text: Cyber Threats and Incident Response In the ordinary course of our business, we collect and store confidential data, including intellectual property, proprietary business information and personally identifiable information (including of our employees, customers, suppliers and business partners). We rely extensively on information technology systems, including some systems that are managed by third-party service providers, to securely process, store and transmit such confidential data in order to conduct our business. These systems include programs and processes relating to internal and external communications, ordering and managing materials from suppliers, collecting, processing and storing data produced by our clinical trials and other research and development initiatives, converting materials to finished products, shipping products to customers, processing transactions, processing payments to employees and vendors, calculating sales receivables, generating our financial results for each reporting period, summarizing and reporting results of operations, and complying with information technology security compliance and other regulatory, legal or tax requirements.


text: We have not been materially impacted by risks from cybersecurity threats and as of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business. However, our systems and networks have been, and are expected to continue to be, the target of increasingly advanced and evolving cyber-attacks and cybersecurity incidents in the future may adversely impact our business, financial condition and results of operations, and we are continuing to actively monitor such threats. For more information, see "Item 1A, Risk Factors—Risks related to our general business and operations—Significant disruptions of our information technology systems could adversely affect our business" and "Item 1A, Risk Factors—Risks related to our general business and operations—A data security breach could adversely affect our business and reputation."

companyName: TEVA PHARMACEUTICAL INDUSTRIES LTD

ticker: TEVA

secItem: Item 1C


text: In the event that we experience a cybersecurity incident, we have a cybersecurity incident response playbook that sets forth the applicable processes, roles, engagements, escalations and notifications to be executed in order to promptly respond to such threats. Depending on its nature and scale, a cybersecurity threat may be managed within our information security office, escalated to our CISO and CIO, or escalated to our management, and Board of Directors and Audit Committee, as appropriate. In certain instances, our GSR may be initiated and will collectively manage Teva's response to a crisis on a corporate level. The GSR is comprised of members from our various business units and regions, including senior leadership from a variety of functions, such as information security, legal, finance, human resources, communications and compliance.


text: We carry insurance that provides protection against the potential losses arising from a cybersecurity incident. However, there is no assurance that our insurance coverage will cover or be sufficient to cover all losses or claims that may result from a cybersecurity incident.


text: As of the date of this filing, we do not believe that our Company, including our business strategy, results of operations, or financial condition, have been materially affected by any cybersecurity incidents for the reporting period covered by this Annual Report on Form 10-K.

companyName: City Office REIT, Inc.


text: While we have not experienced any material cybersecurity threats or incidents to our knowledge in recent years, there can be no guarantee that we will not be the subject of future threats or incidents. For further discussion of the risks we face from cybersecurity threats, including those that could materially affect us, refer to "Item 1A. Risk Factors" in this Annual Report on Form 10-K, including "We face risks associated with security breaches through cyber-attacks, cyber intrusions or otherwise, as well as other significant disruptions of our IT networks and related systems."


text: The CFO and CEO play a pivotal role in informing the Audit Committee on cybersecurity risks. The CFO, in his capacity, regularly informs the CEO of all aspects related to cybersecurity risks and incidents ensuring the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing the Company. They provide briefings to the Audit Committee as needed, with a minimum frequency of once per year. These briefings encompass a broad range of topics, including: Current cybersecurity landscape and emerging threats; Status of ongoing cybersecurity initiatives and strategies; Incident reports and learnings from any cybersecurity events; and Compliance with regulatory requirements and industry standards.


text: While we have not had any material cybersecurity breaches to our knowledge in recent years, the CFO is continually informed about the latest developments in cybersecurity, including potential threats and risk management techniques. The CFO implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of security measures and system audits as needed to identify potential vulnerabilities. In the event of a cybersecurity incident, the CFO is equipped with an incident response plan. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.


text: Risk Management and Strategy We have established security practices and safeguards designed to help identify and protect against intentional and unintentional misappropriation or corruption of our information technology systems, data, and operational continuity. We regularly conduct risk assessments to identify potential cybersecurity threats, which include evaluating the likelihood and potential impact of these threats, identifying system and network vulnerabilities, and assessing the effectiveness of our existing controls. As part of our overall cybersecurity program, we engage specialized third-party vendors for certain cybersecurity functions including, but not limited to, incident response, penetration testing, and security operations center monitoring of our information technology environment. Identified risks are documented and communicated to the relevant stakeholders. Upon identification and assessment of risks, we develop and implement what we believe are appropriate measures to manage these risks, which may involve enhancing security controls, implementing new technologies, training employees, or changing business processes. We maintain change management processes, monitoring practices, and data protection measures to mitigate cybersecurity risks and continuously test our systems for potential threats. Such processes and practices to assess, identify, and manage cybersecurity incidents are integrated into our overall enterprise risk assessment process.

companyName: WATSCO INC

ticker: WSO


text: A dedicated management team at our corporate headquarters, which is led by our Director of Data Security ("DDS") and composed of the Chief Technology Officer ("CTO") and representatives from risk management, legal, internal audit, and finance departments, is responsible for assessing and managing our cybersecurity risks and data protection practices. The Audit Committee oversees the measures taken by this management team to monitor material risks associated with cybersecurity threats, a role crucial to maintaining a robust and effective cybersecurity risk management approach. The DDS and CTO provide formal briefings to the Audit Committee on various cybersecurity matters, including risk assessments, mitigation strategies, areas of emerging risks, and other areas of importance at least once a year, with the Board of Directors receiving updates periodically. Regular discussions on enterprise risks are held between the Audit Committee, Board of Directors, and senior management.


text: Our DDS has more than 20 years of expertise in the information technology sector, with 10 years specifically dedicated to cybersecurity. This experience has fostered a thorough comprehension of cyber threat landscapes, defense strategies, and security technologies.


text: The Company recognizes the importance of assessing, identifying, and managing risks associated with cybersecurity threats. These risks include, among other things, operational risks; intellectual property theft; fraud; extortion; harm to employees, customers or the independent commission sales agents and third party capacity providers in our network; violation of privacy or security laws and other litigation and legal risk; and reputational risks. The Company has implemented cybersecurity processes, technologies, and controls to aid in its efforts to assess, identify, and manage such risks, including network and endpoint monitoring by a third party managed security services provider and Landstar IT professionals, access controls, vulnerability assessments, penetration testing, regular information security training for employees, and tabletop exercises to inform our IT professionals' risk identification and assessment.

companyName: LANDSTAR SYSTEM INC

ticker: LSTR


text: Landstar maintains an Incident Response Plan that guides the actions the Company is to take in the event of a suspected or confirmed cybersecurity incident. The plan includes processes to triage, investigate, contain, and remediate the incident, and is designed to enable us to comply with applicable legal and regulatory obligations and mitigate financial and reputational damage. We also maintain a Business Continuity Plan, which provides procedures for maintaining the continuity of critical business processes in the event of business interruption, including any that involve cybersecurity incidents that may significantly impact our operations. Our cybersecurity risk management processes incorporate appropriate industry standards and are designed using the frameworks developed by National Institute of Standards and Technology ("NIST") as a guide.


text: Our enterprise risk management program reports at least quarterly to the Management Risk Committee and considers cybersecurity threat risks alongside other types of risks as part of our overall risk assessment process. The Management Risk Committee consists of those members of executive management of the Company with ultimate responsibility for the Company's enterprise risk management practices. Members of the Management Risk Committee regularly engage in discussions and meetings relating to cybersecurity risk management and strategy processes and the prevention, detection, mitigation and remediation of cybersecurity incidents. Members of our IT department collaborate with the Management Risk Committee, as necessary, to gather insights for identifying and assessing cybersecurity threats, their severity, and potential mitigations. Our cybersecurity risk management and strategy processes are led by the Chief Information Officer, who is a member of the Management Risk Committee, and the Vice President of Network Services.


text: In particular, the Vice President of Network Services leads a team of IT professionals that includes individuals with significant cybersecurity expertise. The Vice President of Network Services has over 26 years of experience in various roles with the Company as well as with the U.S. Army involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs. The team of IT professionals led by the Vice President of Network Services includes individuals with relevant degrees and certifications, including Certified Information Security Systems Professional (CISSP), Certified Cyber Security Architect (CCSA), EC-Council Certified Ethical Hacker (CEH), GIAC Certified Forensic Examiner (GCFE), SANS Digital Forensics And Incident Response (FOR408), CompTIA Certified PenTest+, Cisco Certified Network Associate (CCNA), and CompTIA Certified Security+.


