text: Material Impact of Cybersecurity Risks The potential impact of risks from cybersecurity threats on us are assessed on an ongoing basis, and how such risks could materially affect our business strategy, operational results, or financial condition are regularly evaluated. During the reporting period, we did not identify any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that we believe have materially affected, or are reasonably likely to materially affect, our business strategy, operational results, or financial condition. We further describe cybersecurity risks that we face in "The failure in cyber security systems, as well as the occurrence of events unanticipated in our disaster recovery systems and management continuity planning could impair our ability to conduct business effectively" and "We, our Investment Adviser and our portfolio companies are subject to risks associated with cyber-attacks" under "Item 1A. Risk Factors" of this annual report on Form 10-K.


text: The Board has overall responsibility for risk oversight, including risks related to cybersecurity threats. The Board is aware of the critical nature of managing these risks and has sought to establish oversight mechanisms to ensure effective governance in managing risks associated with cybersecurity and appropriate review of the protections provided to us by the Investment Adviser.

companyName: SLR Investment Corp.

ticker: SLRC

secItem: Item 1C


text: In conducting its duties, the ISG relies on the experience and expertise of the Investment Adviser's third-party IT service provider, which includes, among other things, over two decades of managing network security for companies, a track record of collaborating with management teams on incident response and threat mitigation, and, through various partnerships, vetting and implementing cutting-edge cybersecurity technologies. The ISG will provide a report, at least annually, to the entire Board regarding our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk mitigation-related goals, the Investment Adviser's incident response plan, and cybersecurity threat risks or incidents and developments, as well as the steps the Investment Adviser's management has taken to respond to and mitigate such risks. The Investment Adviser's incident response plan provides guidelines for responding to cyber incidents and facilitates coordination across multiple operational functions of the Investment Adviser. The incident response plan includes notification to the ISG and, depending on its nature, escalation to the Board, if appropriate. The Board is also encouraged to engage with the ISG on cybersecurity topics at other times, and material cybersecurity threats and risks are also considered by the Board in relation to other important matters that come before it.


text: The Company's board of directors, or the Board, recognizes the critical importance of maintaining the trust and confidence of our patients, investors, business partners and employees. The Board is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to risk management. The Company's cybersecurity policies, standards, processes and practices are fully integrated into the Company's risk management program and are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing, mitigating and remediating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Day One Biopharmaceuticals, Inc.

ticker: DAWN


text: Risk Management and Strategy As one of the critical elements of the Company's overall risk management approach, the Company's cybersecurity program is focused on the following key areas:


text: The Board, in coordination with the Audit Committee, oversees the Company's risk management process, including the management of risks arising from cybersecurity threats. The Board and the Audit Committee each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. The Board and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, the Board and the Audit Committee discuss the Company's approach to cybersecurity risk management with members of the Data Privacy and Security Committee, which includes the Company's Head of Information Technology.


text: Risk Management and Strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and our customers' confidential information ("Information Systems and Data").

companyName: Xometry, Inc.

ticker: XMTR


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example, professional services firms, cybersecurity consultants and software providers, managed cybersecurity service providers, penetration testing firms, and forensic investigators.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of management, including (i) our CTO, Vaidyanathan Raghavan, who previously served as the General Manager of Technology at Wayfair and holds a Master of Science in Electrical Engineering degree from the University of Minnesota; and (ii) our Vice President of Information Technology and Security, Mr. Brendan Hamilton, who has previously worked as a Vice President at an international bank with supervisory responsibility for cybersecurity issues and is a Certified Information Systems Security Professional.


text: Our Director of Information Security, the management position responsible for assessing and managing material risks from cybersecurity threats, has served in various roles in information technology and information security for over 30 years, and is a Certified Information Systems Security Professional (CISSP). He and other members of the OD Technology Department work collaboratively across the Company and have implemented programs designed to protect our information systems from cybersecurity threats and position our Company to promptly respond, in coordination with various members of our senior management team, to any cybersecurity incidents in accordance with our incident response and recovery plans. To facilitate the success of our cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to any cybersecurity incidents. Through ongoing communications and collaboration with these teams, including members of our senior management team, as appropriate, our Director of Information Security monitors the prevention, detection, mitigation and remediation of any cybersecurity threats and incidents in real time, and reports any such threats and incidents to the Risk Committee when appropriate.

companyName: OLD DOMINION FREIGHT LINE, INC.

ticker: ODFL


text: As part of our overall risk management system, IT management monitors and tests our safeguards and trains our employees on these safeguards. Personnel at all levels and departments are made aware of our cybersecurity policies and risks through communication and training.

companyName: RxSight, Inc.

ticker: RXST


text: As one of the critical elements of AGM's overall ERM approach, AGM's cybersecurity program is focused on the following key areas: • Governance. As discussed further under the heading "Cybersecurity Governance," AGM's Board of Directors has an oversight role, as a whole and also at the committee level, in overseeing management of AGM's risks, including its cybersecurity risks. AGM's Chief Information Security Officer ("CISO") and the Chief Information Security Officer of Athene Holding Ltd. ("AHL's CISO"), a subsidiary of AGM, with support from the broader AGM Technology team, are responsible for information security strategy, policies and practices, and also receive support, as appropriate, from our executive officers and other representatives of the Investment Adviser and its affiliates. • Collaborative Approach. AGM utilizes a cross-functional approach involving stakeholders across multiple departments, including AGM Compliance, Legal, Technology, Operations, Risk and others, aimed at identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of potentially material cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management, in consultation with our management and our Board, as applicable, in a timely manner. • Technical Safeguards. AGM deploys technical safeguards that are designed to protect its information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved on an ongoing basis using vulnerability assessments and cybersecurity threat intelligence. • Incident Response and Recovery Planning. AGM has established and maintains incident response and recovery plans that address its response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis. • Third-Party Risk Management. AGM maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of its systems, as well as the systems of third parties that could adversely impact its business and the business of its externally managed entities such as our company, in the event of a cybersecurity incident affecting those third-party systems. • Education and Awareness. AGM provides regular, mandatory training for personnel regarding cybersecurity threats to equip its personnel with effective tools to help mitigate cybersecurity threats, and to communicate its evolving information security policies, standards, processes and practices.

companyName: MidCap Financial Investment Corp

ticker: MFIC


text: Cybersecurity Governance AGM's Board of Directors' oversight of cybersecurity risk management is supported by the audit committee of AGM's Board of Directors ("AGM audit committee"), the AAM Global Risk Committee ("AGRC"), the Operational Risk Forum (the "ORF"), the Cybersecurity Working Group and management. A GM's Board of Directors, AGM's audit committee, the AGRC, the ORF and the Cyber Security Working Group receive regular updates on AGM's information technology, cybersecurity risk profile and strategy, and risk mitigation plans from AGM's risk management professionals, AGM's Chief Security Officer ("CSO"), the CISO, the AHL CISO, other members of management and relevant management committees and working groups. The Cyber Security Working Group is chaired by the CISO and has representation from AGM's Technology, Legal, Compliance, and ERM teams. The group meets at least once a quarter to discuss cybersecurity and risk mitigation activities, among other topics. The CISO regularly reports to the ORF regarding cyber risk, and the ORF in turn reports to the AGRC on a quarterly basis, noting any cyber updates when necessary or appropriate. In turn, AGM's Board of Directors and/or AGM's audit committee receive quarterly risk updates from risk management professionals, as well as at least annual updates on cyber risk specifically. The full AGM Board of Directors or AGM's audit committee receives presentations and reports on cybersecurity risks from AGM's CSO or CISO, as well as from AHL's CISO, at least annually.


text: AGM's CISO, in coordination with the AGM Technology and ERM teams, works collaboratively across AGM to implement a program designed to protect its information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with its incident response and recovery plans. To facilitate the success of AGM's cybersecurity risk management program, multidisciplinary teams throughout AGM are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the CISO monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and reports such threats and incidents to AGM's audit committee or AGM's Board of Directors, as appropriate.


