text: Risk Management and Strategy Our cybersecurity policies, standards, processes and practices are based on applicable laws and regulations and informed by industry standards and industry-recognized practices. Our strategy to assess, identify, and manage material cybersecurity risks is through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security, and availability of our information systems and data. We implement security measures and processes to identify, prevent, and mitigate cybersecurity threats and to effectively respond to cybersecurity incidents when they occur. Our cyber risk management includes: (1) enterprise risk management to identify top cybersecurity risks; (2) vulnerability management to identify software vulnerabilities and risks related to compute infrastructure; (3) vendor risk management to identify risks related to third parties and business partners, which includes pre-engagement review, use of contractual security provisions, and continued monitoring, as applicable; (4) privacy risk management to identify privacy risks in our product and platforms and ensure regulatory compliance; (5) security monitoring to analyze and assess threat activity in real time; and (6) security incident response to investigate, respond to, and mitigate cyber threats. We regularly engage third parties to identify risks in our underlying software and infrastructure, to provide threat intelligence, and to assist in triaging, identifying, and responding to cyber threats.

companyName: Nextdoor Holdings, Inc.

ticker: NXDR


text: In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents. For more information regarding cybersecurity risks that we face and potential impacts on our business related thereto, see the section entitled "Risk Factors — Security breaches, including improper access to or disclosure of our data or our neighbors' data, or other hacking and phishing attacks on our or third-party systems, could harm our reputation and adversely affect our business."

secItem: Item 1C


text: Our Board of Directors maintains oversight of risks from cybersecurity threats by meeting with and receiving periodic updates from our Chief Information Security Officer ("CISO"), via our Audit & Risk Committee, which is assigned oversight of cybersecurity risks. Our Audit & Risk Committee is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks to which the company is exposed and to implement processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents.


text: Our CISO, has over 20 years of experience in the technology and cybersecurity, including senior leadership roles in software security, penetration testing, and incident response. Our CISO attained and maintains multiple security certifications including CISSP (Certified Information Security Professional). Prior to Nextdoor, our CISO led Software Security at the Federal Reserve's National Incident Response Team.


text: Risk Management and Strategy We employ a comprehensive, cross-functional approach to assess, identify, and manage material cybersecurity risks, ensuring the confidentiality, security, and availability of our information systems and data. Our cybersecurity strategy is guided by applicable laws and regulations, industry standards, and best practices. We have established robust policies, standards, and processes to proactively safeguard our digital assets, mitigate risks, and respond effectively to cybersecurity incidents.


text: Our cyber risk management framework includes: (1) enterprise risk management to identify top cybersecurity risks; (2) vulnerability management to identify software vulnerabilities and infrastructure risks; (3) vendor risk management to identify risks related to third parties and business partners, which includes pre-engagement due diligence, use of contractual security provisions, and continued monitoring through risk-based periodic audits, as applicable; (4) privacy risk management to ensure regulatory compliance and proactively manage privacy risks across our products and platforms; (5) security monitoring to analyze and assess threat activity in real time; and (6) security incident response protocols to investigate, contain, and mitigate cybersecurity threats. To strengthen our defenses, we regularly engage third party experts to assess vulnerabilities, provide threat intelligence, and assist in triaging and responding to cyber incidents. We also conduct employee training on cybersecurity awareness, data protection, and threat response to reinforce our security culture.


text: In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents. For more information regarding cybersecurity risks that we face and potential impacts on our business related thereto, see the section entitled "Risk Factors — Security breaches, including improper access to or disclosure of our data or our neighbors' data, or other hacking and phishing attacks on our or third-party systems, could harm our reputation and adversely affect our business."


text: Our Board of Directors, as a whole and at a committee level, maintains oversight of cybersecurity risk management, with primary responsibility assigned to our Audit & Risk Committee. Comprising solely independent directors, our Audit & Risk Committee receives regular updates from our Chief Information Security Officer ("CISO") and is responsible for ensuring that management has processes in place to identify, assess, and mitigate cybersecurity risks. The Audit & Risk Committee collaborates with management to oversee the implementation of security measures, incident response plans, and ongoing risk management strategies.


text: Our CISO, who reports directly to the Chief Technology Officer, has over 15 years of experience in technology and cybersecurity matters, with expertise spanning IT leadership, incident response, enterprise security, and business technology. Our CISO holds multiple cloud and IT certifications and is an active thought leader in the cybersecurity space. Prior to joining Nextdoor, our CISO led Business Technology, IT and Cybersecurity at Workato, Inc. and held key roles at Peloton Interactive, Inc. and KPMG LLP, where they built and implemented business continuity and cyber resilience programs.


text: Cybersecurity Risk Management and Strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and personal information of employees and others ("Information Systems and Data"). We design and assess our program based on the International Standards Organization's (ISO) International standard "ISO 27001: Information security management systems", and "ISO 27002: Code of practice for information security controls". This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the ISO standards as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business."

companyName: OmniAb, Inc.

ticker: OABIW


text: Our information technology department with the assistance of third-party service providers help identify, assess and manage the Company's cybersecurity threats and risks. Our information technology department identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example: manual and automated cybersecurity tools such as malware scans, penetration testing, vulnerability testing such as phishing simulations and analysis of reported threats.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: employee training, access controls, data encryption, systems monitoring, regular patching of operating systems and software, a password policy, a written IT security incident response plan, and cybersecurity insurance coverage.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, the information technology department works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business and reports to the Audit Committee of the Board of Directors, which evaluates cybersecurity and information technology risk as well as other aspects of our overall enterprise risk.


text: We have not identified cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section titled "Risk Factor— Security breaches, loss of data and other disruptions could compromise sensitive information related to our business or prevent us from accessing critical information and expose us to liability, which could adversely affect our business and our reputation."