text: The Company also regularly engages with consultants, auditors, and other third parties, including by having an independent third-party Qualified Security Assessor review our cybersecurity program twice each year to help identify areas for continued focus and enhancement. These third parties analyze data on the interactions of users of our information technology resources, including employees, and conduct penetration tests and scanning exercises to assess the performance of our cybersecurity controls, systems and processes.


text: Our cybersecurity risk management processes also address risks associated with our use of third-party service providers, including those who have access to our employee data or our systems that support customers and our network of independent commission sales agents and third party capacity providers. Third-party risks are included within our enterprise risk management assessment program, as well as our cybersecurity-specific risk identification program. Cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third-parties that have access to our systems, data or facilities that house such systems or data, and continually monitor cybersecurity threats identified through such diligence. Additionally, we may require certain third parties to agree by contract to manage their cybersecurity risks in specified ways, and to agree to be subject to cybersecurity audits, which we conduct as appropriate.


text: During the period covered by this Annual Report, the Company has not experienced any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, institutions like us, as well as our employees, service providers and other third parties, have experienced a significant increase in information security and cybersecurity risk in recent years and will likely continue to be the target of increasingly sophisticated cyber attacks. The Company describes whether and how risks from identified cybersecurity threats materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Disruptions or failures in the Company's computer systems; cyber and other information security incidents" included as part of our risk factor disclosure at Item 1A of this Annual Report on Form 10-K, which disclosures are incorporated by reference herein.


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management. The Safety and Risk Committee of the Board is responsible for the oversight of risks from cybersecurity threats. At least semi-annually, the Management Risk Committee and, subsequently, the Safety and Risk Committee of the Board receives an overview of our cybersecurity threat risk management and strategy processes from the Chief Information Officer and the Vice President of Network Services. These sessions typically cover topics such as data security posture, results from third-party assessments, progress towards risk-mitigation-related goals, our incident response plan, cybersecurity vendors and products, and material risks from cybersecurity threats, incidents and developments, as well as the steps management has taken to respond to such risks. Material cybersecurity threat risks are also considered during separate Board and Board committee meeting discussions relating to matters such as enterprise risk management, internal controls over financial reporting and business continuity planning.


text: We have identified information technology and cybersecurity risk as some of the most significant risk types to our business. Related to these identified risk types, we have classified our top risks and report these risks to both senior management and the risk committee of Genworth Financial's Board of Directors. For additional information regarding the risks associated with these matters, see "Item 1A—Risk Factors."

companyName: GENWORTH FINANCIAL INC

ticker: GNW


text: Genworth's risk management framework recognizes the significant operational risk, including risk of losses, from cyber incidents and the importance of a strong cybersecurity program for effective risk management. As part of our risk management, we have implemented a Data Security and Cybersecurity Program (the "DSCP") which sets policy expectations, ensures broad coverage over information technology risks, integrates the Information Security and Information Technology Risk Management Framework into our broader risk management systems, establishes clear roles and governance, and aligns control expectations to the National Institute of Standards and Technology ("NIST"). Under the DSCP, we have processes for identifying, assessing and managing technology and cybersecurity risk. The DSCP employs various controls and policies to secure our operations and information, which include monitoring, reporting, managing and remediating cybersecurity threats. Key features of the DSCP include access controls, security training, system security testing, dedicated security personnel, security event monitoring, and when necessary, consultation with third-party data security experts. Through a cross-functional team, we assess and mitigate risks associated with our third-party providers and have processes in place to regularly monitor and evaluate cybersecurity risks and threats associated with the use of third-party providers. Our information security team, overseen by our Chief Information Security Officer ("CISO"), conducts annual information security awareness training for employees involved in our systems and processes that handle customer data. We have conducted cybersecurity awareness training with management, including a tabletop exercise to simulate a response to a cybersecurity incident, and used these findings to improve our processes and technologies. In addition, the DSCP includes an incident response plan, which coordinates the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to assess the materiality of the incident, escalate, contain, investigate and remediate the incident, as well as to comply with potentially applicable legal reporting and other obligations and mitigate reputational damage. We also carry insurance that provides protection against the potential losses arising from a cybersecurity incident.


text: Additionally, we have procedures set forth in the DSCP for reporting and responding to potential security incidents as well as determining applicable disclosure requirements, including timely incident reporting. For example, as disclosed in our Form 8-K filed on June 22, 2023, we were notified by PBI, a third-party vendor, that PBI was subject to the widely reported security events involving the MOVEit file transfer system, which PBI uses in the performance of its services. The MOVEit Cybersecurity Incident resulted in the unauthorized acquisition of data by a third party from PBI as well as several organizations and governmental agencies. After being notified of the security event, we, together with PBI, promptly launched an investigation to determine whether and to what extent personal information had been unlawfully accessed. Approximately 2.5 to 2.7 million of our policyholders' or other customers' personal information, including social security numbers, was exposed to and obtained by the threat actor as a result of the MOVEit Cybersecurity Incident. We believe that the MOVEit Cybersecurity Incident has not had any impact on any of our information systems, including our financial systems, and that there has not been any material interruption of our business operations. While we are continuing to measure the impact, including certain remediation expenses and other potential liabilities, we do not currently believe this incident or other known risks from cybersecurity threats are reasonably likely to have a material adverse effect on our business, results of operations or financial condition. See "Item 1A—Risk Factors—Our computer systems and those of our third-party service providers have in the past and may in the future fail or be compromised, including through cybersecurity breaches; we may experience issues from new and complex information technology methodologies such as artificial intelligence; and unanticipated problems could materially adversely impact our disaster recovery systems and business continuity plans, any of which could damage our reputation, impair our ability to conduct business effectively, result in enforcement action or litigation, and materially adversely affect our business, financial condition and results of operations."


text: Our Board of Directors recognizes the importance of maintaining the privacy and security of customer information, as well as the availability of our systems, and consequently dedicates meaningful time and attention to oversight of cybersecurity risk. In light of these risks, our Board of Directors is actively engaged in the oversight of the Company's information technology, which includes periodic briefings on cybersecurity threats and participation in cybersecurity preparedness exercises. Furthermore, under its charter, the Board's risk committee has primary responsibility for cybersecurity oversight. In this capacity, the risk committee oversees the Company's processes for identifying, assessing and managing technology and cybersecurity risk. In connection with the MOVEit Cybersecurity Incident, the risk committee was immediately notified by management and regularly briefed on the matter, and worked with management, including Genworth's CISO and Chief Risk Officer ("CRO"), to assess and manage the risk and implement the Company's response to the incident.


text: Genworth's CISO and CRO, both members of management, support the cybersecurity risk oversight responsibilities of the Board and the risk committee and involve applicable management personnel in cybersecurity risk management. The risk committee receives periodic reports from the CISO and CRO on the Company's technology and cybersecurity risk profiles, information security program and key cybersecurity initiatives. Additionally, the CISO and CRO follow a risk-based escalation process to notify the risk committee outside of the regular reporting cycle when they identify potential substantive cybersecurity risks or issues.


text: Genworth's CISO is an information technology and security professional with 23 years of experience and 11 years of service at Genworth. In his 23 years of experience, he has held roles in information technology infrastructure administration, information technology infrastructure, security consulting and security administration. He received a Bachelor of Science Degree in Business Administration from Regent University and is a Certified Information Systems Security Professional (CISSP).


text: Genworth's CRO has served in information technology and risk management leadership roles for over twenty years, including oversight of enterprise risk management and operational risk, as well as oversight for financial reporting systems, operational and technology platforms, and testing and quality assurance programs. He received a Bachelor of Science Degree in Decision Support Systems from Virginia Polytechnic Institute (Virginia Tech) and graduated from the Tuck Global Executive Leadership Program through Dartmouth in 2020. For more information about our CRO, see "Part III—Item 10—Directors, Executive Officers and Corporate Governance."