text: As part of the risk management oversight (including oversight of cyber risks) of the audit committee of our Board of Directors, our audit committee regularly interacts with, and receives reports from, our management, the Investment Adviser, AGM, and other service providers. The audit committee of our Board receives presentations and reports on cybersecurity risks from AGM's CSO or CISO, at least annually, and they address a wide range of topics including recent developments, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to AGM's peers and third parties. Additionally, AGM and other service providers periodically report to management as it relates to our cybersecurity practices.


text: We utilize external standards, such as the Center for Internet Security framework, as a starting point for the design and development of our systems that assess risk and mitigation measures. Helios is committed to achieving compliance with the CIS implementation group level 2 standards. However, this does not mean that we meet any particular technical standards, specifications, or requirements, but rather we use external standards as a guide to help us identify, assess and manage cybersecurity risks and threats relevant to our business. An annual risk assessment is completed and presented to the executive leadership team and the Company's Board of Directors. We discuss changes to our policies, procedures and processes needed to address gaps identified through the assessment.

companyName: HELIOS TECHNOLOGIES, INC.

ticker: HLIO


text: We maintain organizational safeguards that include employee training, business continuity planning and cybersecurity insurance. These safeguards are reviewed on an annual basis or more frequently as the business environment warrants and are adjusted as needed to account for changes in the Company and overall risk environment. Cybersecurity training is delivered to employees through a combination of online modules and, where role-specific needs or circumstances warrant, instructor-led classroom sessions. This approach ensures comprehensive training tailored to the requirements of various roles while maintaining flexibility and accessibility.


text: We incorporate technical safeguards such as Multi-Factor Authentication ("MFA"), principles of Zero Trust and password complexity policies for all accounts to help prevent unauthorized access to our systems and data. Additionally, we utilize XDR (Extended Detection and Response) installed on endpoints, along with our Security Operations Center ("SOC") to manage real-time endpoint protection monitoring.


text: We engage in annual corporate-wide internal and external facing penetration tests, employing a battery of hacking tools to map out our assets and to assess vulnerabilities that could be exploited. In addition, we also extend such testing to newly acquired companies and assets as part of the integration process. This penetration testing is performed by a third party and is used to evaluate our current posture towards cybersecurity threats and to make adjustments, as needed, to protect our systems. The results are reviewed with the executive leadership team and the Company's ESG Committee of the Board of Directors.


text: We have an Incident Response Policy and related processes that outline steps to be taken in the event of a cybersecurity incident that impacts Helios, our partners and third-party hosted systems. When a cybersecurity incident occurs, the IT team promptly notifies the VP, Information Technology and assesses its potential impact on operations and business continuity. Incidents that pose a potential threat to operations or business continuity are escalated to a cross-functional team comprising the VP, Information Technology, the Chief Financial Officer (CFO), and the General Counsel. This team evaluates the incident's materiality, considering factors such as the nature, scope, and timing of the event, as well as its potential financial and operational. Based on the evaluation, incidents determined to be material are reported to the ESG Committee. This escalation ensures that the Board of Directors is informed of significant cybersecurity events that could impact the company's financial health or operations.


text: No risks from cybersecurity threats nor any previous cybersecurity incidents have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition, but we cannot provide any assurance that they will not be materially affected in the future by such risks or incidents. For a discussion of whether and how any risks from cybersecurity threats have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition, see "Risks Relating to Our Business: Other––Increased IT security threats and more sophisticated and targeted computer crime could pose a risk to our systems, networks, products, solutions and services" in Item 1A, Risk Factors.


text: Role of Management Helios Technologies' Information Technology organization is led by the VP, Information Technology and is responsible for administration of the cybersecurity and information security framework and risk management, including that of the Corporation and its business units, with oversight by the ESG Committee.


text: Helios' VP, Information Technology is an active member of InfraGard and has formal education in information technology with over 25-years' experience in roles involving management of cybersecurity functions, cyber strategy, and leading and collaborating on information systems and related technologies. The VP, Information Technology receives regular updates on cybersecurity developments, results of mitigation efforts and cybersecurity incident response and remediation through monthly Advanced Threat Intelligence briefings and FBI bulletins via Infragard.


text: Helios information systems organization and its management team are responsible for developing and implementing its cybersecurity policies and is comprised of individuals with either formal education in information technology or cybersecurity or relevant experience working in information technology and cybersecurity. Additionally, leaders in Helios' information technology function receive periodic training and education on cybersecurity related topics including certifications.


text: Role of the Helios Board of Directors The ESG Committee addresses risks related to the global enterprise, including material risks facing the businesses, risks the Company may face in the future, measures that management has employed to address those risks and other information relating to how risk analysis is incorporated into the Company's corporate strategy and day-to-day business operations. As part of this oversight function, the ESG Committee is responsible for overseeing cybersecurity-related risks. The ESG Committee includes cybersecurity topics in its quarterly updates to the full Board of Directors, which provides further oversight over our cybersecurity-related risks and the Company's strategies to address such risks. Reports to the Board of Directors and ESG Committee include comprehensive updates on the current cybersecurity risk landscape, the status of ongoing mitigation efforts, and emerging incident trends. Additionally, these reports cover updates on third-party risk assessments, progress on cybersecurity initiatives such as technology upgrades, regulatory compliance measures, and employee training programs.


text: Identifying and assessing cybersecurity risk is integrated into our overall enterprise risk management systems and processes. Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through a multi-faceted approach including third party assessments, internal IT audits, IT security, governance, and risk and compliance reviews. To defend, detect and respond to cybersecurity incidents, we, among other things: conduct privacy and cybersecurity reviews of systems, applications, and applicable data policies; perform penetration testing using external third-party tools and techniques; conduct employee training; monitor emerging laws and regulations related to data protection and information security; and implement appropriate changes. We have implemented incident response and breach management processes that are overseen by leaders from our information security, engineering, compliance and legal teams regarding matters of cybersecurity. Security threats are evaluated, ranked by severity and prioritized for response and remediation. Potential data security incidents are investigated to determine operational and business impact, applicability of regulatory or contractual data privacy requirements, including state data breach notification statutes, and materiality. We conduct tabletop exercises to simulate responses to cybersecurity incidents and collaborate with technical and business stakeholders across our business units to form detection, mitigation and remediation strategies. We also maintain third party security procedures to identify, prioritize, assess, mitigate and remediate third party risks; however, we rely on the third parties we use to implement security programs commensurate with their risk, and we cannot ensure in all circumstances that their efforts will be successful.

companyName: EverQuote, Inc.

ticker: EVER


text: Our systems periodically experience directed attacks intended to lead to interruptions and delays in our service and operations as well as loss, misuse or theft of personal information (of third parties, employees, and our members) and other data, confidential information or intellectual property. However, to date these incidents have not had a material impact on our service, systems or business. Any significant disruption to our service or access to our systems could result in a loss of insurance provider customers, third-party publishers, other service providers, or consumer referrals and adversely affect our business and results of operation. Further, a penetration of our systems or a third-party's systems or misappropriation or misuse of personal information could subject us to business, regulatory, litigation and reputation risk, which could have a negative effect on our business, financial condition and results of operations. See "Item 1A. Risk Factors —Risks Related to Our Business and Industry— Our business could be materially and adversely affected by a cybersecurity breach or other attack involving our computer systems or our third-party service providers."


text: Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. Cybersecurity risks related to our business, technical operations, and privacy and compliance issues are identified and addressed through a multi-faceted approach including third-party assessments, IT security, governance, risk and compliance reviews. To defend, detect and respond to cybersecurity incidents, we, among other things: conduct proactive cybersecurity reviews of systems and applications, perform penetration testing using external third-party tools and techniques to test security controls, conduct employee training, utilize an expert third party to continuously monitor and respond to possible threats, monitor emerging laws and regulations related to data protection and information security and implement appropriate changes. We regularly collaborate with leading security providers, industry groups, and industry peers to exchange information on trends and best practices to address new and evolving cybersecurity risks.