text: Cybersecurity Governance Our Board of Directors addresses the Company's cybersecurity risk management as part of its general oversight function. The Board of Directors' Audit Committee is responsible for overseeing the Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Vice President of Data Sciences and IT, who has prior work experience in information technology, and our Director of IT, who has experience in network security and systems administration. The Vice President of Data Sciences and IT and Director of IT have a combined 25 years of risk management experience. Our Vice President of Data Sciences and IT is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel.


text: Our IT security incident response plan is designed to escalate certain cybersecurity incidents to our IT Security Council depending on the circumstances. Our IT Security Council is made up of our Chief Executive Officer, Chief Financial Officer, Chief Legal Officer and Secretary, Vice President of Data Sciences and IT, and Director of IT. Based on the severity and materiality of the incident, the Company's IT security incident response plan also includes reporting to the Audit Committee of the Board of Directors for cybersecurity incidents. In addition, the Audit Committee receives regular reports from management concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them.


text: We have not identified cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section titled "Risk Factor— Security breaches, loss of data and other disruptions could compromise sensitive information related to our business or prevent us from accessing critical information and expose us to liability, which could adversely affect our business and our reputation."


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Vice President of Data Sciences and IT, who has prior work experience in information technology, and our Director of IT, who has experience in network security and systems administration, who are primarily responsible for assessing and managing our material risks from cybersecurity threats. The Vice President of Data Sciences and IT and Director of IT, who report to our Chief Financial Officer, have a combined 25 years of risk management experience. Our Vice President of Data Sciences and IT is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel.


text: Cybersecurity Risk Management We recognize the importance of developing, implementing, and maintaining cybersecurity measures designed to safeguard our information systems and protect the confidentiality, integrity, privacy, and availability of our data. We have implemented and integrated into our broader risk management framework a cybersecurity risk management program designed to promote a company-wide culture of cybersecurity risk awareness and management. Our cybersecurity risk management program includes a number of components, including periodic system audits and ongoing monitoring of critical risks from cybersecurity threats supported by third-party providers and technologies as well as automated tools. This process is designed to evaluate, assess, identify, and manage cyber risks in alignment with our business objectives and operational needs. In support of those efforts, we leverage a managed service provider ("MSP") and also engage with other third-party providers, consultants, and auditors to support our cyber risk management program, including periodic engagement of third parties to conduct security assessments and testing related to our computer systems. We have a process to implement mitigation plans to monitor and address identified cyber risks. Additionally, we have implemented an employee education program that is designed to raise awareness of cybersecurity threats, including risks posed by phishing attempts. We have implemented a process for this training to be included during the employee onboarding process and periodically thereafter.

companyName: Centessa Pharmaceuticals plc

ticker: CNTA


text: We rely on our vendor network to enable the performance of core research and development activities, including clinical trials. As part of our cybersecurity risk management program, we therefore maintain processes to, prior to onboarding and periodically thereafter, assess and review vendor standards around cybersecurity, incident management, and personal data processing, as applicable. Additionally, as appropriate, we include security requirements in vendor contracts.


text: We, like other companies in our industry, face a number of cybersecurity risks in connection with our business. Although our business strategy, results of operations, and financial condition have not, to date, been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, we have, from time to time, experienced threats to and security incidents related to our data and systems, including phishing attacks. For more information on our cybersecurity-related risks, see "Our internal computer systems have suffered, and our collaborators or other contractors or consultants may suffer from security breaches, which could result in a material disruption of our product development programs," in Item 1A "Risk Factors."


text: The Board of Directors has responsibility for oversight of cybersecurity risk management. As part of our enterprise risk management program, the Board has established oversight mechanisms that seek to implement effective governance in managing risks associated with cybersecurity threats.


text: Day-to-day responsibility for assessing, monitoring, and managing our cybersecurity risk management program rests with our IT Department, who consults with our MSP as well as members of our finance and legal teams as appropriate, and our Head of Compliance on cyber matters. Our Head of Compliance oversees our risk management governance and periodic compliance testing and works with our IT Department and other functions, as appropriate, on the mitigation and management of identified cyber risks. The IT Department, together with our MSP executes the cybersecurity strategy. The IT Department and Head of Compliance report periodically to the General Counsel as well as to our Governance, Risk Management, and Compliance Committee ("GRC Committee") on cyber matters. Our GRC Committee is responsible for monitoring and overseeing our overall enterprise risk management process, including assessing, identifying, and managing cybersecurity related risks as part of its annual assessment of critical risks facing the Company.


text: On at least an annual basis, the Head of Compliance, the General Counsel, the GRC Committee, and the IT Department, in consultation with our MSP, provide an update to the Board regarding critical cybersecurity risks and ongoing cybersecurity initiatives and strategies. We have implemented a process for significant cybersecurity matters and strategic risk management decisions related to cyber risks to be escalated to the GRC Committee and/or the Board, as appropriate.


text: The Board of Directors has responsibility for oversight of cybersecurity risk management. As part of our enterprise risk management program, the Board has established oversight mechanisms that seek to implement effective governance in managing risks associated with cybersecurity threats. In particular, the Audit Committee has been vested with cybersecurity governance mandate that includes defining the Company's cybersecurity strategy and implementation plan, performing regular oversight over Company's cybersecurity landscape, and assessing the impact of material cyber incidents, should they happen.


text: Day-to-day responsibility for assessing, monitoring, and managing our cybersecurity risk management program rests with our IT Department, supported by broader MSP's service team, and members of our finance and legal teams as appropriate, and our Head of Compliance on cyber matters. Our Head of Compliance oversees our risk management governance and periodic compliance testing and works with our IT Department and other functions, as appropriate, on the mitigation and management of identified cyber risks. The IT Department, supported by broader MSP's service team executes the cybersecurity strategy. The IT Department and Head of Compliance report periodically to the General Counsel as well as to our Governance, Risk Management, and Compliance Committee ("GRC Committee") on cyber matters. Our GRC Committee is responsible for monitoring and overseeing our overall enterprise risk management process, including assessing, identifying, and managing cybersecurity related risks as part of its annual assessment of critical risks facing the Company.