text: The Trust does not have a board of directors, so the Trustee is responsible for oversight of the Trust's risks from cybersecurity threats. The Trustee has dedicated personnel that are responsible for assessing and managing the Trust's cyber risk management program, informing senior management of the Trustee regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervising such efforts. The Trustee's information technology team has decades of experience selecting, deploying, and operating cybersecurity technologies, initiatives, and processes, and relies on threat intelligence as well as other information obtained from governmental, public or private sources, including external consultants engaged by the Trustee to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. External partners are a key part of the Trustee's cybersecurity protocols and policies. The Trustee works with leading firms in the cybersecurity industry, leveraging their technology and expertise to monitor and maintain the performance and effectiveness of products and services that are used by the Trustee.

companyName: SABINE ROYALTY TRUST

ticker: SBR


text: The Trustee maintains a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats, which processes are integrated into the Trustee's overall risk management process. The Trustee maintains robust cybersecurity protocols including, but not limited to technological capabilities that prevent and detect disruptions; computer workstations and programs protected with passwords and passphrases, as well as employee training throughout the year on financial regulations and cybersecurity followed up by testing of that knowledge. The protocols are based on recognized best practices and standards for cybersecurity and information technology. The Trustee has an annual assessment, performed by a third party vendor, of the Trustee's cyber risk management program.


text: The Trust faces risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows or reputation. The Trustee has experienced, and will continue to experience, cyber incidents in the normal course of its business. However, prior cybersecurity incidents have not had a material adverse effect on the Trust's business, financial condition, results of operations, or cash flows. See " Risk Factors – Business and Operational Risks – The Trustee may be subject to attempted cybersecurity disruptions from a variety of sources including state-sponsored actors."


text: Management Committee ("RMC"), which is responsible for the oversight of the Corporation's overall risk framework, and assists the Board in the monitoring, review and approval of the policies that measure, limit and manage the Corporation's risks, including cybersecurity risk. The RMC holds periodic meetings in which management provides overview of Popular's cybersecurity threat risk management incident status.

companyName: POPULAR, INC.

ticker: BPOP


text: Cyber Risk Management and Strategy As a part of the overall risk management system for the Trust, processes are in place to assess, identify and manage material risks from cybersecurity threats. The Trust does not have any directors, officers, or employees. The Sponsor, an indirect, wholly owned subsidiary of The Goldman Sachs Group, Inc. ("Goldman Sachs) and an affiliate of Goldman Sachs & Co. LLC, generally oversees the performance of the Trustee and the Trust's principal service providers. The Trustee in turn is generally responsible for the day-to-day administration of the Trust. The Sponsor and the Trust rely on Goldman Sachs' cybersecurity policy, which also applies to the Trust. The Sponsor and the Trust also rely on the systems of GS Group Inc., its third-party service providers, and the Trust's service providers.

companyName: Goldman Sachs Physical Gold ETF

ticker: AAAU


text: Goldman Sachs' cybersecurity risk management processes are integrated into its overall risk management processes. Goldman Sachs has established an Information Security and Cybersecurity Program (the "Cybersecurity Program"), administered by Technology Risk within Engineering, and overseen by Goldman Sachs' chief information officer. This program is designed to identify, assess, document, and mitigate threats, establish, and evaluate compliance with information security mandates, adopt and apply the security control framework, and prevent, detect, and respond to security incidents. The Cybersecurity Program is periodically reviewed and modified to respond to changing threats and conditions. A dedicated Operational Risk team, which reports to the chief risk officer of Goldman Sachs, provides oversight of the Cybersecurity Program, independent of Technology Risk, and assesses the operating effectiveness of the program against industry standard frameworks and risk appetite-approved operational risk limits and thresholds.


text: Goldman Sachs' process for managing cybersecurity risk includes the critical components of its risk management framework, as well as the following: Training and education, to enable Goldman Sachs' people to recognize information and cybersecurity concerns and respond accordingly; Identity and access management, including entitlement management and production access; Application and software security, including software change management, open source software, and backup and restoration;


text: Infrastructure security, including monitoring Goldman Sachs' network for known vulnerabilities and signs of unauthorized attempts to access the firm's data and systems; Mobile security, including mobile applications; Data security, including cryptography and encryption, database security, data erasure and media disposal; Cloud computing, including governance and security of cloud applications, and software-as-a-service data; Onboarding;


text: Technology operations, including change management, incident management, capacity and resilience; and Third-party risk management, including vendor management and governance, and cybersecurity and business resiliency on vendor assessments.


text: In conjunction with third-party vendors and consultants, Goldman Sachs performs risk assessments to gauge the performance of the Cybersecurity Program, to estimate its risk profile and to assess compliance with relevant regulatory requirements. Goldman Sachs performs periodic assessments of control efficacy through its internal risk and control self-assessment process, as well as a variety of external technical assessments, including external penetration tests and "red team" engagements where third parties test its defenses. The results of these risk assessments, together with control performance findings, are used to establish priorities, allocate resources, and identify and improve controls. Goldman Sachs uses third parties, such as outside forensics firms, to augment its cyber incident response capabilities. Goldman Sachs and its third-party service providers have a vendor management program that documents a risk-based framework for managing third-party vendor relationships (including those of the Trust). Information security risk management is built into the vendor management process, which covers vendor selection, onboarding, performance monitoring and risk management.


text: Cyber Risk Governance GS Group Inc.'s board of directors (the "GS Board") provides strategic oversight on cybersecurity matters generally, including oversight of material risks associated with cybersecurity threats. The GS Board, both directly and through its committees, including its Risk and Audit Committees, receives periodic reports and updates from an officer of Goldman Sachs regarding the overall state of the cybersecurity program, the current cybersecurity threat landscape, material risks from cybersecurity threats, cybersecurity incidents, risk management policies and/or risk assessment initiatives.


text: The chief risk officer, chief information officer and chief technology officer of Goldman Sachs among others, periodically brief the GS Board on operational and technology risks, including cybersecurity risks. The GS Board also receives regular briefings from the chief information security officer of Goldman Sachs ("CISO") on a range of cybersecurity-related topics, including the status of the Cybersecurity Program, emerging cybersecurity threats, mitigation strategies and related regulatory engagements. In addition, these are topics on which various directors maintain an ongoing dialogue with the CISO, chief information officer, and chief technology officer.


text: The CISO is responsible for managing and implementing the Cybersecurity Program and reports directly to the chief information officer. The CISO oversees the Technology Risk team, which assesses and manages material risks from cybersecurity threats, sets firmwide control requirements, assesses adherence to controls, and oversees incident detection and response.


text: Goldman Sachs has a series of committees that oversee the implementation of the cybersecurity risk management strategy and framework. These committees are informed about cybersecurity incidents and risks by designated members of Technology Risk and Operational Risk teams, who periodically report to these committees about the Cybersecurity Program, including the efforts of the Technology Risk and Operational Risk teams to prevent, detect, mitigate and remediate incidents and threats. These committees enable formal escalation and reporting of risks, and the CISO and other members of Technology Risk provide regular briefings to these committees.


text: The Firmwide Operational Risk and Resilience Committee is responsible for overseeing operational risk and seeks to ensure business and operational resilience.


text: The Firmwide Technology Risk Committee reviews matters related to the design, development, deployment and use of technology. This committee oversees cybersecurity matters, as well as technology risk management frameworks and methodologies, and monitors their effectiveness. This committee is chaired by the chief technology officer and reports to the Firmwide Operational Risk and Resilience Committee.


text: The Engineering Risk Steering Group oversees Engineering risk decisions, monitors control performance and reviews approaches to comply with current and emerging regulation applicable to Engineering. This committee is chaired by the CISO (who also serves on the Firmwide Technology Risk Committee) and reports to the Firmwide Technology Risk Committee.