companyName: ONTO INNOVATION INC.

ticker: ONTO


text: We also conduct tabletop exercises to simulate responses to cybersecurity incidents. Our team of cybersecurity professionals then collaborates with technical and business stakeholders across our business units to further analyze the risk to the Company, and form detection, mitigation and remediation strategies.


text: Cybersecurity Governance The Company's Board of Directors has oversight of information security matters at the Company, including reviewing the Company's cybersecurity practices. At least annually, the Vice President of IT presents the Company's information security policies and programs to the Board. Our Audit Committee is tasked with overseeing risks from cybersecurity threats. Members of the Audit Committee receive updates on cybersecurity matters on a quarterly basis from one or more representatives from the Company's Cyber Security Council ("CSC"), which is composed of our business unit general managers, other members of senior management, our Vice President of IT and our IT Security Manager. These updates include a discussion of existing and new cybersecurity risks (if any), updates on how management is addressing and/or mitigating those risks, and the status of information security initiatives. Other Board members also engage in conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs outside of the scheduled meetings.


text: We have also established a process whereby potentially material cybersecurity incidents are escalated to a Cybersecurity Disclosure Committee ("CDC") consisting of our CEO, CFO, Vice President and General Counsel, Vice President of IT and Corporate Controller. The CDC is tasked with evaluating whether such incidents have material impact on the Company, and thus require disclosure, as well as any other actions that may be appropriate in response to the incident. The CDC promptly notifies the Audit Committee if it determines that an incident is likely to have a material impact on the Company and updates the Audit Committee on a quarterly basis of any incidents that it has evaluated and determined were not material.


text: The Vice President of IT acts as our head of information security in leading our information security organization. Our Vice President of IT has over 25 years of industry experience leading large technology organizations, including, most recently, as the leader of the IT organization at a large privately held company. Team members who support our information security program have relevant educational and industry experience, including holding similar positions at other technology companies.


text: Risk Management and Strategy We recognize the critical importance of developing, implementing, and maintaining proactive cybersecurity measures to safeguard our information and operational systems and protect the confidentiality, integrity, and availability of our data. To that end, we engage in the following cybersecurity risk management principles:

companyName: Atlas Energy Solutions Inc.

ticker: AESI


text: Material Risks & Integrated Overall Risk Management We have strategically integrated cybersecurity risk management into our broader risk management framework to promote a Company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. Additionally, our proactive risk management approach is formed by a variety of established cybersecurity frameworks. The security function housed within our Technology department continuously evaluates and addresses cybersecurity risks in alignment with our business objectives and operational needs and in cooperation with our broader risk management team.


text: Proactive Risk Mitigation & Vulnerability Management We take a proactive approach to cybersecurity, evaluating the latest industry threats against our organization to ensure protection. This evaluation directly informs our security enhancements. For example, identified vulnerabilities or threat vectors prompt updates to firewalls, intrusion detection systems, email filtering and security training etc. We also perform real-time analyses, automate responses to suspicious activity, and maintain robust alerts. The results of these scans, along with threat intelligence, are used to prioritize vulnerability remediations and enhance long-term cyber security hardening efforts.


text: Third-Party Risk Management Advisors Recognizing the complexity and the evolving nature of cybersecurity threats, we engage with a range of external experts, including cybersecurity assessors, consultants, and auditors in evaluating and testing our cybersecurity program and practices. This ecosystem enables us to leverage specialized knowledge and insights, ensuring our cybersecurity program and practices remain attuned to our Company's particular needs and vulnerabilities. Our collaboration with these third-parties includes annual penetration tests on externally facing systems, annual external and internal risk assessments and subject matter expertise consultation on risk remediation and security enhancements.


text: Vendor Risk Oversight Given the risks associated with using third-party service providers, we have developed processes to oversee and manage these risks. We aim to start the assessment right from the vendor onboarding stage, by conducting security and background assessments of vendors prior to their engagement, and we endeavor to monitor ongoing relationships to ensure compliance with our cybersecurity standards. These processes are designed to mitigate risks related to data breaches or other security incidents originating from third parties.


text: Risks from Cybersecurity Threats As of the date of this Annual Report, though we and the third parties with whom we do business have experienced certain cybersecurity incidents, we are not aware of cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business, financial condition or results of operations. However, we recognize that cybersecurity threats are continually evolving, and there remains a risk that a cybersecurity incident could potentially negatively impact us. Despite the implementation of our cybersecurity processes, we cannot guarantee that a significant cybersecurity attack will not occur. A successful attack on our information or operational technology systems could have significant consequences to the business, including the interruption of key services that our customers depend on. While we devote resources to our security measures to protect our operations and information, these measures cannot provide absolute security.


text: The Board is aware of the critical nature of managing risks associated with cybersecurity threats given the significance of these threats to our operational integrity and stakeholder confidence. As such, the Board engages with our management team, as necessary, for updates on our cybersecurity risk program and progress on remediation efforts.


text: The Board is central to the Company's oversight of cybersecurity risks and bears the primary responsibility for this domain. The Board is composed of members with depth of experience in enterprise risk management, compliance, corporate governance, technology, finance, and the unique characteristics and vulnerabilities of the oil and gas industry, equipping them to oversee cybersecurity risks effectively.


text: Management's Risk Management Role Our VP of Technology plays a pivotal role in informing the Board on cybersecurity risks. As necessary, he provides briefings to the Board encompassing a broad range of topics, including: • the current cybersecurity landscape and emerging threats; • the status of ongoing cybersecurity initiatives and progress on remediation efforts; and • compliance with regulatory requirements and industry standards.


text: Cybersecurity Risk Management Personnel Our VP of Technology, Shaam Farooq, has primary responsibility for assessing, monitoring, and managing our cybersecurity risks. Mr. Farooq has over 25 years of experience in global technology leadership, having served as an enterprise CISO across multiple industries. He actively participates in the oil and gas cybersecurity community, ensuring our security strategy remains responsive to current industry threats and aligned with best practices. Shaam continues to refresh his Certified Information Systems Security Professional and Certified Information Security Manager trainings as necessary.


text: Cybersecurity Incident Monitoring The VP of Technology strives to be continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. The VP of Technology has implemented industry tools and oversees the processes for the regular monitoring of our information and operational technology systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the VP of Technology is equipped with an incident response plan (IRP). This comprehensive plan encompasses immediate actions like identification, containment, and eradication, mid-term objectives such as recovery, and long-term goals including forensic analysis and lessons learned. It also lists response parties as well as chain of command and reporting. We regularly test our incident preparedness through at least one annual drill and tabletop exercise. These activities simulate real-world attacks, allowing us to evaluate and refine our incident response plan. Drills focus on specific technical responses, while tabletop exercises involve key stakeholders walking through the response process to identify potential gaps. The insights gained from these exercises ensure our team is prepared to effectively respond to and recover from security incidents.


text: Reporting to Board The VP of Technology regularly informs the Chief Executive Officer regarding cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing the Company. In addition to briefings on an as-needed basis, any significant cybersecurity matters and strategic risk management decisions are escalated to the Audit Committee, ensuring that they have comprehensive oversight and can provide guidance on critical cybersecurity issues.


text: We do not believe that risks from cybersecurity threats of which we are currently aware, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. For additional information, see "A cyber-attack or security breach could cause a loss of confidential consumer data, give rise to remediation and other expenses, expose us to liability under privacy laws, consumer protection laws, common law and other legal theories, subject us to litigation and federal and state governmental inquiries, damage our reputation, result in interruptions or delays to services, adversely impact our financial results, and otherwise be disruptive to our business" included in Part I, Item 1A of this Form 10-K.

companyName: Addus HomeCare Corp

ticker: ADUS


text: Every quarter we evaluate our cybersecurity posture and reassess whether significant changes in our business could impact our digital infrastructure. These assessments aim to identify potential internal and external threats, estimate their probability and possible impact, and gauge the effectiveness of our current policies and processes in mitigating these threats.