text: On at least an annual basis, the Head of Compliance, the General Counsel, the GRC Committee, and the IT Department, in consultation with our MSP, provide an update to the Audit Committee regarding critical cybersecurity risks and ongoing cybersecurity initiatives and strategies. We have implemented a process for significant cybersecurity matters and strategic risk management decisions related to cyber risks to be escalated to the GRC Committee and/or the Audit Committee, as appropriate.


text: Lafayette Square maintains a cybersecurity program which includes processes for assessing, identifying, and managing material risks from cybersecurity threats in the form of unauthorized occurrences that could result in adverse effects on the confidentiality, integrity, or availability of the Company's information systems (any such occurrence, a "Cybersecurity Incident"). The Company's business is dependent on the communications and information systems of the Adviser and other third-party service providers. The Adviser manages the Company's day-to-day operations and has implemented a cybersecurity program that applies to the Company and its operations.

companyName: Lafayette Square USA, Inc.


text: Cybersecurity Program Overview The Adviser has instituted a cybersecurity program designed to identify, assess, and mitigate cyber risks applicable to the Company. The cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Company relies. The Adviser actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Company. The Adviser maintains a comprehensive information security policy to manage risk which details procedures such as incident response, business continuity and disaster recovery management plans, penetration testing and quarterly cybersecurity training for all employees. The Adviser (through the Staffing Agreement with the Administrator) employs a Chief Technology Officer ("CTO"), Bobby Patnaik. Mr. Patnaik has more than twenty years of experience, including fourteen years in financial services. Prior to joining Lafayette, Mr. Patnaik worked at Goldman Sachs Asset Management rising to the Global Head of Institutional/Fund Reporting and Reference Data Technology after spending several years developing and leading middle and back-office technologies. Mr. Patnaik began his career working for several technology and telecommunication companies, including AT&T and Verizon.


text: The Company relies on the Adviser to engage external experts, including cybersecurity assessors, consultants, and auditors to evaluate cybersecurity measures and risk management processes, including those applicable to the Company. The Adviser has contracted with Salt Cybersecurity, LLC to serve as a virtual Chief Information Security Officer ("vCISO") and perform an annual information security program risk assessment and gap analysis based on the International Organization for Standardization (ISO) and International Electrotechnical Commission (IEC) standard (ISO/IEC 27001:2013). In addition, our vCISO conducts due diligence on each vendor we utilize to assess their levels of security when working with Lafayette Square data. The Adviser has also engaged a third-party cybersecurity firm, AG1, Inc. (dba AgileBlue), to act as Lafayette Square's outsourced security operation center ("SOC") and provide continuous monitoring of Lafayette Square issued devices for potential vulnerabilities with any threats escalated to the CTO.


text: Management's Role in Cybersecurity Risk Management The Company's management, including the Company's CCO, is responsible for assessing and managing material risks from cybersecurity threats. Lafayette Square's information security policy includes an incident response plan which specifies procedures for elevating, remediating, monitoring and communicating about Cybersecurity Incidents. A dedicated team of executive level leaders at the Adviser (the "Incident Response Team") including the Chief Risk Officer, Chief People Officer, Chief Compliance Officer and led by the Chief Technology Officer ensure Cybersecurity Incident containment, eradication, recovery and notification that is integrated in Lafayette Square's overall risk management. If a Cybersecurity Incident is detected, whether by way of penetration testing, a vulnerability scan conducted by the SOC, or otherwise, it will be reported to the Chief Technology Officer and Chief Compliance Officer who mobilize the Incident Response Team. The Incident Response Team will prepare the communications including alerting the Board of any material risks and any additional required reporting. The Chief Technology Officer is designated as the leader of the Incident Response Team and is designated to interface with key stakeholders including the Board.


text: Board Oversight of Cybersecurity Risks The Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from the Company's Chief Compliance Officer regarding the overall state of the Adviser's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Company are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. See "Item 1.A Risk Factors – We depend on information systems, and systems failures could significantly disrupt our business, which may, in turn, negatively affect the value of our Common Stock and our ability to pay distributions." for more details on how cybersecurity threats are reasonably likely to materially affect the Company including its business strategy, results of operations, or financial condition. During the reporting period, the Company has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition.


text: Cybersecurity Program Overview The Adviser has instituted a cybersecurity program designed to identify, assess, and mitigate cyber risks applicable to the Company. The cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Company relies. The Adviser actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Company. The Adviser maintains a comprehensive information security policy to manage risk which details procedures such as incident response, business continuity and disaster recovery management plans, penetration testing and quarterly cybersecurity training for all employees. The Adviser (through the Staffing Agreement with the Administrator) employs a Chief Technology Officer ("CTO"), Bobby Patnaik. Mr. Patnaik has more than twenty years of experience, including fourteen years in financial services. Prior to joining Lafayette, Mr.


text: Patnaik worked at Goldman Sachs Asset Management rising to the Global Head of Institutional/Fund Reporting and Reference Data Technology after spending several years developing and leading middle and back-office technologies. Mr. Verizon.