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats are assessed on an ongoing basis, and how such risks could materially affect the Trust's business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, the Trust did not identify any risks from cybersecurity threats, including previous cybersecurity incidents, that the Trust believes materially affected, or are reasonably likely to materially affect, the Trust, including its business strategy, operational results, and financial condition.


text: Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data related to our clinical trials and technology platform ("Information Systems and Data").

companyName: DBV Technologies S.A.

ticker: DBVT


text: Our Information Systems function, led by our Vice President for Information Systems and Director of Information Systems, helps identify, assess and manage the Company's cybersecurity threats and risks. Our Information Systems function identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example automated tools, subscribing to and analyzing reports and services that identify cybersecurity threats, conducting scans of the Company's threat environment, evaluating threats that are reported to us, conducting internal audits, internal threat assessments, and conducting vulnerability assessments.


text: Depending on the environment and system, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: an information systems security policy; incident management; disaster recovery procedures; periodic backup recovery tests; risk assessments; encryption of certain data; network security controls; data segregation for certain systems and environments; access controls; physical security; asset management, tracking, and disposal; systems monitoring; employee training and phishing simulations; penetration tests; outsourced managed detection and response services; maintaining cybersecurity insurance; and having dedicated cybersecurity staff.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, cybersecurity risk is addressed as a component of the Company's enterprise risk management program and identified in the Company's risk mapping and management documentation. The cybersecurity component of the Company's risk mapping and management documentation is updated annually, and our Information Systems function, led by our Vice President for Information Systems and Director of Information Systems, prepares cybersecurity roadmaps designed to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example, cybersecurity software providers, managed cybersecurity service providers, and penetration testing firms.


text: We use third-party service providers to perform a variety of functions throughout our business, such as contract research organizations (CROs), contract manufacturing organizations (CMOs), cloud hosting and other SaaS providers. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, we take various measures designed to help manage risk associated with our use of certain of these providers. These measures include, for example, obtaining confirmation of certain cybersecurity certifications, information security questionnaires, and imposition of certain contractual obligations.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including If our information technology systems or sensitive information, or those of third parties upon which we rely, are or were compromised, we could experience adverse consequences resulting from such compromise, including, but not limited to, regulatory investigations or actions, litigation, fines and penalties, disruptions of our business operations, reputational harm, loss of revenue or profits, and other adverse consequences.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including Cyril Guyardeau, our Director of Information Systems Security, who had previously spent 15 years as an IT infrastructure engineer in the healthcare industry, and Cecile Delansorne, our Vice President for Information Systems, who has held similar executive positions overseeing information systems in other pharmaceutical companies for over 7years. Our Vice President for Information Systems reports to our CFO.


text: The Vice President for Information Systems is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. The Vice President for Information Systems is also responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response and vulnerability management procedures are designed to escalate certain cybersecurity incidents to members of management depending on the impact of the incident, including the CFO, Data Privacy Officer, Company Legal department, and Executive Committee, who work with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified.


text: The audit committee may receive periodic reports from our CFO concerning the Company's significant threats and risk, including, if applicable, those related to cybersecurity threats, and the processes the Company has implemented to address them. The audit committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: 26North conducts annual cybersecurity awareness training for all employees and conducts quarterly phishing exercises to assess employee cybersecurity recovery tests to simulate a response to a cybersecurity incident, and uses the findings therefrom to improve practices, procedures, and technologies. 26North also assesses the risks from cybersecurity threats that impact our third-party service providers and has established oversight processes to identify and manage cybersecurity risks associated with the products or services we or 26North procure from such suppliers.

companyName: 26North BDC, Inc.


text: 26North has also developed an incident response plan that provides guidelines for preparing for, responding to and recovering from cybersecurity incidents, and facilitates coordination across multiple operational functions. The incident response plan includes processes to triage, assess severity, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. The incident response plan includes notification to the applicable members of 26North's technology leadership team, including 26North's Chief Financial Officer ("CFO") and Chief Technology Officer ("CTO"), and, as appropriate, escalation to an internal ad-hoc group of senior employees, tasked with helping to manage the cybersecurity incident.


text: Depending on their nature, incidents may also be reported to the Risk Committee (as defined below) or the board of directors of 26North, as well as to our Chief Compliance Officer, the Audit Committee of our Board of Directors and to our full Board of Directors, if appropriate.


text: Cybersecurity Risk Management and Strategy Cybersecurity risks and data protection are key components of our long-term strategy and enterprise risk management program and are integrated into our overall risk management systems and processes. We maintain processes for assessing, identifying and managing material risks from cybersecurity threats, and we routinely invest in the development and implementation of essential cybersecurity systems, infrastructures and processes to protect the security and integrity of our systems, networks, databases and proprietary information. Key areas of our cybersecurity risk management processes and strategy currently include:

companyName: MAGNACHIP SEMICONDUCTOR Corp

ticker: MX


text: Compliance with industry standards and regulatory frameworks : Our information security management system is ISO 27001 certified. In addition, we align our standards to comply with South Korea's industrial technology protection law (Act on Prevention of Divulgence and Protection of Industrial Technology), which prevents technologies vital to South Korean national security or economic competitiveness from being divulged to or shared with foreign countries or corporations without the government's approval.


text: Ongoing Evaluation and Assessment of Systems and Procedure : We monitor compliance with regulatory, industry and evolving data privacy requirements and update our cybersecurity risk management program from time to time as appropriate. We also continuously monitor our information security systems and processes on an ongoing basis to identify and remediate cybersecurity threats and vulnerabilities that could be exploited to adversely impact our business operations. To better preemptively identify risks and vulnerabilities in our security systems, we perform penetration testing for security controls using external third-party tools and encourage vulnerability reporting within our organization,


text: Cross-Collaboration and Coordination : Cybersecurity risks related to our business, privacy and compliance issues are identified and managed through a multifaceted approach, including third-party monitoring, internal and external IT security audits and reviews by relevant committees.


text: Third-Party Service Providers : We engage leading third-party product and service providers to assist us with our cybersecurity risk management. We use an Information Prevention and Data Loss Prevention System on networks and endpoints, which is designed to prevent unauthorized access to or transfer of sensitive data. We also use centrally managed antivirus systems for blocking illegal software to detect and remove malware and illegal software from devices in real time. In particular, we use a Managed Security Service provider for Security Information and Event Management services for matters such as firewall management, intrusion detection and prevention, vulnerability management and incident response.


text: Cyber Incident Response Plan : We maintain a comprehensive cyber incident response plan that sets forth the applicable processes, roles, engagements, escalations and notifications to promptly respond to a cybersecurity incident. This plan covers steps to be taken upon the detection of a cybersecurity incident detection, review by relevant committees, identification of damages, recovery process, post-incident analysis and the introduction of improvement measures. Such incident responses are managed in a timely manner by a dedicated team and overseen by relevant organizations, including IT, finance, legal and compliance.


text: Security Awareness Training for Personnel : We provide comprehensive employee training on cybersecurity awareness, confidential information protection and simulated phishing attacks.


text: Review of Third-Party Risks : We routinely conduct risk and compliance assessments of third-party service providers prior to exchanging any sensitive data or integrating with any key third-party provider.


text: As of December 31, 2023, we have not identified any risks from cybersecurity threats, including any previous cybersecurity incidents, that have materially affected the Company, our business strategy, our results of operations or our financial condition. For a discussion of risks from cybersecurity threats (including any previous cybersecurity incidents) that could be reasonably likely to materially affect us, please refer to our Risk Factors discussion under the heading 'We may be subject to disruptions, breaches or cyber-attacks of our secured networks and information technology systems that could damage our reputation, harm our business, expose us to liability and materially adversely affect our results of operations' in Item 1A of this Annual Report on Form 10-K.


text: Cybersecurity Governance In line with our overall risk management governance structure, management is responsible for the day-to-day management of cybersecurity risks while the Company's Board of Directors and its Risk Committee actively and continuously provide oversight.


text: Our Risk Committee oversees the Company's management of key risks including those arising from cybersecurity threats. Our management team reports to the Risk Committee on a quarterly basis, presenting their assessment of key enterprise risks, including cybersecurity. The topics include trends in cyber threats and the initiatives designed to strengthen our security systems and enhance the cyber readiness of our organization. Additionally, at least annually, our management team and our Chief Information Security Officer ("CISO") update the members of the Risk Committee and the Board of Directors on existing and new cybersecurity risks, status of risk mitigation efforts, cybersecurity incidents, if any, and the progress of key information security initiatives.


text: In 2020, we established the Information Security Steering Committee (the "IS Steering Committee"), a management-level and cross-functional committee, led by our Chief Executive Officer, and comprised of our Chief Compliance Officer, Chief Financial Officer, CISO, Chief Privacy Officer and relevant teams including Information Security, HR, Compliance & Internal Audit and Legal. The IS Steering Committee holds quarterly meetings, during which they review and take action on a wide range of topics, including cybersecurity threat matters such as prevention monitoring, detection mitigation and remediation of cybersecurity incidents.