companyName: Revolve Group, Inc.

ticker: RVLV


text: We have established a cybersecurity committee, composed of members of senior management, to provide guidance, management and oversight of our cybersecurity and data responsibility initiatives and risk assessment and mitigation protocols, including those described in the "Risk Management and Strategy" section above. Our chief architect, who has over 15 years of experience in software engineering and has served as our chief architect for eight years, is a member of our cybersecurity committee and works to manage our cybersecurity policies and processes. Our chief architect and cybersecurity committee stay informed and manage how we identify, address, prevent and resolve cybersecurity issues and related matters. This is done through regular checks of our systems, tests to identify security weaknesses and maintaining our incident response plan.


text: Our chief architect and the cybersecurity committee are responsible for our cybersecurity rules and methods, like those described in the "Risk Management and Strategy" section. They stay updated and track how we prevent, identify, lessen and address cybersecurity issues. This is done through regular checks of our systems, tests to find security weaknesses and having a plan ready to respond to any incidents. In addition to regular meetings and participation on the cybersecurity committee, the chief architect and co-chief executive officer regularly discuss active, emerging and potential cybersecurity risks. They keep each other informed about significant changes affecting cybersecurity, and they periodically update our board of directors or the audit committee about these changes as well as our cybersecurity risks, so that our board of directors can administer its oversight function as part of its broader oversight and risk management.


text: Our board of directors is responsible for overseeing our strategy and risk management process and discharges its duties both as a full board and through its committees. As reflected in the audit committee charter, our board has delegated to the audit committee oversight of our risk assessment and management process, including processes related to cybersecurity. The audit committee meets at least annually with management, our internal auditor and our contracted Chief Technology Officer to discuss our cybersecurity program in regards to potential significant financial or operational risk exposures and the measures implemented to monitor and address those risks, including those that may result from cybersecurity threats. As necessary or appropriate, these discussions may include our risk assessment and risk management policies. In addition to our multidisciplinary management team, we rely on our internal audit function in collaboration with a third-party information security service provider to lead our cybersecurity risk assessment and management processes and oversee their implementation and maintenance. We have a longstanding relationship with our third-party information security service provider, which includes services from our contracted Chief Technology Officer. The contracted Chief Technology Officer has approximately 16 years of information technology experience, including nine years in the finance and real estate sectors, and our Head of Internal Audit, has approximately 31 years of audit experience, including 21 years in the real estate and financial services sectors.

companyName: Easterly Government Properties, Inc.

ticker: DEA


text: Our cybersecurity risk management and strategy processes are led by our Chief Information Officer ("CIO") and are supported by the Senior Director of Enterprise Cybersecurity. These individuals are also supported by both dedicated cybersecurity professionals and third-party security service providers. Our CIO is responsible for leading our technology organization across our global portfolio, which includes ERP, commercial, supply chain, and product development technologies, enterprise architecture, infrastructure, cyber security, technical operations, end-user services, and finance and human resources systems. Our current interim CIO has over 30 years of experience in information technology matters. Our Senior Director of Enterprise Cybersecurity has over 30 years of expanding leadership experience in information technology and 18 years of experience in information security leading and developing security programs. Our CIO provides regular updates on cybersecurity matters to our senior executives. In the event of a cybersecurity incident or incidents, our incident response plan includes detailed processes designed to ensure that information is triaged from our information technology management team to our CIO and to other members of our management team in a timely manner such that senior leadership can assure critical decision support and oversight and otherwise monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents.

companyName: Fortune Brands Innovations, Inc.

ticker: FBIN


text: Cybersecurity-related risks are assessed as part of the enterprise risk management program. The Audit Committee is responsible for overseeing the Company's enterprise risk management program. The Audit Committee also oversees the Company's information technology systems and controls, including the cybersecurity program and related risks. Annually, management assesses and ranks the risks identified through the enterprise risk management program according to the likelihood of occurrence and the potential monetary impact, which the Audit Committee reviews. Management also identifies and provides the Audit Committee with quarterly updates on these risks.


text: The CIO typically provides the Audit Committee with cybersecurity updates on a quarterly basis. During such updates, the CIO generally covers topics such as data security positions, results from third-party assessments, our incident response plan, and any material cybersecurity threats and developments. In 2024, the CIO reported to the full Board of Directors on the Company's cybersecurity programs and risk mitigation efforts.


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including risks to our customer, vendor, and employee data and our systems. We conduct due diligence of third parties' information security programs, and cybersecurity considerations may inform our selection of third-party service providers. In certain circumstances, including in those where we believe a third party could introduce cybersecurity risk to us, we generally seek to contractually require such third parties to manage their cybersecurity risks in certain proscribed manners. We also receive the results of cybersecurity and data privacy audits conducted on certain vendors to determine if those vendors meet our cybersecurity standards.


text: We describe the risks that cybersecurity threats, including as a result of any previous cybersecurity incidents, pose to us that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "We may experience delays or outages in our information technology systems and computer networks and the third-party information technology systems and computer networks that we use. We may be subject to breaches of our information technology systems, the third-party information technology systems that we use or other cybersecurity incidents, which could damage our reputation and consumer relationships. Failures in our information technology systems or in the third-party information technology systems that we use and the costs of increasing information security regulation could also subject us to significant financial, legal and operational consequences" included as part of our risk factor disclosures under Item 1A of this Annual Report on Form 10-K, which disclosures are incorporated by reference herein. We have experienced, and will continue to experience, cybersecurity incidents in the normal course of our business. However, to our knowledge, we have not had any cybersecurity incidents in the past three years that have had a material adverse effect on our business, financial condition, results of operations, or cash flows.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. As part of our risk management program, we reference various security industry frameworks and other guidance, including the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF), HIPAA, Service Organization Control Type 2 (SOC 2 Type II), and Sarbanes-Oxley IT General Controls (SOX ITGC), to help us assess, identify and manage cybersecurity risks relevant to our business. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF, HIPAA, SOC 2 Type II, and SOX ITGC as guides to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Ceribell, Inc.

ticker: CBLL


text: Key elements of our cybersecurity risk management program include but are not limited to the following: • risk assessments are performed and designed to help identify material risks from cybersecurity threats to our critical systems and information; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers or third party software, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, including incident response personnel; • an incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party vendor risk management process for key service providers based on the security teams assessment of their criticality to our operations and respective risk profile.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See the risk factor titled, "Our business and operations may suffer in the event of information technology system failures, cyber attacks, or deficiencies in our cybersecurity." for additional information.


text: Cybersecurity Governance Our Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity risks, including oversight of management's implementation of our cybersecurity risk management program.


text: The Audit Committee receives quarterly reports from management on our cybersecurity risks. In addition, management updates the Committee, where it deems appropriate, regarding cybersecurity incidents it considers to be significant or potentially significant.


text: The Audit Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity. The full Board of Directors also periodically receives briefings from management on our cybersecurity risk management program. Members of the Board of Directors receive presentations on cybersecurity topics from our Executive Director Information Security as part of the Board of Directors' continuing education on topics that impact public companies.


text: Our management team, including the Executive Director of Information Security and Chief Technology Officer (CTO), are responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes a cumulative 22 years of experience in assessing and managing risk throughout organizations. In addition, hold industry specific certifications such as Certified Information Systems Auditor (CISA) and Certified Data Privacy Solutions Engineer (CDPSE).


text: Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence, other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in our IT environment.


text: We design and assess our program based on established frameworks, such as the CIS Critical Security Controls ("CIS Controls"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the CIS Controls as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Offerpad Solutions Inc.

ticker: OPAD


text: We have a comprehensive approach to mitigate cybersecurity risk which primarily focuses on three key elements: • people – security awareness education and readiness-testing throughout the year for employees; • process – incorporating "cyber awareness" in our day-to-day processes which includes constant review of alerting and detection to mitigate constant cybersecurity threats, regular review of security posture and security roadmap to ensure alignment throughout the organization, physical and digital asset protection and security vulnerability remediation via preventable and detective measures; and • technology – investing in industry aligned security technology and threat intelligence capabilities.