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Company are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. See " Item 1.A Risk Factors – We depend on information systems, and systems failures could significantly disrupt our business, which may, in turn, negatively affect the value of our Common Stock and our ability to pay distributions. " for more details on how cybersecurity threats are reasonably likely to materially affect the Company including its business strategy, results of operations, or financial condition. During the reporting period, the Company has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition.


text: Process for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats We maintain an incident response program. In the event of a cybersecurity incident, designated personnel are responsible for assessing the severity of an incident and associated threat, containing the threat, remediating the threat, including recovery of data and access to systems, analyzing any reporting obligations associated with the incident, and performing post-incident analysis and program enhancements. We maintain a Cybersecurity Policy, which includes an Incident Response Plan in the event of a significant cybersecurity incident. In the event of a significant cybersecurity incident, our IT Director will chair an incident response team to handle the incident. Such incident response team will include members of IT, finance (if applicable), legal, communications, human resources and any affected unit or department. IT, along with a designated forensic team, will use the Incident Response Plan to guide the response.

companyName: Nauticus Robotics, Inc.

ticker: KITT


text: Management Oversight The controls and processes employed to assess, identify and manage material risks from cybersecurity threats are implemented and overseen by our IT Director. Our IT Director has over 10 years of experience addressing cybersecurity risks. Our IT Director is responsible for the day-to-day management of the cybersecurity program, including the prevention, detection, investigation, response to, and recovery from cybersecurity threats and incidents, and is regularly engaged to help ensure the cybersecurity program functions effectively in the face of evolving cybersecurity threats. Our Chief Technology Officer oversees the IT Director and briefs our board of directors on cybersecurity matters, including the nature and design of our cybersecurity program, and threats, events, and program enhancements.


text: On a regular basis, our IT Director will report to our board of directors on cybersecurity matters, including key risks, the potential impact of those exposures on our business, financial condition, results of operations, cash flows, reputation and prospects, and the programs and steps implemented by our management team to monitor and mitigate risks.


text: As of the date of this Annual Report on Form 10-K, we are not aware of any previous cybersecurity incidents that have materially affected our business, financial condition, results of operations, cash flows, reputation and prospects or that are reasonably likely to have such a material effect. While we have implemented a cybersecurity program, the techniques used to infiltrate information technology systems continue to evolve. Accordingly, we may not be able to timely detect threats or anticipate and implement adequate security measures. For additional information regarding risks relating to privacy and cybersecurity, see "Item 1A—Risk Factors—Risks Related to Our Business."


text: Process for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats We maintain an incident response program. In the event of a cybersecurity incident, designated personnel are responsible for assessing the severity of an incident and associated threat, containing the threat, remediating the threat, including recovery of data and access to systems, analyzing any reporting obligations associated with the incident, and performing post-incident analysis and program enhancements. We maintain a Cybersecurity Policy, which includes an Incident Response Plan in the event of a significant cybersecurity incident. In the event of a significant cybersecurity incident, our IT Systems Administrator will chair an incident response team to handle the incident. Such incident response team will include members of IT, finance (if applicable), legal, communications, human resources and any affected unit or department. IT, along with a designated forensic team, will use the Incident Response Plan to guide the response.


text: Management Oversight The controls and processes employed to assess, identify and manage material risks from cybersecurity threats are implemented and overseen by our IT Systems Administrator. Our IT Systems Administrator has 15 years in total network and system administration experiences, 8 of which are experience addressing cybersecurity risks. Our IT Systems Administrator is responsible for the day-to-day management of the cybersecurity program, including the prevention, detection, investigation, response to, and recovery from cybersecurity threats and incidents, and is regularly engaged to help ensure the cybersecurity program functions effectively in the face of evolving cybersecurity threats. Our Vice President of Corporate Development & Administration oversees the IT Systems Administrator and briefs our board of directors on cybersecurity matters, including the nature and design of our cybersecurity program, and threats, events, and program enhancements.


text: In its oversight role, our board of directors considers risks, including with respect to privacy, information technology and cybersecurity and threats to technology infrastructure.


text: On a regular basis, our Vice President of Corporate Development & Administration will report to our board of directors on cybersecurity matters, including key risks, the potential impact of those exposures on our business, financial condition, results of operations, cash flows, reputation and prospects, and the programs and steps implemented by our management team to monitor and mitigate risks.


text: Cybersecurity Risks Our cybersecurity risk management processes are integrated into our overall approach to risk management. Given our nature and size, we do not have a dedicated enterprise risk function, but our management team regularly considers and evaluates the cybersecurity risks. As part of that risk management process, our management team identifies, assesses and evaluates risks impacting our operations, including those risks related to cybersecurity, and raise them for internal discussion, and where it is determined to be appropriate, issues are also raised to our board of directors for consideration.


text: The Fund faces risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows or reputation. See "Risk Factors – Risks Related to Cybersecurity" for further information on how our operations are subject to cyber incidents that could have a material adverse effect on our business, financial condition, results of operations, and cash flows.

companyName: WTI Fund X, Inc.


text: Risk Management Oversight and Governance Our Board of Trustees oversees our enterprise risk management strategy, including our strategy on cybersecurity risks, directly and through its committees. In this respect, the Audit Committee of the Board of Trustees (the "Audit Committee")

companyName: Carlyle Secured Lending III


text: oversees our risk management program, which focuses on the most significant risks we face in the short-, intermediate-, and long-term timeframe. Audit Committee meetings include discussions of specific risk areas throughout the year, including, among others, those relating to cybersecurity, and reports from Carlyle on our enterprise risk profile on an annual basis. In addition, Carlyle's Chief Information Security Officer ("CISO") leads our cybersecurity program, chairs Carlyle's Information Security Steering Committee ("ISSC"), and provides cybersecurity status reporting to our Audit Committee at least annually. The ISSC meets quarterly and ensures that cybersecurity initiatives are in alignment with Carlyle's strategic priorities.