text: Our CISO leads a dedicated Information Security team in charge of cybersecurity matters. Collectively, the members of our Information Security team have over 35 years of relevant experience in various roles involving information technology, information security, compliance and systems. Also, our Information Security team oversees compliance with our cybersecurity framework, facilitates cybersecurity risk management activities, assists with the review and approval of policies, and oversees the security awareness program. At least annually, our Information Security team and CISO update the members of the Risk Committee and the Board of Directors on compliance and risk matters. The Information Security team also reports to the IS Steering Committee on a quarterly basis. We invest in ongoing cybersecurity training for our Information Security team.


text: The Company's management, including the Company's Chief Compliance Officer and the investment manager's Global Chief Information Security Officer, are responsible for conducting a regulatory risk assessment which includes cybersecurity threats. Members of Company management possess relevant experience in various disciplines that are important to effectively managing cybersecurity related risks including Security Operations, Vulnerability Management, Network Security, Application and Cloud Security, and cybersecurity risk management. Management of the Company and the investment manager maintain compliance programs which include policies and procedures that are reasonably designed to address regulatory risks related to cybersecurity. The compliance programs include controls to monitor the prevention, detection, mitigation and remediation of cybersecurity incidents impacting the Company; in addition to the compliance programs, a vendor oversight program is leveraged to monitor risks associated with relevant service providers including cybersecurity.

companyName: PIMCO Capital Solutions BDC Corp.


text: The Company relies on the Adviser to engage external experts, including cybersecurity assessors, consultants, and internal auditors to evaluate cybersecurity measures and risk management processes, including those applicable to the Company. The Company relies on the Adviser's risk management program and processes, which include cyber risk assessments.


text: Board Oversight of Cybersecurity Risks The Board provides oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from the Company's Global Chief Information Security officer or their designee regarding the overall state of the Adviser's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.


text: Management's Role in Cybersecurity Risk Management The Company's management, including the Company's Chief Compliance Officer ("CCO"), is responsible for assessing and managing material risks from cybersecurity threats. Members of Company management possess relevant expertise in various disciplines that are key to effectively managing such risks. Management of the Company is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Company, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, information technology, and/or compliance personnel of the Adviser.


text: Cybersecurity Risk Management and Strategy As a financial institution, our business depends on the continuous operation of its information and data processing systems and the security of information received from customers, employees and others. We have developed and implemented a cybersecurity program intended to protect the reliability of our critical systems and the confidentiality of nonpublic information.

companyName: California BanCorp


text: Our cybersecurity program is designed to assess, identify and manage the material risks from cybersecurity threats, including threats associated with third-party service providers, such as technology providers and cloud-based platforms. Our program is based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF") and the guidance of banking and other regulatory agencies. As part of the program, we have adopted a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents and facilitates coordination and communication across multiple parts of our organization.


text: Our cybersecurity risk management process is integrated as part of our overall risk management program. Our information security professionals have primary responsibility for overall cybersecurity risk management. Our cybersecurity professionals are led by our Chief Technology Officer, who has over 30 years of experience in the information technology field, including over 20 years of experience focusing solely in the cybersecurity space. Our Chief Technology Officer, works in conjunction with the Compliance Manager, Information Security Manager/Information Security Officer and Enterprise Risk Manager to develop and maintain the cybersecurity program. In addition to our own employees, we engage third parties to provide security products and services as needed, using their technology and expertise to evaluate and enhance its cybersecurity program and to inform employees regarding evolving threats, risks and defensive measures. Generally, these third-party service providers are managed by the Information Security Manager/Officer.


text: We periodically review, test and assess our cybersecurity systems, using both internal resources and third-party service providers with cybersecurity expertise. We periodically (at least once per year) review and test our incident response plan through simulations and assessments.


text: We require periodic cybersecurity training for our employees to learn about data security, how to identify and mitigate potential cybersecurity risks and how to protect our resources and information. Members of the risk management, cybersecurity and technology teams receive specialized training about evolving cybersecurity threats and new risk mitigation and detection technologies.


text: We have developed processes to identify and oversee risks from cybersecurity threats associated with third-party service providers, which includes the Information Security Manager/Officer assisting with and evaluating cybersecurity readiness during vendor selection and onboarding as well as risk-based monitoring of vendors on an ongoing basis.


text: Cybersecurity Governance Our Board of Directors and its Audit Committee are responsible for overseeing the cybersecurity program and policies. The Company's management, led by the Chief Technology Officer, is responsible for designing and implementing the program. The Information Security Manager/Officer and Chief Technology Officer regularly report to the Audit Committee regarding management's implementation of the cybersecurity program, cybersecurity risks and threats, assessments of our cybersecurity systems and the planning and status project to strength our information security. Our cybersecurity incident response plan requires that management promptly advise the Audit Committee of any material cybersecurity incident. The Chair of the Audit Committee regularly reports to the Board on cybersecurity risks and other matters reviewed by the Committee. Board members may attend Audit Committee meetings where cybersecurity issues are discussed and have access to the materials for management's Risk and Technology and Enterprise Risk Management Committee meetings.


text: Cybersecurity Incidents Like many financial institutions, we have experienced cyber-based attacks and other attempts to compromise our information systems and we expect that we will continue to experience these attacks and attempts in the future. While we have not identified cybersecurity threats that have materially affected or are reasonably likely to materially affect us, like all financial institutions, we face ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect our business, results of operations, or financial condition. See Item 1A – Risk Factors – "Risks Related to Technology—System failure or breaches of our network security, including as a result of cyber-attacks or data security breaches, could subject us to increased operating costs as well as litigation and other liabilities."


text: Risk management and strategy The Partnership has no directors or executive officers and its affairs are managed by its General Partner. The General Partner is a wholly-owned subsidiary of MSCM. MSCM is ultimately owned by Morgan Stanley. Morgan Stanley, its businesses, the General Partner, the Partnership, and the broader financial services industry face an increasingly complex and evolving threat environment. Morgan Stanley has made and continues to make substantial investments in cybersecurity and fraud prevention technology, and employ experienced talent to lead its Cybersecurity and Information Security organizations and program under the oversight of the Morgan Stanley Board of Directors (the "Board") and the Operations and Technology Committee of the Board (the "BOTC"). See "Risk Factors – The General Partner, the Partnership, the Funds and their respective service providers (including the Advisors) and operations are potentially vulnerable to cyber-security attacks or incidents" for information on risks to the Partnership from cybersecurity threats.

companyName: Ceres Tactical Commodity L.P.


text: As part of its enterprise risk management ("ERM") framework, Morgan Stanley has implemented and maintains a program to assess, identify and manage risks arising from the cybersecurity threats (the "Cybersecurity Program"). The Cybersecurity Program has been adopted by the General Partner, and applies to its business, as relevant. The Cybersecurity Program helps protect Morgan Stanley's clients, customers, employees, property, products, services and reputation by seeking to preserve the confidentiality, integrity and availability of information, enable the secure delivery of financial services, and protect the business and the safe operation of Morgan Stanley's technology systems. Morgan Stanley continually adjusts the Cybersecurity Program to address the evolving cybersecurity threat landscape and comply with extensive legal and regulatory expectations.


text: Processes for assessing, identifying and managing material risks from cybersecurity threats The Cybersecurity Program takes into account industry best practices and addresses risks from cybersecurity threats to Morgan Stanley's network, infrastructure, computing environment and the third parties that Morgan Stanley, and its affiliates rely on. Morgan Stanley periodically assesses the design of its cybersecurity controls against the Cyber Risk Institute Cyber Profile, which is based on the National Institute of Standards and Technology ("NIST") Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity, as well as global cybersecurity regulations, and develops improvements to those controls in response to that assessment. The Cybersecurity Program also includes cybersecurity and information security policies, procedures and technologies that are designed to address regulatory requirements and to protect clients', employees' and Morgan Stanley's own data against unauthorized disclosure, modification and misuse. These policies, procedures and technologies cover a broad range of areas, including: identification of internal and external threats, access control, data security, protective controls, detection of malicious or unauthorized activity, incident response, and recovery planning.