companyName: RANGE RESOURCES CORP

ticker: RRC


text: Cybersecurity governance is supported by our information technology department which includes certified security professionals and seasoned security analysts. This department conducts extensive ongoing reviews of our security initiatives to assess the current state of our program (using a cybersecurity framework) and potential evolution based on current business risks along with detection and communication of cybersecurity threats and actions to mitigate those threats. Our Director of IT Security is responsible for assessing, monitoring and managing risks from cybersecurity threats, overseeing our overall cybersecurity risk management program which includes prevention, mitigation, detection and remediation of cybersecurity incidents and supervises a team of cybersecurity personnel. Our Director of IT Security reports to our VP – Information Technology and is responsible for reporting material incidents to our Cybersecurity Risk Management Committee ("CRMC") that includes officers charged with reporting responsibilities. Cybersecurity incidents that meet a pre-determined minimum threshold are communicated upward to executive officers to determine overall materiality and disclosure obligations. Our Director of IT Security keeps the CRMC apprised of our processes to prevent, detect, mitigate and remediate cybersecurity incidents at least annually. Our internal cybersecurity team led by our Director of IT Security has over 75 years of combined experience in information security and maintains several cybersecurity certificates.


text: We conduct security assessments, manage user access, perform vulnerability scanning and patching, oversee monitoring and carry out annual penetration testing, in addition to other critical security functions. In conjunction with our internal team, we utilize an independent third-party operations center that is focused on, but not limited to, monitoring alerts, logs, behavior analytics, vulnerability notifications and remediation guidance. Critical infrastructure is continuously monitored to ensure accessibility and appropriate security posture. We also perform reviews and risk analysis for third-party software and platforms which sets a standardized security baseline. We monitor known third-party breaches, known software vulnerabilities that may affect third-party vendors and communicate as necessary with those vendors, allowing us to increase security of our technology assets and our data. In addition, we perform an annual cybersecurity risk assessment of critical third-party systems.


text: Our board of directors oversees our cybersecurity risk and receives, at a minimum, a quarterly cybersecurity report and a bi-annual update from IT leadership, which includes additional discussions of any relevant issues related to the understanding of technology and cybersecurity risk that may be relevant at any given time. This report includes, among other things, information regarding our current security posture and ongoing cybersecurity events. Cybersecurity incidents meeting a pre-determined minimum threshold are communicated to our Board.


text: To date, there have been no risks from cybersecurity threats because of any previous cybersecurity incidents, which have materially affected, or have been reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. For more information on our cybersecurity related risks, see Item 1A. Risk Factors of this Annual Report on Form 10-K.


text: Cybersecurity is the responsibility of our Chief Information Security Officer ("CISO") who oversees an information security team responsible for maintaining the confidentiality, integrity, and accessibility of data within CCC while continuously monitoring for and responding to cybersecurity threats, with oversight by our EVP, Chief Product and Technology Officer who is responsible for all of our IT systems. Our CISO has 18 years of experience managing risks from security threats and developing and implementing security policies and procedures, as well as relevant degrees and certifications, including a bachelor of science in information systems and cybersecurity and being a Certified Information Security Manager and a Certified Information Systems Security Professional. Our EVP, Chief Product and Technology Officer has over three decades of experience in the technology industry and holds a bachelor of science in computer science.

companyName: CCC Intelligent Solutions Holdings Inc.

ticker: CCC


text: Our Board has tasked the Audit Committee with oversight of enterprise risk management, including cybersecurity risk management. Our CISO or EVP, Chief Product and Technology Officer briefs the Audit Committee on cybersecurity risks at each of the quarterly meetings of the Audit Committee. These briefings include assessments of cyber risks, the threat landscape, updates on incidents, and reports on our investments in cybersecurity risk mitigation and governance. The Audit Committee and/or the EVP, Chief Product and Technology Officer also regularly briefs the entire Board on cybersecurity matters.


text: Our cybersecurity strategy prioritizes detection, analysis and response to known, anticipated or unexpected threats, effective management of security risks and resiliency against incidents. Our cybersecurity risk management processes include technical security controls, policy enforcement mechanisms, monitoring systems, contractual arrangements, tools and related services from third-party providers, and management oversight to assess, identify and manage risks from cybersecurity threats. We implement risk-based controls to protect our information, the information of our customers and other third parties, our information systems, our business operations, and our products and related services. We have adopted security-control principles based on the National Institute of Standards and Technology Cybersecurity Framework and contractual, industry and regulatory best practices and requirements.


text: We operate in the transportation and logistics sector, which is subject to various cybersecurity risks that could adversely affect our business, financial condition and results of operations. We have implemented a risk-based approach aligned with industry standards to identify and assess the cybersecurity threats that could affect our business and information systems. We conduct periodic risk assessments to identify the potential impact and likelihood of various cyber scenarios, including those involving third-party service providers, and to determine the appropriate mitigation strategies and controls. We use various tools and methodologies to manage cybersecurity risk, including implementation of a business continuity process that includes a comprehensive Incident Response Protocol that is tested on a regular cadence and an information security training and awareness program. We also monitor and evaluate our cybersecurity posture and performance on an ongoing basis through regular vulnerability scans, penetration tests and threat intelligence feeds. We require third-party service providers with access to personal, confidential or proprietary information to implement and maintain comprehensive cybersecurity practices consistent with applicable legal standards and industry best practices.

companyName: Hub Group, Inc.

ticker: HUBG


text: Our business depends on the availability, reliability, and security of our information systems, networks, data and intellectual property. Any disruption, compromise or breach of our systems or data due to a cybersecurity threat or incident could adversely affect our operations, customer service, product development and competitive position. They might also result in a breach of our contractual obligations or legal duties to protect the privacy and confidentiality of our stakeholders. Such a breach could expose us to business interruption, lost revenue, ransom payments, remediation costs, liabilities to affected parties, cybersecurity protection costs, lost assets, litigation, regulatory scrutiny and actions, reputational harm, customer dissatisfaction, harm to our vendor relationships or loss of market share. In the last three years prior to filing of this Form 10-K, we have not experienced any significant information security breach.


text: Our Board of Directors (the "Board") has direct oversight of cybersecurity risks and strategy and receives quarterly updates from our Chief Information Officer (CIO). The Board has also delegated to our Audit Committee responsibilities related to cybersecurity and other risks of our Company. Our CIO has spent over 20 years in engineering and product development roles and our VP of Information Security and Operations has spent over 25 years in infrastructure and cybersecurity roles including in the finance and insurance industries. Additionally, one of the independent directors on our Board and a member of our Audit Committee has significant experience leading technology and information systems at some of the country's leading healthcare organizations and adds to our Board substantial expertise and knowledge in information technology, privacy, data governance and cybersecurity. A cross-functional incident response team, which includes members of our management team, determines the apparent severity of reported potential incidents and operationalizes the cybersecurity incident response protocol.


text: To reduce the likelihood and severity of cybersecurity incidents, we established a comprehensive cybersecurity program designed to protect and preserve the confidentiality, integrity and availability of our technology systems and business operations more broadly. For a discussion of the risks associated with cybersecurity threats, see Item 1A. Risk Factors.

