conduct penetration and vulnerability testing, data recovery testing, security audits, and ongoing risk assessments, including due diligence on and audits of our key technology vendors. We have an incident response plan designed to mitigate and remediate identified cybersecurity incidents at both Assertio and our customers and vendors and escalate certain incidents to management and, as appropriate, the Audit Committee. We also conduct periodic employee trainings on cyber and information security, among other topics. As needed, we consult with outside advisors and experts to assist with assessing, identifying, and managing cybersecurity risks in order to anticipate future threats and trends, and their impact on the Company's risk environment. Cybersecurity risks and threats are integrated into our enterprise risk management ("ERM") program, which establishes a risk management framework that seeks to identify and assess risks that could materially impact our business and operations.


text: The Board of Directors, as a whole and at the committee level, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate those risks. The Board oversees the ERM program and oversees an enterprise-wide approach to risk management, including risks related to cybersecurity.


text: The Audit Committee, which is comprised solely of independent directors, has been designated by our Board of Directors to oversee cybersecurity risks. The Audit Committee receives, at a minimum, quarterly updates on cybersecurity and information technology matters and related risk exposures from our Senior Vice President of Human Resources and Administration as well as other members of the senior leadership team, including, if necessary, the Chief Financial Officer. The Board also receives updates from management and the Audit Committee on cybersecurity risks on at least an annual basis.


text: Our Senior Vice President of Human Resources and Administration, who reports directly to our Chief Executive Officer and has been responsible for overseeing the assessment and management of cybersecurity risks at Assertio for approximately a year and a half.


text: Since the beginning of the last fiscal year, there were no identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, but we face certain ongoing cybersecurity risks threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the heading "Business interruptions, including data breaches and cyber-attacks can compromise our intellectual property or other sensitive information and cause significant damage to our business, can limit our ability to operate our business, and adversely impact the success of our commercialization partners."


text: Risk management and Strategy We have implemented a set of comprehensive cybersecurity and data protection policies and procedures placing special interest in addressing cybersecurity threats and effectively managing associated risks. Our cybersecurity program is designed to identify, assess, and proactively manage material risk from cybersecurity threats, which are integrated into our overall risk management systems, as overseen by the Company's Board of Directors, primarily through its Audit Committee. Risks from cybersecurity threats are regularly evaluated as a part of our broader risk management activities and as a fundamental component of our internal control system. Our information technology, or IT, program is led by our Director of Information Technology, who strives to monitor and mitigate risks from cybersecurity threats and provides reporting to the Audit Committee.

companyName: American Outdoor Brands, Inc.

ticker: AOUT


text: Our approach to cybersecurity is not a one-time effort but an ongoing process. We engage in monitoring, risk assessments, and robust security measures designed to ensure the confidentiality, integrity, and availability of our information systems, including critical computer networks, hosted services, communication systems, hardware, and software and to protect critical data, including our employees' and customers' data, intellectual property, confidential and proprietary data, and strategic competitive information. We address cybersecurity challenges and enhance our overall risk management efforts by adopting and working to integrate recognized best practices, standards, and controls utilizing guidelines from the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) for our protection and prevention of cybersecurity, risk management, data backup, and disaster recovery.


text: Our cybersecurity program includes some key aspects such as (i) a Cybersecurity Leader who oversees our day-to-day program, (ii) outsourced information technology firm and consultants with significant expertise in cybersecurity (iii) an incident response team comprised of a cross-section of management with oversight over our programs, (iv) incident detection and response policies, and (v) ongoing security awareness training programs for all employees.


text: We maintain a practical approach to cybersecurity. Our cybersecurity risk management program (an integral part of our overall Enterprise Risk Management Program) is designed to incorporate guidance from NIST CSF and other industry best practices. Within our program, we conduct internal and external security-based activities, including reviews and assessments of our third-party service providers and vendors. Our employees receive a formal cybersecurity awareness training on an annual basis, including specific topics related to social engineering and email frauds.


text: Detailed activities include: • Continuous Monitoring and Detection: Leveraging industry leading technologies to detect and alert on any suspicious activity across the enterprise to prevent and minimize cybersecurity attacks; • Information Security Assessments: Collaborating with internal and external partners to evaluate our data and network security; • Vulnerability Scanning and Penetration Testing: Engaging third-party service providers to assess internal and external vulnerabilities and potential threats; • Cyber Risk Register Reviews: Regularly reviewing our internal risk register to remain fully informed and prepared to address potential and identified risks; • Risk Prioritization: Prioritizing and addressing risks through our dedicated cybersecurity risk management program and cybersecurity council; • Annual Third-Party SOC Reviews: Ensuring that our financially critical service partners maintain effective internal controls, including access controls, change management, backup, and disaster recovery planning; and • Tabletop Exercises and Event Simulations: Engaging all employees across the company to build awareness, education, and enhance our cyber response posture and the collective team decision-making processes. For more information about these risks, see the risk factor titled "Our business is subject to the risk of terrorism, cyberattacks, or failure of key information technology systems," "Breaches of our information systems could adversely affect our reputation, disrupt our operations, and result in increased costs and loss of revenue," and "If our efforts to protect the security of personal information related to any of our customers, consumers, vendors, or employees are unsuccessful and unauthorized access to that personal information is obtained, or we experience a significant disruption in our computer systems or a cyber security breach, we could experience an adverse effect on our operations, we could be subject to costly government enforcement action and private litigation, and our reputation could suffer" under Item 1A.