text: The threat intelligence function within the Cybersecurity Program actively engages in private and public information sharing communities and leverages both commercial and proprietary products to collect a wide variety of industry and governmental information regarding the latest cybersecurity threats, which informs the cybersecurity risk assessments and strategy. This information is also provided to an internal forensics team, which develops and implements technologies designed to help detect these cybersecurity threats. Where a potential threat is identified, an incident response team evaluates the potential impact, and coordinates remediation where required. These groups, as well as Morgan Stanley's Operational Risk Department (the "Operational Risk Department"), review external cybersecurity incidents that may be relevant to Morgan Stanley and its affiliates, and the outcomes of these incidents further inform the design of the Cybersecurity Program. In addition, Morgan Stanley maintains a robust global training program on cybersecurity risks and requirements and conducts regular phishing email simulations for its employees and consultants.


text: The cybersecurity processes are designed to help oversee, identify and mitigate risks associated with Morgan Stanley's use of third-party vendors. Morgan Stanley maintains a third-party risk management program that includes evaluation of, and response to, cybersecurity risks at its third-party vendors. Prior to engaging third-party vendors to provide services, Morgan Stanley conducts assessments of the third-party vendors' cybersecurity programs to identify the impact of their services on the cybersecurity risks to Morgan Stanley. Once on-boarded, third-party vendors' cybersecurity programs are subject to risk-based oversight, which may include security questionnaires, submission of independent security audit reports or an audit of the third-party vendor's security program, and, with limited exceptions, third-party vendors are required to meet Morgan Stanley's cybersecurity standards. Where a third-party vendor cannot meet those standards, its services, and the residual risk, are subject to review, challenge and escalation through Morgan Stanley's risk management processes and ERM committees, which may ultimately result in requesting increased security measures or ceasing engagement with such third-party vendor.


text: The Cybersecurity Program is regularly assessed by Morgan Stanley's Internal Audit Department ("IAD") through various assurance activities, with the results reported to the Audit Committee of the Board ("BAC") and the BOTC. Annually, certain elements of the Cybersecurity Program are subject to an audit by an independent consultant, as well as an assessment by a separate, independent third party, the results of which, including opportunities identified for improvement and related remediation plans, are reviewed with the BOTC. The Cybersecurity Program is also examined regularly by Morgan Stanley's prudential and conduct regulators within the scope of their jurisdiction.


text: Morgan Stanley Management's role in assessing and managing material risks from cybersecurity threats The Cybersecurity Program is operated and maintained by management, including Morgan Stanley's Chief Information Officer of Cyber, Data, Risk and Resilience ("CIO") and Morgan Stanley's Chief Information Security Officer ("CISO"). These senior officers are responsible for assessing and managing the Firm's cybersecurity risks. The General Partner adheres to the Cybersecurity Program's policies and participates in periodic testing. The Cybersecurity Program strategy, which is set by the CISO and overseen by the Head of the Operational Risk Department, is informed by various risk and control assessments, control testing, external assessments, threat intelligence, and public and private information sharing. The Cybersecurity Program also includes processes for escalating and considering the materiality of incidents that impact Morgan Stanley and its affiliates, including escalation to senior management and the Board, which are periodically tested through tabletop exercises.


text: The members of management that lead the Cybersecurity Program and strategy have extensive experience in technology, cybersecurity and information security. The CIO has over 30 years of experience in various engineering, IT, operations and information security roles. The CISO has over 25 years of experience leading cybersecurity teams at financial institutions, including in the areas of IT strategy, risk management and information security. The Head of the Operational Risk Department has over 20 years of experience in technology, security and compliance roles, including experience in government security agencies.


text: Risk levels and mitigating measures are presented to and monitored by dedicated management-level cybersecurity risk committees. These committees include representatives from management as well as business and control stakeholders who review, challenge and, where appropriate, consider exceptions to its policies and procedures. Significant cybersecurity risks are escalated from these committees to Morgan Stanley's non-financial risk committee. The CIO and the Head of the Operational Risk Department report on the status of the Cybersecurity Program, including significant cybersecurity risks; review metrics related to the program; and discuss the status of regulatory and remedial actions and incidents to Morgan Stanley's non-financial risk committee, the BOTC and the Board, as appropriate.


text: We recognize the importance of assessing, identifying, and managing risk associated with cybersecurity threats. Our external advisor has implemented cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage such risks. Our advisor has developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. As we are fully externally managed, we are reliant on our external advisor's network and risk management program.

companyName: LUB LIQUIDATING TRUST


text: This cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, and financial risk areas.


text: As we are fully externally managed, we are reliant on our external manager's network and risk management program. Our external advisor has elected to engage third-party managed service providers to maintain its network and to manage the monitoring, detection, mitigation, and prevention of cybersecurity threats. These service providers are responsible for managing our advisor's hosted services, all of the computer and computer-related hardware and software they use, and for managing the backup process. Our manager's primary managed service provider supplies management with monthly updates and activity reports related to network alerts, connectivity issues and help desk tickets.


text: We are subject to risks from cybersecurity threats and incidents. As of December 31, 2023, we do not believe such risks have materially affected or are reasonably likely to materially affect the Company, including the Company's business strategy, results of operations or financial condition. However, there can be no assurance that the Company will not be materially affected in the future.


text: December 31, 2023 Our Trustees consider cybersecurity risk as part of its risk oversight function. Our Trustees oversee management's implementation of our cybersecurity risk management program. Our Trustees will receive periodic reports from management on our cybersecurity risks as well as updates, as necessary, regarding any significant cybersecurity incidents impacting our advisor's information systems.


text: In 2023, we were a SPAC with no business operations. Since our IPO, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. We identified an acquisition transaction candidate in the Fall of 2022, entered into a Business Combination Agreement in December 2022, and consummated the Business Combination on March 4, 2024. Prior to the consummation of the Business Combination, we did not consider that we faced significant cybersecurity risk and did not adopt any formal processes for assessing cybersecurity risk, however, we did maintain certain cybersecurity risk procedures, including utilization of two-factor authentication for accessing the Company's servers which were maintained by a third party IT service provider, and controls for disbursement of funds in the Company's bank account that held the Company's working capital, which included the Company's Chief Financial Officer receiving authorization from either the Company's Chief Executive Officer or Executive Chairman of the Board followed by callback confirmation from the Company's bank in order for funds to be disbursed. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if there is any. We have not encountered any cybersecurity incidents since our Offering through the time of the consummation of the Business Combination.

companyName: QT IMAGING HOLDINGS, INC.

ticker: QTI


text: We rely extensively on various information systems and other electronic resources to operate our business. In addition, nearly all our customers, service providers and other business partners on whom we depend, including the providers of our online banking, mobile banking, and accounting systems, use their own information systems and electronic resources. Any of these systems can be compromised, including through the employees, customers, and other individuals who are authorized to use them, and bad actors who use a sophisticated and constantly evolving set of software, tools, and strategies to do so. Moreover, the nature of our business as a financial services provider, and our relative size, make us and our business partners high-value targets for these bad actors to pursue. For additional information see "Item 1A. Risk Factors—Operational Risks."

companyName: Princeton Bancorp, Inc.

ticker: BPRN


text: Accordingly, we have long devoted significant resources to assessing, identifying, and managing risks associated with cybersecurity threats, including: an in-house team dedicated to information and cybersecurity, responsible for conducting regular evaluations of our information systems, existing controls, vulnerabilities, and potential enhancements; tools for continuous monitoring capable of detecting and aiding in the response to cybersecurity threats in real-time;


text: conducting thorough due diligence on our third-party service providers, evaluating their cybersecurity practices, and requiring contractual commitments from them to implement specific cybersecurity measures;


text: collaboration with third-party cybersecurity experts who perform periodic penetration testing, vulnerability assessments, and other procedures to pinpoint potential weaknesses in our systems and processes; and regular cybersecurity training sessions for our staff.


text: This information security program is a key part of our overall risk management system, which is administered by our Information Security Officer. The program includes administrative, technical and physical safeguards to help ensure the security and confidentiality of customer records and information. These security and privacy policies and procedures are in effect across all of our businesses and geographic locations.


text: Our management team is responsible for the day-to-day management of risks we face, including our Chief Information Officer ("CIO"). Our CIO has been in the role since May 2021, and has 30 years of experience in technology risk management and cybersecurity, primarily within the financial services sector.


text: In addition, our board of directors is responsible for the oversight of risk management. In that role, our board of directors, with support from our cybersecurity advisors, are responsible for ensuring that the risk management processes designed and implemented by management are adequate and functioning as designed. To carry out those duties, our board of directors receives quarterly reports from our management team regarding cybersecurity risks, and our efforts to prevent, detect, mitigate, and remediate any cybersecurity incidents.