companyName: PUBLIC SERVICE ENTERPRISE GROUP INC

ticker: PEG


text: Risk Management and Strategy Our processes for assessing, identifying, and managing material risks from cybersecurity threats include: • Ongoing Assessment—The Cybersecurity department, led by the VP, Chief Information Security Officer (CISO), and reporting to the SVP, Chief Information and Digital Officer (CIDO) is staffed with cyber professionals tasked with the day-to-day responsibility of assessing material risks from cybersecurity threats. In addition, the Cybersecurity Council, comprised of senior management, is kept apprised of the state of PSEG's cybersecurity program, including any emerging risks, and provides guidance on the strategic directions of the program. • Engagement of Nth Parties—We engage Nth parties (third parties and other business relationships, including fourth parties, etc.), such as cybersecurity service providers, risk management firms, and external legal counsel, to assess material risks from cybersecurity threats and assess our internal incident response preparedness and cyber posture, support incident response, conduct tabletop exercises, and comply with applicable laws and regulations. We also carry cybersecurity insurance that provides certain protection against losses from a cybersecurity incident. Regulatory agencies, including but not limited to the NRC and Transportation Security Administration (TSA), as well as NERC, inspect applicable components of our cybersecurity program. • Nth-Party Service Provider Management— We maintain processes to oversee and identify risks from cybersecurity threats associated with our use of Nth-party service providers. This includes a risk-based vendor management program, which incorporates robust cybersecurity contractual provisions, vendor security assessments and, if appropriate, periodic audits. • Technical Safeguards—We manage controls to protect our network perimeter, internal IT and Operational Technology (OT) environments, such as internal and external firewalls, network intrusion detection and prevention, penetration testing, vulnerability assessments, threat intelligence, endpoint security and access controls. • Training and Awareness—We provide mandatory annual cybersecurity training for all personnel with network access, and additional education for personnel with access to industrial control systems and/or customer information systems; and conduct phishing exercises with progressive consequences for failures. Employees also receive periodic cybersecurity awareness messages and each year, in recognition of Cybersecurity Awareness Month, are invited to presentations throughout October from internal and external cyber experts covering diverse cyber topics. These efforts better enable all employees to identify potential cybersecurity risks and escalate them appropriately. • Incident Response Plans—We maintain and periodically update a cyber incident response plan that addresses the life cycle of a cybersecurity incident from a technical perspective (i.e., detection, response, and recovery), and a data breach response plan (with a focus on external communication/disclosure and legal compliance); and conduct regular tabletop exercises to test plan effectiveness (both internally and through external exercises). • Mobile Security—We maintain controls to prevent loss of data through mobile device channels.


text: • Physical Security—We also maintain physical security measures to protect our OT systems, consistent with a defense in-depth and risk-tiered approach. Physical security measures may include access control systems, video surveillance, around-the-clock command center monitoring, and physical barriers (such as fencing, walls, and bollards). Additional features of PSEG's physical security program include threat intelligence, insider threat mitigation, background checks, a threat level advisory system, a business interruption management model, and active coordination with federal, state, and local law enforcement officials. See Item 1. Business. Regulatory Issues—Federal Regulation for a discussion of Critical Infrastructure Protection standards that the NERC promulgated that mitigate risk associated with both cybersecurity and physical security of PSEG's critical facilities.


text: These processes are integral to our overall risk management system/processes and inform the identification and assessment of risks and mitigations through our Enterprise Risk Management (ERM) program. The ERM team, led by the SVP, Audit, Enterprise, Risk and Compliance (AERC) considers cybersecurity risks alongside other PSEG risks, and facilitates discussion with PSEG subject matter experts to identify cybersecurity risks, evaluate their potential severity and likelihood, identify mitigations, including those identified above, and assess the impact of those mitigations on residual risk. In addition, PSEG maintains a Risk Management Committee (RMC), responsible for assessing exposure to and determining PSEG's overall risk management strategy, including with respect to cybersecurity. The RMC, supported by the ERM function, is chaired by the SVP, AERC and consists of members of senior management including the CIDO and six of the CEO's other direct reports. In discharging its responsibilities related to cybersecurity threats, the RMC has received presentations from the CISO. To date, there has been no material impact or reasonably likely material impact on our business strategy, results of operations or financial condition from cybersecurity attacks or incidents, including as a result of prior cybersecurity incidents.


text: – PSEG Board of Directors (Board) Oversight of Risks from Cybersecurity Threats: • PSEG Board—The PSEG Board has ultimate responsibility for the oversight of risk management at PSEG, overseeing PSEG's risk management program and reviewing the most significant risks facing PSEG, including cybersecurity risks. The Governance, Nominating and Sustainability Committee of the PSEG Board reviews key enterprise risks, including cybersecurity risks, and recommends to the Board the mapping of each risk to an appropriate committee or the full Board, in accordance with the allocation of risk categories reflected in the charter of each committee. Through this process, cybersecurity risk is mapped primarily to the Board's Industrial Operations Committee (IOC), and also the Audit Committee. In providing oversight of risks from cybersecurity threats, the Board is informed of cybersecurity incidents as appropriate, by way of updates from Senior Management, pursuant to PSEG's Cybersecurity Event Escalation and Incident Response Practice, as administered by the CISO. • IOC—At the PSEG Board level, the IOC holds the primary responsibility, as enumerated in its charter, of overseeing PSEG's cybersecurity program and assessing overall compliance through active, independent and critical oversight. The IOC is informed about cybersecurity risks by the CIDO and/or the CISO, during the IOC's four regularly scheduled meetings per year, which each include cybersecurity as a standing agenda item. Cybersecurity updates to the IOC include discussions on OT and IT cyber risks, cybersecurity updates from the CISO and/or CIDO, and reviews of a corporate cybersecurity scorecard and other performance indicators. The CIDO and CISO regularly attend IOC meetings. In addition, the IOC meets with the CISO in executive session with no other members of management present. To ensure the full Board is kept informed about the cybersecurity risks discussed at the IOC meetings, the cybersecurity materials provided to the IOC are available for full viewing by all members of the Board, members of the Board who are not IOC members have a courtesy invitation to each IOC meeting, and the Chair of the IOC provides a summary of IOC meetings to the full Board, typically the day after the meeting takes place. • Audit Committee—The Audit Committee has the charter responsibility of overseeing cybersecurity risks related to financial reporting and internal controls. The Audit Committee receives a cybersecurity update twice a year from the CISO, either with the full Board or the IOC in attendance. Audit Committee members have a courtesy invitation to all IOC meetings, have full access to IOC meeting materials, and receive the summary of IOC meetings from the IOC Chair as noted above. • Governance, Nominating and Sustainability Committee and Audit Committee—These committees are briefed at least annually on enterprise-level risks and emerging risks, including those related to cybersecurity, and receive regular updates on PSEG RMC activities, including those related to cybersecurity.


text: • Board of Directors, IOC, and Audit Committee—In providing oversight of risks from cybersecurity threats, the Board, IOC, and Audit Committee are informed of cybersecurity risks through frequent reports on such topics as personnel and resources to monitor and address cybersecurity threats, technological advances in cybersecurity protection, rapidly evolving cybersecurity threats that may affect us and our industry, cybersecurity incident response and applicable cybersecurity laws, regulations and standards, as well as collaboration mechanisms with intelligence and enforcement agencies and industry groups to assure timely threat awareness and response coordination. In addition, risks associated with cybersecurity incidents, or potential incidents, are escalated by senior management promptly to the Board outside of regularly scheduled meetings, if appropriate. – Management's Role in Assessing and Managing Material Cybersecurity Risks:


text: The assessment and management of material risks from cyber threats is managed by the CIDO, CISO and Cybersecurity Council, as further described below.


text: • CIDO—The CIDO has had the overall responsibility for PSEG's cybersecurity since September 2022, including the assessment and management of material risks to PSEG from cybersecurity threats. The CIDO has served in that position since August 2020 and is a direct report to the CEO. The CIDO has over 25 years of energy experience inclusive of leading technology compliance with cybersecurity regulations for nuclear, transmission, gas and corporate assets. Our CIDO's experience includes leading the secure technology design, development, and deployment strategy for grid modernization efforts, including digital customer engagement platforms, advanced metering, enterprise asset management and distribution automation functionality.


text: As noted above, the CIDO provides cybersecurity updates to the Board or its Committees, regularly attends and provides updates with the CISO to the IOC, and has met with the IOC, without other members of management present, during the IOC executive sessions.