text: As part of its enterprise risk management ("ERM") framework, Morgan Stanley has implemented and maintains a program to assess, identify, and manage risks arising from the cybersecurity threats confronting the Firm ("Cybersecurity Program"). Morgan Stanley's Cybersecurity Program helps protect the Firm's clients, customers, employees, property, products, services, and reputation by seeking to preserve the confidentiality, integrity, and availability of information, enable the secure delivery of financial services, and protect the business and the safe operation of our technology systems, including as applicable to the Company and its unitholders. Morgan Stanley continually adjusts its Cybersecurity Program to address the evolving cybersecurity threat landscape and comply with extensive legal and regulatory expectations.

companyName: North Haven Private Income Fund LLC


text: Processes for assessing, identifying, and managing material risks from cybersecurity threats Morgan Stanley's Cybersecurity Program takes into account industry best practices and addresses risks from cybersecurity threats to the Firm's network, infrastructure, computing environment, and the third-parties Morgan Stanley relies on, including third parties relied on by the Company. Morgan Stanley periodically assesses the design of its cybersecurity controls against the Cyber Risk Institute Cyber Profile, which is based on the National Institute of Standards and Technology Cybersecurity ("NIST") Framework for Improving Critical Infrastructure Cybersecurity, as well as against global cybersecurity regulations, and develops improvements to those controls in response to those assessments. Morgan Stanley's Cybersecurity Program also includes cybersecurity and information security policies, procedures, and technologies that are designed to address regulatory requirements and protect Morgan Stanley's clients', employees' and own data, and the data of the Company and its officers and unitholders, against unauthorized disclosure, modification, and misuse. These policies, procedures, and technologies cover a broad range of areas, including: identification of internal and external threats, access control, data security, protective controls, detection of malicious or unauthorized activity, incident response, and recovery planning.


text: Morgan Stanley and Company Management's role in assessing and managing material risks from cybersecurity threats Morgan Stanley's Cybersecurity Program is operated and maintained by its management, including the Chief Information Officer ("CIO") of Cyber, Data, Risk and Resilience and the Chief Information Security Officer ("CISO"). These senior officers are responsible for assessing and managing the Firm's cybersecurity risks, which includes cybersecurity risks faced by the Company. Morgan Stanley's Cybersecurity Program strategy, which is set by the CISO and overseen by the Morgan Stanley's Head of Operational Cyber, Technology, and Information Security Non-Financial Risk ("Head of NFR CTIS"), is informed by various risk and control assessments, control testing, external assessments, threat intelligence, and public and private information sharing. Morgan Stanley's Cybersecurity Program also includes processes for escalating and considering the materiality of incidents that impact the Firm and the Company, including escalation to senior management of Morgan Stanley, the MS Board, and management of the Company.


text: Our cybersecurity program includes some key aspects such as (i) a Cybersecurity Leader who oversees our day-to-day program and who is a long-standing member of both the ISC2 and ISACA organizations, which specialize in cybersecurity and governance, (ii) a cybersecurity council comprised of a cross-section of management with oversight over our program, (iii) incident response, and (iv) ongoing security awareness training.

companyName: Nextpower Inc.

ticker: NXT


text: As of the date of this report, we are not aware of any cybersecurity threats or incidents that have materially affected or are reasonably expected to materially affect our business. However, we acknowledge the evolving nature of cybersecurity threats and remain committed to enhancing our protective measures as needed. For more detailed information about our company's specific cybersecurity risks, please refer to the risk factor titled "Cybersecurity or other data security incidents could harm our business, expose us to liability and cause reputational damage" in Item 1A. Risk Factors of this Annual Report on Form 10-K.


text: Management is responsible for day-to-day risk management activities, including identifying and assessing cybersecurity risks, establishing processes to ensure that potential cybersecurity risk exposures are monitored, implementing appropriate mitigation or remediation measures and maintaining cybersecurity programs. Our cybersecurity programs are under the direction of our Cybersecurity Leader. Our Cybersecurity Leader reports regularly to the cybersecurity council, management and the Audit Committee concerning our significant cybersecurity threats and risks, the processes we have implemented to address them, and various reports, summaries, or presentations on cybersecurity threats, risks, and mitigation. The Audit Committee also reports to our Board of Directors on cybersecurity matters as needed.


text: We believe that cybersecurity is fundamental to how we operate and as such we focus on defining and managing our cybersecurity risk. With the ever-changing cybersecurity landscape and continual emergence of new threats, our Board of Directors, Audit Committee and senior management team ensure that significant resources are devoted to cybersecurity risk management and the technologies, processes and people that support it. We have an Enterprise Risk Management Committee, comprising senior leaders from key functions, and a Cybersecurity Risk Committee which utilize the National Institute of Standards and Technology ("NIST") framework to ensure that these risks are clearly and effectively categorized and treated.

companyName: GXO Logistics, Inc.

ticker: GXO


text: We utilize comprehensive and widespread information sources and services (including third-party threat intelligence) to understand the threat landscape faced by the Company and design our protective controls accordingly using a defense-in-depth approach. The layers of these defenses are aligned to the NIST framework; Identify, Protect, Detect, Respond and Recover. The Enterprise Risk Management Committee and Cybersecurity Risk Management Committee meet regularly to consider any change to risk levels and ensure that the Company's cybersecurity controls remain commensurate to those risk levels.


text: The Company's Chief Information Security Officer ("CISO") is responsible for developing and implementing our cybersecurity program and reporting on related matters to our Board of Directors. The CISO has over a decade of experience leading cybersecurity functions and over two decades in cybersecurity. The CISO leads a global team of highly trained experts covering all major cybersecurity functions including Technical Engineering and Architecture, Governance Risk and Compliance, Security Operations and Incident Response, Threat and Vulnerability Management and Security Awareness. The technologies, policies and processes associated with these functions are tested by third parties at least annually to ensure continued effectiveness and identify any opportunities for improvement. These tests and assessments are useful tools for maintaining a robust cybersecurity program to protect our investors, customers, employees, vendors and intellectual property.