text: The Company, the Advisor and StepStone Group are affiliates of StepStone Group Inc., a Delaware corporation listed on the Nasdaq Stock Market LLC and whose securities are registered with the SEC pursuant to Section 12(b) of the Exchange Act. In general, the Company relies upon the information systems and other enterprise services provided by StepStone Group Inc. and its subsidiaries, including StepStone Group and the Advisor (together, "STEP").

companyName: Stepstone Private Credit Fund LLC


text: STEP maintains a cybersecurity program that is reasonably designed to protect the Company's information, and that of the Company's portfolio companies and investors, against cybersecurity threats that may result in significant adverse effects on the confidentiality, integrity, and availability of the information systems of STEP and its affiliates. Governance.


text: Board of Directors The Board of Directors of StepStone Group Inc. ("STEP Board") oversees STEP's processes for assessing and managing risk. The STEP Board's Audit Committee is responsible for reviewing and discussing STEP's practices with respect to risk assessment and risk management, and risks related to matters, including information technology and cybersecurity. The STEP Board and Audit Committee regularly review the measures implemented by STEP to identify and mitigate risks from cybersecurity threats. As part of such reviews, the STEP Board and Audit Committee receive reports and presentations from those responsible for overseeing STEP's cybersecurity risk management, including the Managing Director, Head of Information Technology ("Head of IT") and STEP's Legal team, which may address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to STEP's peers, industry participants, service providers and other third parties. The Head of IT also periodically presents to the STEP Board and its Audit Committee, including to describe STEP's information security infrastructure and improvements made, and to report on any significant developments in respect to STEP. From time to time, external legal advisers provide education to the STEP Board and/or Audit Committee in respect of information security related developments and to provide training in respect of directors' responsibilities.


text: At the Company level, the Company's Board oversees and monitors enterprise risk management at the Company, including with respect to cybersecurity and information security risk. The Company's Board and disclosure review team are expected to receive periodic reports and updates from the Head of IT, as applicable in the context of risks from cybersecurity threats that may impact the Company. STEP has a framework under which certain cybersecurity incidents are escalated within the Company and STEP and, where appropriate, reported to the Company Board, STEP Board or Audit Committee in a timely manner.


text: STEP has a cybersecurity working group composed of members of the Information Technology (including Information Security), Legal and Compliance departments, including the Head of IT, the Chief Legal Officer of STEP, the Chief Compliance Officer of STEP, and a number of their respective team members. The working group meets regularly to identify and mitigate data protection and cybersecurity risks, implement information security governance mechanisms, discuss developments in information security, and discuss and action any significant cyber incidents relevant to STEP, and its affiliates, including the Company. The working group is expected to escalate matters of significance to STEP's Incident Response Team, ERMC (defined below) and/or the STEP Disclosure Committee, as well as to the Company's disclosure review team, as appropriate.


text: STEP has adopted an Incident Response Plan ("IRP") that applies in the event of a cybersecurity threat or incident, including those that impact the Company, to provide a standardized framework for responding to security incidents. The IRP sets out a coordinated approach to investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate, including stakeholders at the Company, as relevant. In general, STEP's incident response process leverages the NIST framework and focuses on four phases: preparation; detection and analysis; containment, eradication and recovery; and post-incident remediation. The IRP applies to all STEP personnel and STEP networks and systems, third-party systems and end-user devices, including those of the Advisor and those relied upon by the Company.


text: In addition, STEP has an Enterprise Risk Management Committee ("ERMC") composed of a number of members of senior management from operations across STEP's businesses, legal, compliance, information technology, finance, human resources and internal audit and risk. The ERMC was established to oversee and ensure the efficient and effective management of STEP's enterprise risks. Cybersecurity and significant information security matters are to be brought before the ERMC or certain of its members, and matters of primary significance are to be further escalated and reported to the StepStone Global Executive Committee and the Audit Committee of the STEP Board and the Company's Board, as appropriate.


text: At the management level, the STEP Head of IT, who has extensive cybersecurity knowledge and skills gained from over 20 years of work experience at STEP and elsewhere, heads the team responsible for implementing, monitoring and maintaining cybersecurity and data protection practices and reports directly to the President and Co-Chief Operating Officer of STEP. The Head of IT receives reports on cybersecurity threats from his team and external service providers on an ongoing basis and, in conjunction with management, reviews risk management measures implemented by STEP to identify and mitigate data protection and cybersecurity risks, including those applicable to the Company and the Advisor. The Head of IT works closely with the STEP Legal and Compliance departments to oversee compliance with legal, regulatory and contractual security requirements and in developing reports and presentations to the STEP Board and its Audit Committee, as well as to the Company's Board. The Head of IT is responsible for providing regular training to STEP employees, including employees of the Advisor, in respect of information security. Risk Management and Strategy.


text: STEP takes a multifaceted approach to managing risk from cybersecurity threats. STEP's cybersecurity program leverages people, processes, and technology to identify and respond to cybersecurity threats in a timely manner. STEP's information security program, and supporting policies apply to all employees, contractors and vendors servicing the firm, including employees of the Advisor. The program outlines the development, maintenance, and distribution of information security policies and procedures that detail the implementation and maintenance of the information security program and its safeguards, and cover various areas such as information handling, user access management, encryption, data retention and backups, computer and network security and monitoring, physical security, incident reporting and response, service provider oversight, and employee and contractor use of technology. STEP also undergoes annual SOC 1 Type 2 testing of its financial processes and supporting technical controls. In addition to the foregoing, STEP conducts regular employee trainings on cybersecurity, which trainings apply to the Company's officers and employees of the Advisor, and performs phishing exercises to test employees' understanding of how to identify social engineering attacks. STEP performs diligence, including in respect of information security, of vendors and third parties with significant access to confidential information and personal data, and periodically monitors such vendors, including such vendors relied upon by the Company and the Advisor. STEP also employs systems and processes designed to oversee, identify, and reduce the potential impact of a security incident at a third-party vendor, service provider or customer or otherwise implicating the third-party technology and systems STEP and its affiliates use. STEP conducts annual penetration testing performed by a rotating group of third-party security firms to test STEP's technical controls and security response. STEP's internal audit team has also conducted a cybersecurity assessment to evaluate STEP's preparedness against potential cyber risks and threats. In addition to its internal cybersecurity capabilities and third-party penetration testing, STEP also, at times, engages consultants or other third parties to assist with assessing, identifying, and managing cybersecurity risks.


text: Material Cybersecurity Risks, Threats & Incidents Due to evolving cybersecurity threats, it has and will continue to be difficult to prevent, detect, mitigate, and remediate cybersecurity incidents. To date, the Company has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, results of operations, or financial condition, but the Company faces certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to have such an effect. Additional information on cybersecurity risks the Company faces can be found in Part I, Item 1A "Risk Factors" of this Report under the heading "Cybersecurity risks and cyber incidents could adversely affect our business by causing a disruption to our operations, which could adversely affect our financial condition and results of operations.", which should be read in conjunction with the foregoing information.


text: Since our IPO, our sole business activities have been identifying and evaluating suitable acquisition transaction candidates. We do not operate any enterprise information technology systems of our own and have only a limited number of personnel. Our cybersecurity risk is assessed and managed by our management team, who limit the persons who have authorized access to our online accounts and limit the vendors whose services we utilize to a small number of reputable service providers. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if there is any. We have not encountered any cybersecurity incidents since our IPO.

companyName: Zapata Quantum, Inc.

ticker: ZPTA


text: The Chief Compliance Officer of the Fund oversees the Fund's risk management function generally and relies on the Adviser's Chief Compliance Officer to assist with assessing and managing material risks from cybersecurity threats. The Adviser's Chief Compliance Officer has 12 years of experience in the financial services industry, and during such time has acquired relevant experience overseeing and actively managing cybersecurity and information security programs for financial services companies with complex information systems. The Fund's Chief Compliance Officer has been responsible for the general oversight function as Chief Compliance Officer to the Fund for 3 years and has worked in the financial services industry for 18 years, during which the Fund's Chief Compliance Officer has gained expertise in assessing and managing risk applicable to the Fund.