text: The CIDO remains informed about the monitoring, prevention, detection, mitigation, and remediation of cybersecurity incidents through the CISO and other members of the cybersecurity team, as appropriate, who are tasked with these responsibilities on a day-to-day basis.


text: • CISO—The CISO has day-to-day responsibility for PSEG's cybersecurity, including the assessment and management of material risks to PSEG from cybersecurity threats, and leads the cybersecurity team. The CISO served in this role since July 2024. Our CISO has over 20 years of experience in cybersecurity and served as a VP, CISO in the manufacturing/chemicals sector prior to joining PSEG. Our CISO also started her career at the Department of Defense and led cyber teams in the financial and retail sectors. Our CISO holds an MBA in strategy, an MSE in Computer Science, a BS in Computer Science, and multiple cybersecurity certifications, including Certified Information Systems Security Professional.


text: As noted above, the CISO provides cybersecurity updates during the four regularly scheduled IOC meetings and regularly meets with the IOC, without other members of management present, during executive sessions. The CISO remains informed about the monitoring, prevention, detection, mitigation, and remediation of cybersecurity incidents through the members of the CISO's cybersecurity team, who are tasked with these responsibilities on a day-to-day basis.


text: • Cybersecurity Council—The Cybersecurity Council, chaired by the CISO, ensures that senior management, and ultimately, the Board, are given the information required to exercise proper oversight over cybersecurity risks and that escalation procedures are followed. The Cybersecurity Council meets at least six times annually to receive reports on the state of PSEG's cybersecurity program, provide guidance on the strategic direction of the program, discuss emerging cybersecurity issues, and review the cybersecurity scorecard to measure performance of key risk indicators. The Cybersecurity Council receives presentations from the CISO, members of the Cybersecurity team, other IT domain experts, cybersecurity managing counsel and external cybersecurity experts, and participates in tabletop exercises led by external consultants. In addition to the CISO, the Cybersecurity Council members include the: (i) CIDO; (ii) EVP and General Counsel; (iii) EVP and CFO; (iv) President and COO of PSE (v) President of PSEG Nuclear and Chief Nuclear Officer; (vi) SVP – Corporate Citizenship; (vii) SVP – Chief Human Resources and Diversity Officer; (viii) VP of Corporate Security and Properties; (ix) SVP – AERC; (x) Project Executive Advisor; and (xi) Vice President and Controller. PSEG's Corporate Secretary and Managing Counsel – Cybersecurity serves as counsel to the Cybersecurity Council. In providing oversight of risks from cybersecurity threats, Senior Management is informed of cybersecurity risks through updates shared during Cybersecurity Council meetings and through notifications or updates by the CISO, pursuant to PSEG's Cybersecurity Event Escalation and Incident Response Practice. For a discussion of regulatory requirements relating to cybersecurity matters, see Item 1. Business—Regulatory Issues.


text: The energy sector, including electric and natural gas utility companies, has become the subject of cyberattacks with increased frequency and we, along with other utility companies, are the target of these frequent attacks. In addition, there is a growing reliance on third party providers which are also subject to attacks and breaches. Any unexpected failure, or unauthorized access to technology systems or third parties relied upon can result in the unavailability of systems or services, which can result in a loss of operating revenues, damage to our brand and reputation, and/or an increase in operating expenses and costs to repair or replace damaged assets. See "Risk Factors – Cyber Risk Factors" for further information.

companyName: AVISTA CORP

ticker: AVA


text: We mitigate cyber risk by maintaining an enterprise security program based on the National Institute of Standards and Technology Cyber Security Framework. This program includes trainings and exercises at all levels of the Company. Our security program incorporates enterprise business continuity which facilitates a business impact analysis of core functions for development of emergency operating and disaster recovery plans and coordinates annual testing and training exercises. In addition, there are independent third party and regulatory audits of our security program.


text: Flywire recognizes the critical importance of developing, implementing and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our and our client's data.

companyName: Flywire Corp

ticker: FLYW


text: Risk Management and Strategy Managing Material Risks and Integrated Overall Risk Management Flywire has strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration is designed to ensure that cybersecurity considerations are an integral part of our decision-making processes at every level. Our security and risk management team works closely with our IT department to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.


text: Engage Third-parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity threats, Flywire engages with a range of external experts, including cybersecurity assessors, consultants and auditors in evaluating and testing our risk management systems. These partnerships enable us to leverage specialized knowledge and insights to help ensure our cybersecurity strategies and processes remain at the forefront of industry best practices. Our collaboration with these third-parties includes regular audits, threat assessments and consultation on security enhancements.


text: Risk Management Personnel Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the CISO. With over 30 years of experience in the field of cybersecurity, the CISO brings a wealth of expertise to her role. Her background includes extensive experience as an enterprise CISO and she is well-recognized within the industry. Her in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies. Our CISO oversees our governance programs, tests our compliance with standards, remediates known risks, and leads our employee training program.


text: Reporting to Management and Board of Directors Our CISO, in her capacity, regularly informs our Chief Financial Officer (CFO), GC & CCO, COO and CEO of all aspects related to cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing Flywire. Furthermore, our CISO reports to the Board of Directors at a minimum twice a year, ensuring that they have comprehensive oversight and can provide guidance on significant cybersecurity matters, and strategic risk management decisions.


text: Although risks from cyber threats have not materially affected the Fund's business strategy, results of operations or financial condition as of December 31, 2024, Invesco continues to closely monitor cyber risk. In addition, security controls, no matter how well designed or implemented, may only mitigate and not fully eliminate risks. For more information regarding the risks we face from cybersecurity threats, please see "Due to the Increased Use of Technologies, Intentional and Unintentional Cyber Attacks Pose Operational and Information Security Risks" in Item 1A. Risk Factors.

companyName: Invesco DB Multi-Sector Commodity Trust


text: Although risks from cyber threats have not materially affected the Trust's business strategy, results of operations or financial condition as of December 31, 2024, Invesco continues to closely monitor cyber risk. In addition, security controls, no matter how well designed or implemented, may only mitigate and not fully eliminate risks. Additional information on cybersecurity risks the Trust faces is discussed in Part I, Item 1A "Risk Factors," which should be read in conjunction with the foregoing information.

companyName: Invesco CurrencyShares Australian Dollar Trust

ticker: FXA


text: Important to these programs is Invesco's investment in threat-intelligence, its active engage ment in industry and government security-related forums, and its utilization of external experts to challenge its program maturity, assess its controls and routinely test its capabilities.

companyName: Invesco CurrencyShares Canadian Dollar Trust

ticker: FXC


text: Risk Management and Strategy We have established policies and processes for assessing, identifying, managing and disclosing, as necessary, risks from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes as described below.

companyName: QuantumScape Corp

ticker: QS


text: We routinely assess material risks from cybersecurity threats, including from any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein. These risk assessments are designed to identify internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks. Following these risk assessments, we evaluate whether and how to re-design, implement, and maintain safeguards intended to address and minimize identified risks and continue monitoring and testing the effectiveness of such safeguards.


text: We devote significant resources and have designated senior management to manage the cybersecurity and information security risk assessment and mitigation process. We have established an internal security committee that includes members of our information security/technology, internal audit/compliance, finance and accounting, people operations, and legal teams, to instill a thoughtful security culture across our Company. Our employees and contractors are made aware of our cybersecurity policies through mandatory trainings during onboarding and on an annual basis. We also engage and consult with third parties in connection with our risk assessment processes, including advisors, consultants and auditors. These service providers assist us to design and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards.


text: The Company deploys multiple tools and processes to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents, both internal and associated with the use of any third-party service provider.


text: We have not experienced a material security breach in our systems, and, to our knowledge, there have not been any material compromises of our confidential information in our third-parties' systems, nor have we incurred any significant expenses or penalties to resolve or settle any security breach in the past three years. For additional information regarding whether any risks from cybersecurity threats are reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors – Our Business Risks – Our ability to manage our business is highly dependent on IT systems and our website, systems, and data we maintain may be subject to intentional or inadvertent disruption, security incidents, or alleged violations of laws, regulations, or other obligations relating to data handling that could adversely impact our reputation and future sales," in this Annual Report on Form 10-K.