text: A full suite of cybersecurity policies exists and is applicable to all employees globally. These policies are reviewed annually and approved by relevant senior leaders. All Company employees are required to complete cybersecurity training annually, with quarterly "refreshers" throughout the year.


text: We invest in our cybersecurity defenses and have implemented multiple layers of protection against all known critical threats. We have high levels of compliance to protective controls on our technical estate, robust perimeter defenses, industry-leading filtering and analysis of web and email traffic, widespread multi-factor authentication, continuous training of our employees through educational material or simulation (e.g., phishing) and 24/7 monitoring of the IT estate. We have our own "red team" that is always searching our own environment for signs of vulnerability and have a well-defined Cyber Incident Response Plan ("CIRP") that is performed as a table-top exercise at least annually. A range of dashboards has been designed for use by the cybersecurity management team to monitor the day-to-day performance of the cybersecurity defenses and immediately remediate any sign of concern.


text: All third-party vendors utilized by GXO undergo a cybersecurity assessment at the time of engagement. This assessment scrutinizes the third party's cybersecurity maturity to ascertain the level of risk the third party may present to the systems and data of GXO and its customers.


text: Our Audit Committee and our Board of Directors actively participate in discussions with management and among themselves regarding cybersecurity risks. In addition, our Board receives regular cybersecurity reports, which include a review of key performance and risk indicators, test results and related remediation and recent threats and how the Company is managing those threats.


text: Despite the continuous risk faced by the Company, we have suffered no incidents that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition, nor have we had any widespread intrusion or incident. Notwithstanding the exhaustive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on our business, results of operations and financial condition. While GXO maintains cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. See Item 1A. "Risk Factors" for a discussion of cybersecurity risks.


text: We believe that cybersecurity is fundamental to how we operate and as such we place significant focus on defining and managing our cybersecurity risk. With the ever-changing cybersecurity landscape and continual emergence of new threats, our Board of Directors, Audit Committee and senior management team ensure that significant resources are devoted to cybersecurity risk management and the technologies, processes and people that support it. We have an Enterprise Risk Management Committee, comprising senior leaders from key functions, and a Cybersecurity Risk Committee which utilize the National Institute of Standards and Technology ("NIST") framework to ensure that these risks are clearly and effectively categorized and treated.


text: We utilize comprehensive and widespread information sources and services (including third-party threat intelligence) to understand the threat landscape faced by the Company and design our protective controls accordingly using a defense-in-depth approach. The layers of these defenses are aligned to the NIST framework; Govern, Identify, Protect, Detect, Respond and Recover. The Enterprise Risk Management Committee and Cybersecurity Risk Management Committee meet regularly to consider any change to risk levels and ensure that the Company's cybersecurity controls remain commensurate to those risk levels. These controls and their performance are constantly evaluated and evolved to ensure that the Company remains well protected against any new threats.


text: The Company's Chief Information Security Officer ("CISO") is responsible for developing and implementing our cybersecurity program and reporting on related matters to our Board of Directors. The CISO has over two decades of cyber security experience in a variety of industries including banking, aerospace, manufacturing and defense. A decade of this experience has been in senior leadership roles. The CISO leads a global team of highly trained experts covering all major cybersecurity functions including Technical Engineering and Architecture, Governance Risk and Compliance, Security Operations and Incident Response, Threat and Vulnerability Management and Security Awareness. The technologies, policies and processes associated with these functions are tested by third parties at least annually to ensure continued effectiveness and identify any opportunities for improvement. These tests and assessments are useful tools for maintaining a robust cybersecurity program to protect our investors, customers, employees, vendors and intellectual property.


text: A full suite of cybersecurity policies exists and is applicable to all employees globally. These policies are reviewed annually and approved by relevant senior leaders. All Company employees are required to complete cybersecurity training annually, with quarterly "refreshers" throughout the year. An advanced phishing simulation program exists at the Company and all employees are tested at least monthly on their ability to identify phishing emails.


text: We invest in our cybersecurity defenses and have implemented multiple layers of protection against all known critical threats. We have high levels of compliance to protective controls on our technical estate, robust perimeter defenses, industry-leading filtering and analysis of web and email traffic, widespread multi-factor authentication, continuous training of our employees through educational material or simulation (e.g., phishing) and 24/7 monitoring of the IT estate. We have a robust and up-to-date Cyber Incident Response Plan ("CIRP") that is performed as a table-top exercise at least annually. A range of dashboards has been designed for use by the cybersecurity management team to monitor the day-to-day performance of the cybersecurity defenses and immediately remediate any sign of concern.


text: All third-party vendors utilized by GXO undergo a cybersecurity assessment at the time of engagement. This assessment scrutinizes the third party's cybersecurity maturity to ascertain the level of risk the third party may present to the systems and data of GXO and its customers. Additionally, these vendors' security maturity is constantly monitored via a third-party service.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for certain service providers, suppliers, and vendors that have access to our critical systems and information.

companyName: EverCommerce Inc.

ticker: EVCM


text: Cybersecurity Governance Our board of directors (the "Board") considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee ("Committee") oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on relevant cybersecurity topics from our Senior Vice President of Security Operations and internal security staff.


text: Our management team, including our Senior Vice President of Security Operations and the Security Operations team, is responsible for assessing and managing our material risks from cybersecurity threats. The Security Operations team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants and contractors. Our Security Operations team includes members with a variety and depth of experience in cybersecurity matters, with more than 80 years of combined cybersecurity experience amongst the team members and the Senior Vice President of Security Operations with more than 30 years of information technology and cybersecurity experience throughout his career. The Senior Vice President of Security Operations holds Certified Information Systems Security Professional and Certified Identity and Access Manager certifications, while the penetration testing team leader holds Offensive Security Certified Professional and Certified Red Team Operator certifications and the additional Security Operations team members hold a Security + certification.