companyName: AB Private Credit Investors Corp


text: The Trust does not have any material internal operations of its own that face material cybersecurity threats and is not a regulated financial institution subject to mandatory cybersecurity compliance under New York law (including, without limitation, the New York Code, Rules and Regulations), and therefore has not adopted any cybersecurity risk management program or formal processes for assessing or monitoring cybersecurity risk. However, the Trust does depend on the digital technologies of the Corporate Trustee and third parties, including EMI, Sony/ATV and their respective affiliates' information systems, infrastructure and cloud applications and services. Any sophisticated and deliberate attacks on, or security breaches in, the systems, infrastructure or cloud that benefit the Trust, including those of the Corporate Trustee and third parties, could lead to corruption, misappropriation or miscalculation of the gross royalty income arising from the Catalogue (or calculation of the Contingent Portion related thereto) and/or the Trust's assets, proprietary information and sensitive or confidential data. Because of the Trust's reliance on the technologies of the Corporate Trustee and third parties including EMI, Sony/ATV, their respective affiliates, the Trust also depends upon the personnel and the processes of such parties to protect against cybersecurity threats arising from their own operations in the ordinary course of their respective businesses. The Trust does not employ any operating personnel and has not contracted for the development of processes of its own for the purpose of data security protections and as such may not adequately protect against, or investigate and/or remediate any vulnerability to, cyber incidents. To the best knowledge of the Trustees, as of December 31, 2023, risks from cybersecurity threats, including any previous cybersecurity incidents, have not materially affected the Trust, but it is possible that any of these occurrences, or a combination of them, could have material adverse consequences on the Trust, including its results of operations or financial condition.

companyName: MILLS MUSIC TRUST

ticker: MMTRS


text: During the reporting period, we have not had a cybersecurity incident that has materially affected, or was reasonably likely to materially affect, the Company, including our business strategy, results of operations or financial condition. There are risks from cybersecurity threats that if they were to occur could materially affect our business strategy, results of operations or financial condition, including as discussed in " Item 1A. Risk factors – A failure in cyber security systems, as well as the occurrence of events unanticipated in our disaster recovery systems and management continuity planning could impair our ability to conduct business effectively," although we do not currently believe that such a result is reasonably likely.

companyName: AB Commercial Real Estate Private Debt Fund, LLC


text: The Secretary of the Company relies on the Investment Manager's Chief Compliance Officer to assist with assessing and managing material risks from cybersecurity threats. The Investment Manager's Chief Compliance Officer has 12 years of experience in the financial services industry, and during such time has acquired relevant experience overseeing and actively managing cybersecurity and information security programs for financial services companies with complex information systems. The Company's Secretary has been responsible for the general oversight function as Secretary to the Company since its inception and has worked in the financial services industry for 10 years.


text: As a blank check company, we do not have any operations and our sole business activity has been to search for and consummate an initial business combination. However, because we have investments in our Trust Account and bank deposits and we depend on the digital technologies of third parties, we and third parties may be subject to attacks on or security breaches in our or their systems. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose. In the event of a cybersecurity incident impacting us, the management team will report to the Board of Directors and provide updates on the management team's incident response plan for addressing and mitigating any risks associated with such an incident. As an early-stage company without significant investments in data security protection, we may not be sufficiently protected against such occurrences. We also lack sufficient resources to adequately protect against, or to investigate and remediate any vulnerability to, cyber incidents. It is possible that any of these occurrences, or a combination of them, could have material adverse consequences on our business and lead to financial loss. We have not encountered any cybersecurity incidents since our Initial Public Offering.

companyName: TortoiseEcofin Acquisition Corp. III


text: We are a SPAC with no business operations. Since our Initial Public Offering, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if there is any. We have not encountered any cybersecurity incidents since our Initial Public Offering.

companyName: Global Technology Acquisition Corp. I


text: The Trust does not have a board of directors; therefore, the Trustee is responsible for oversight of the Trust's risks from cybersecurity threats.

companyName: CROSS TIMBERS ROYALTY TRUST

ticker: CRT


text: The Trustee has dedicated personnel that are responsible for assessing and managing the Trust's cyber risk management program, informing senior management of the Trustee regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervising such efforts. The Trustee's information technology team has decades of experience selecting, deploying, and operating cybersecurity technologies, initiatives, and processes, and relies on threat intelligence as well as other information obtained from governmental, public or private sources, including external consultants engaged by the Trustee to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. External partners are a key part of the Trustee's cybersecurity protocols and policies. The Trustee works with leading firms in the cybersecurity industry, leveraging their technology and expertise to monitor and maintain the performance and effectiveness of products and services that are used by the Trustee.


text: The Trustee maintains a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats, which processes are integrated into the Trustee's overall risk management process. The Trustee maintains robust cybersecurity protocols including, but not limited to technological capabilities that prevent and detect disruptions; computer workstations and programs protected with passwords and passphrases, as well as employee training throughout the year on financial regulations and cybersecurity followed up by testing of that knowledge. The protocols are based on recognized best practices and standards for cybersecurity and information technology. The Trustee has an annual assessment, performed by a third-party vendor, of the Trustee's cyber risk management program.


text: risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows or reputation. The Trustee has experienced, and will continue to experience, cyber incidents in the normal course of its business. However, prior cybersecurity incidents have not had a material adverse effect on the Trust's business, financial condition, results of operations, or cash flows. See Item 1A. Risk Factors—The Trust may be subject to attempted cybersecurity disruptions from a variety of sources including state-sponsored actors.


text: The Trustee has dedicated personnel that are responsible for assessing and managing the Trust's cyber risk management program, informing senior management of the Trustee regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervising such efforts. The Trustee's information technology team has decades of experience selecting, deploying, and operating cybersecurity technologies, initiatives, and processes, and relies on threat intelligence as well as other information obtained from governmental, public or private sources, including external consultants engaged by the Trustee to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents.

companyName: HUGOTON ROYALTY TRUST

ticker: HGTXU


text: External partners are a key part of the Trustee's cybersecurity protocols and policies. The Trustee works with leading firms in the cybersecurity industry, leveraging their technology and expertise to monitor and maintain the performance and effectiveness of products and services that are used by the Trustee.


text: risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows or reputation. The Trustee has experienced, and will continue to experience, cyber incidents in the normal course of its business. However, prior cybersecurity incidents have not had a material adverse effect on the Trust's business, financial condition, results of operations, or cash flows. See Item 1A. Risk Factors – The Trust may be subject to attempted cybersecurity disruptions from a variety of sources including state-sponsored actors.


text: Apollo's Board of Directors is involved in overseeing Apollo's risk management program, including with respect to cybersecurity, which is a critical component of Apollo's overall approach to enterprise risk management (" ERM "). Apollo's cybersecurity policies and practices are fully integrated into its ERM framework through its reporting, risk management and oversight channels and are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards.

companyName: Apollo Infrastructure Co LLC


text: As one of the critical elements of Apollo's overall ERM approach, Apollo's cybersecurity program is focused on the following key areas:


text: Governance. As discussed further under the heading "Cybersecurity Governance," Apollo's Board of Directors has an oversight role, as a whole and also at the committee level, in overseeing management of Apollo's risks, including its cybersecurity risks. Apollo's Chief Information Security Officer (" CISO ") and the Chief Information Security Officer of Athene Holding Ltd. (" AHL's CISO "), a subsidiary of Apollo, with support from the broader Apollo Technology team, are responsible for information security strategy, policies and practices, and also receive support, as appropriate, from our executive officers and other representatives of the Operating Manager and its affiliates.


text: Collaborative Approach. Apollo utilizes a cross-functional approach involving stakeholders across multiple departments, including Apollo Compliance, Legal, Technology, Operations, Risk and others, aimed at identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of potentially material cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by Apollo management, in consultation with our management and our Board as applicable, in a timely manner.


text: Technical Safeguards. Apollo deploys technical safeguards that are designed to protect its information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved on an ongoing basis using vulnerability assessments and cybersecurity threat intelligence.


text: Incident Response and Recovery Planning. Apollo has established and maintains incident response and recovery plans that address its response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis.


text: Third-Party Risk Management. Apollo maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of its systems, as well as the systems of third parties that could adversely impact its business and the business of its externally managed entities such as our company, in the event of a cybersecurity incident affecting those third-party systems.