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight function directly, as well as through the audit committee, which has been tasked with such oversight in the audit committee charter. The audit committee of our board of directors reviews cybersecurity and information security risks and mitigation strategies; the audit committee receives periodic updates on information security and privacy, and the full board receives at least an annual update.


text: Our information security team has many years of experience implementing cybersecurity at technology and research and development companies, and together with our internal information security committee, is primarily responsible for assessing and managing our material risks from cybersecurity threats.


text: Our head of information security periodically provides briefings to our internal security committee and to the audit committee and board of directors on an annual basis regarding our Company's cybersecurity risks and activities, including, as applicable, any recent cybersecurity incidents and related responses and remediation efforts, cybersecurity systems testing, activities of third parties, policies and the like. We have internal guidelines governing our identification, assessment, communication, and escalation upon the occurrence of a cybersecurity incident. Depending on the nature and severity of an incident, this process provides for escalating notification to a special executive security committee and the chair of the audit committee, among others as needed, to manage the Company's response.


text: We design and assess our program based on multiple cybersecurity frameworks, such as the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) and ISO 27001. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF, ISO 27001 and other frameworks as guides to help us identify, assess, and manage cybersecurity risks relevant to our business. Our program is assessed by third-party security auditors on a yearly basis through our SOC II Type 2 and SOX audit processes.

companyName: Zeta Global Holdings Corp.

ticker: ZETA


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • the use of external service providers, where appropriate, to monitor our cybersecurity posture on a 24/7 basis in a co-managed Security Operations Center (SOC); • the design and deployment of a Defense-In-Depth layered technical security implementation leveraging best-of-breed components; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.


text: Our management team, including our CIO, Chief Information Security Office (CISO) and General Counsel, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our CIO (to whom the CISO reports) regularly attends meetings of the Committee. Our management team's experience includes decades of experience working in information security, advanced education, and information security certifications. Kurt Baumgarten, CISO, has a long history of successfully leading Information Security Programs across a diverse array of organizations such as Linedata SA, Indigo Ag, and Matterport. Kurt has multiple security certifications, such as CISA, CRISC, CDPSE, CGEIT, and has earned a master's degree in information security from Norwich University as well as an MBA with a concentration in e-commerce. Dr. Jeffry Nimeroff, CIO, has a 25-year history of building technology groups and integrating Information Security programs at organizations ranging from startups like Hotsocket and Pet360 to established companies at various points in their lifecycle like CDnow, and Bertelsmann Music Group. Dr. Nimeroff has a PhD in Computer Science from the University of Pennsylvania.


text: Our Audit Committee oversees the application of our ICT systems and all risks relating to cybersecurity. Cybersecurity is a standing agenda item at each of the Audit Committee's regularly scheduled meetings and the committee may engage any external advisor as needed to advise on cybersecurity matters. The Audit Committee periodically reports on such matters to the Board of Directors as part of our overall risk management and oversight framework. We have also established a management-level disclosure committee (the "Disclosure Committee"). The Disclosure Committee, which consists of employees representing our legal, finance, IT, regulatory and clinical departments, is responsible for overseeing the preparation of our public disclosure materials and assessing the materiality of events within the Company. The Disclosure Committee is also responsible for conducting our cybersecurity risk assessment and ensures constituencies from across the Company are represented in such assessment. The Disclosure Committee monitors cybersecurity incidents and risk on an ongoing basis and may engage outside consultants as needed to assess and respond to cybersecurity incidents. The Disclosure Committee reports to the Audit Committee on a variety of matters, including cybersecurity risks. In addition, our Senior Vice President of Information Technology has significant experience managing IT departments, including with regard to cybersecurity risk management and compliance. We have also engaged a third party to provide technical information technology experience to the Disclosure Committee, Audit Committee and Board of Directors.

companyName: NewAmsterdam Pharma Co N.V.

ticker: NAMS


text: Cybersecurity Program Overview As part of our overall risk management processes and procedures, we have instituted a cybersecurity program designed to identify, assess and manage material risks from cybersecurity threats, including by engaging a third-party cybersecurity service provider, which communicates directly with our management and compliance personnel. The cyber risk management program involves risk assessments, implementation of security measures and ongoing monitoring of systems and networks, including networks on which we rely. Through our cybersecurity program, the current threat landscape is actively monitored in an effort to identify material risks arising from new and evolving cybersecurity threats. We engage external experts, including cybersecurity assessors, consultants and auditors to evaluate cybersecurity measures and risk management processes as needed. We also depend on and engage various third parties, including suppliers, vendors and service providers in connection with our operations. Our risk management, legal, and compliance personnel oversee and identify, including through a third-party cybersecurity service provider, material risks from cybersecurity threats associated with our use of such entities.

companyName: Trinity Capital Inc.

ticker: TRIN


text: Our information technology team, led by our Vice President of Information Technology, helps identify, assess, and manage our cybersecurity threats and risks. Our information technology team assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example analyzing threat reports, conducting audits, and using intelligence feeds.

companyName: Taysha Gene Therapies, Inc.

ticker: TSHA


text: Depending on the environment, systems, and data, we implement and maintain various technical, physical, and organizational measures, processes, standards, and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident detection and response, employee training, access controls, cyber insurance, and systems monitoring.


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "If our information technology systems or those third parties with whom we work or our data are or were compromised, we could experience adverse consequences resulting from such compromise, including, but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions to our operations such as our clinical trials; claims that we breached our data privacy and security laws; reputational harm; a loss of customers or sales; and other adverse consequences."


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Compliance Officer and Vice President of Information Technology, both of whom have previously served in management roles at other public biotechnology companies.


text: Internal and External Risk Evaluations An annual Information Technology Audit, which is facilitated by the Internal Audit Department, is conducted via a co-sourcing agreement with a third-party auditor. The objective of the IT audit is to evaluate the effectiveness and efficiency of operations, test the reliability of data and IT controls, and ensure compliance with applicable laws, regulations, guidance, and industry best practices. The audit scope addresses IT Governance, IT Management, IT Operations, and IT Security. Testing of the internal network environment and external network perimeter are included in the Results of the IT Audit and are reviewed with the IS Steering Committee and Company management. For any exceptions identified, a responsible party is assigned, and action plans are developed to address corrective measures. The final results of the IT Audit are reviewed with the Board Audit Committee. The status of unresolved audit issues along with their priority ratings is reported to both Management's IS Steering Committee and the Board Audit Committee at each meeting.

companyName: FARMERS & MERCHANTS BANCORP INC

ticker: FMAO


text: In addition, in accordance with Gramm-Leach-Bliley Act requirements regarding safeguarding and protecting customer information, an Information Security Risk Assessment is conducted at least annually by the Risk Department and reviewed with the Management Risk Committee, the ERM Committee, and the Board of Directors. A risk analysis is performed to evaluate current processes, identify information assets, and determine the adequacy of the safeguarding and protection of confidential customer information collected and maintained. For each information asset identified, the criticality of the asset, the threats to the defined asset, the likelihood of compromise of the asset, the business impact if an asset is compromised, and an overall risk rating for each asset are defined. The results of this assessment are reviewed with the IS Steering Committee and the Risk Committee and reported at least annually to the Board ERM Committee.


text: We maintain an information security program and governance framework that are designed to protect our information systems against risks related to cybersecurity.

companyName: STIFEL FINANCIAL CORP

ticker: SF


text: Cybersecurity Risk Management and Strategy We define information security and cybersecurity risk as the risk that the confidentiality, integrity, or availability of our information and information systems are impacted by unauthorized or unintended access, use, disclosure, disruption, modification, or destruction. Information security and cybersecurity risk are incorporated into our comprehensive Enterprise Risk Management ("ERM") program, which we use to identify, aggregate, monitor, report, and manage risks.