text: Our Security Operations team, in coordination with our legal and compliance teams, supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment. Our Security Operations team meets monthly with key executives and management to provide updates regarding the Company's cybersecurity efforts. For more information, see the section titled "Risk Factor— Unauthorized disclosure, destruction or modification of data, disruption of our software or services or cyber breaches could expose us to liability, protracted and costly litigation and damage our reputation."


text: Our management team, including our Chief Information Security Officer (CISO)/Senior Vice President of Information Technology and Security (SVP), is responsible for assessing and managing, and mitigating cyber risk and security threats. The Security team has primary responsibility for our overall cybersecurity risk management program and supervises both internal cybersecurity personnel and external cybersecurity consultants and contractors. The Security team members have diverse experience in security strategy, architecture, and operations. Additionally, the CISO/SVP has more than 30 years' experience leading transformative security and technology. The CISO/SVP has earned the following certifications: Certified Information Systems Manager, Department of Homeland Security, Certified Incident Command, Certified Technical Emergency Response Training, Certified Incident Response, and the penetration testing team leader holds Offensive Security Certified Professional and Certified Red Team Operator certifications and the additional Security Operations team members hold a Security + certification.


text: Cyber Risk Management and Strategy We have adopted cybersecurity risk management processes that are informed by and incorporate elements of recognized industry standards, such as the National Institute of Standards and Technology Cybersecurity Framework, and that are designed to identify, assess, and mitigate critical risks from cybersecurity threats.

companyName: Senti Biosciences, Inc.

ticker: SNTI


text: To support our cybersecurity risk management processes, we leverage a third-party Information Security Coordinator who provides ongoing support for the protection of our information technology infrastructure and also engage with other third-party providers and cybersecurity consultants as appropriate, including engagement of third parties to assist with managed detection and response. Additionally, our cybersecurity risk management strategy is informed by a recent risk assessment conducted by a third-party cybersecurity consultant.


text: We have an employee security awareness training program, required upon onboarding and on an annual basis thereafter, that is designed to raise awareness of cybersecurity threats across functions as well as to encourage consideration of cybersecurity risks across our Company. As part of this employee training program, we periodically conduct phishing simulations designed to raise employee awareness of such risks.


text: We have also implemented a process to assess and review the cybersecurity practices of certain third-party vendors and service providers, such as software-as-a-service providers whose products are used to store our data, including through review of System and Organization Controls (SOC) reports prior to onboarding.


text: Governance Related to Cybersecurity Risks Our Information Security Coordinator is responsible for the establishment and maintenance of our cybersecurity risk management processes, including the day-to-day oversight of the assessment and management of cybersecurity risks. The individual who is currently in this role has approximately 20 years of experience in information security. Our Information Security Coordinator reports to, and meets periodically with, our Director of Operations to discuss and review our information security and cybersecurity risk management processes.


text: Our board of directors has delegated oversight of the Company's enterprise risk management processes, including those related to cybersecurity risks, to the audit committee of the board of directors. We have implemented a process for our Information Security Coordinator, as appropriate, to provide periodic updates to the audit committee on the status of our cybersecurity program.


text: Cybersecurity Risk Management and Strategy We have adopted cybersecurity risk management processes that are informed by and incorporate elements of recognized industry standards, such as the National Institute of Standards and Technology Cybersecurity Framework, and that are designed to identify, assess, and mitigate critical risks from cybersecurity threats.


text: To support our cybersecurity risk management processes, we leverage a third-party information security firm ("Information Security Coordinator") who provides ongoing support for the protection of our information technology infrastructure and also engage with other third-party providers and cybersecurity consultants as appropriate, including engagement of third parties to assist with managed detection and response. Additionally, our cybersecurity risk management strategy is informed by a risk assessment conducted by a third-party cybersecurity consultant.


text: We have also implemented a process to assess and review the cybersecurity practices of certain third-party vendors and service providers, such as software-as-a-service providers whose products are used to store our data, including through review of System and Organization Controls ("SOC") reports prior to onboarding.


text: Governance Related to Cybersecurity Risks Our Information Security Coordinator is responsible for the maintenance of our cybersecurity risk management processes, including the day-to-day oversight of the assessment and management of cybersecurity risks. The individual who is currently in this role has approximately 20 years of experience in information security. Our Information Security Coordinator meets periodically with our Director of Operations, to discuss and review our information security and cybersecurity risk management processes.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan. We design and assess our program based on the National Institute of Standards ("NIST"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use NIST as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Bridge Investment Group Holdings Inc.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across our enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas. Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.


text: We have not identified risks from cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Cybersecurity Governance Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program. Management regularly reports on our cybersecurity risks to the Audit Committee. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as incidents with lesser impact potential.


text: The Audit Committee reports to the full board of directors regarding its activities, including those related to cybersecurity. The full board of directors also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Chief Technology Officer, internal security staff or external experts as part of the board of directors' continuing education on topics that impact public companies.


text: Our management team, including our Chief Operating Officer, Chief Financial Officer, Chief Compliance Officer, Chief Technology Officer and Head of Risk Management, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Chief Technology Officer, Scott Cardenas, is responsible for all aspects of technology across the Company and has extensive experience in cybersecurity and technology, including 15 years of experience managing technology organizations. Before joining the Company in 2018, Mr. Cardenas was chief technology officer for Kiewit Corporation and chief technology officer for the City and County of Denver before being promoted to chief information officer. Mr. Cardenas received a B.S. in Computer Information Systems and Management from Metropolitan State University of Denver and a M.B.A. from the University of Denver. As Chief Technology Officer, Mr. Cardenas is a member of the Company's Risk Management Committee, a cross-functional committee that governs and oversees our cybersecurity risk management program, among other responsibilities and includes the Chief Operating Officer, Chief Financial Officer, General Counsel, Chief Compliance Officer, Chief Technology Officer, and Head of Risk Management and Director of Internal Audit.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include: briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology environment.


text: Risk Management and Strategy We employ a risk management strategy for the assessment, identification and management of material risks stemming from cybersecurity threats. Our methodologies involve a systematic evaluation of potential threats, vulnerabilities, and their potential impacts on our organization's operations, data, and systems. Our cybersecurity risk management program includes: • Risk assessments designed to help identify material cybersecurity risks to our critical systems, and our IT environment; • The use of external service providers to assess, test or otherwise assist with aspects of our security controls; • Cybersecurity awareness training of our employees and senior management through the use of third-party providers for regular mandatory trainings; • A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • We design and assess our program using the National Institute Cybersecurity Framework ("NIST CSF") as a set of guiding principles.

companyName: NewLake Capital Partners, Inc.

ticker: NLCP


text: We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – The occurrence of cyber incidents or cyberattacks could disrupt our operations, result in the loss of confidential information and/or damage our business relationships and reputation.


text: Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program. The Committee receives periodic reports from management on our potential cybersecurity risks and threats and receives presentations on cybersecurity topics. In addition, management works collaboratively with our third-party provider to test our systems security processes and prevent, monitor, detect, mediate and remediate cybersecurity threats and incidents, and will report such threats and incidents to the Audit Committee when appropriate. The Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity.


text: As of the date of this Annual Report on Form 10-K, we have not identified of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Risk Management and Strategy We employ a risk management strategy for the assessment, identification and management of material risks stemming from cybersecurity threats. Our methodologies involve a systematic evaluation of potential threats, vulnerabilities, and their potential impacts on our organization's operations, data, and systems. Our cybersecurity risk management program includes: • Risk assessments designed to help identify material cybersecurity risks to our critical systems, and our IT environment; • The use of third-party service providers to assess, test or otherwise assist with aspects of our security controls; • Cybersecurity awareness training of our employees and senior management through the use of third-party providers for regular mandatory trainings; • A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • We design and assess our program using the National Institute Cybersecurity Framework ("NIST CSF") as a set of guiding principles.


text: Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program. The Committee receives periodic reports from management on our potential cybersecurity risks and threats and receives presentations on cybersecurity topics. In addition, management oversees and identifies such risks from cybersecurity threats associated with our use of third-party service providers and works collaboratively with our third-party providers to test our systems security processes and prevent, monitor, detect, mediate and remediate cybersecurity threats and incidents, and will report such threats and incidents to the Audit Committee when appropriate. The Committee reports to the full board of directors regarding its activities, including those related to cybersecurity.


text: Our Chief Executive Officer, Anthony Coniglio, leads our cybersecurity risk assessment and management processes. Mr. Coniglio is an experienced risk management professional. Mr. Coniglio has served as our Chief Executive Officer, President and Chief Investment Officer, overseeing risk management activities. Previously, Mr. Coniglio was the Chief Executive Officer of Primary Capital Mortgage Company ("PCM"), a residential mortgage company, where he was responsible for overseeing information technology, including cybersecurity, for the highly regulated business. Mr. Coniglio currently serves on the board of St. Mary's Hospital for Children, as chair of the IT & cybersecurity committee and chair of the audit committee.


text: Mr. Coniglio oversees the development and enhancement of internal controls designed to prevent, detect, address, and mitigate the risk of cyber incidents. Since 2021, we have retained a third-party information technology provider to develop and maintain our information technology infrastructure, cloud network, and assist in the development of cybersecurity and information technology policies. Our third-party provider is MSPAlliance Cyber Verified, which has been examined by an independent third-party public accounting firm and has successfully met the applicable 10 control objectives and underlying controls and requirements.


text: Management plays a key role in incorporating cybersecurity risk considerations into our boarder risk management framework and ensuring that essential priorities are communicated to the appropriate personnel. Management is responsible for approving cybersecurity processes, reviewing cybersecurity assessments and other cybersecurity-related matters, and responding to cybersecurity incidents, including but not limited to reporting cybersecurity incidents to the audit committee as described above. Our management team also evaluates the potential impact of cybersecurity incidents. If any such incidents should occur, management's evaluation considers factors such as the nature. scope and materiality of the incident, and its effects on the Company's operations.


text: We recognize the critical importance of maintaining the safety and security of our systems and data and have a process for overseeing and managing cybersecurity and related risks, which is supported by both management and our Board.

companyName: KORE Group Holdings, Inc.

ticker: KORE


text: Our cybersecurity functions are led by our Chief Technology Officer ("CTO"), who reports to our Chief Executive Officer. Our Senior Director - Global Security ("SDGS"), under the direction of the CTO, is responsible for overseeing our cybersecurity management program and the protection and defense of our networks and systems. The SDGS manages a team of cybersecurity professionals with broad experience and expertise, including in cybersecurity threat assessments and detection, mitigation technologies, cybersecurity training, incident response, cyber forensics, insider threats and regulatory compliance.


text: Our Board is responsible for overseeing our enterprise risk management activities in general, and each of our Board committees assists the Board in its role of risk oversight. The full Board receives an update on the Company's risk management process and the risk trends related to cybersecurity at least annually from the CTO. The audit committee of the Board (the "Audit Committee") specifically assists the Board in its oversight of risks related to cybersecurity. To help ensure effective oversight, the Audit Committee receives an update on cybersecurity from the CTO on an as-needed basis.


text: Internal Audit Program – We operate an internal audit program. On an annual basis, our internal audit team conducts an overall business risk assessment, which includes an evaluation of cybersecurity risks. Included in this evaluation is a report on our cybersecurity posture and related matters that is presented to the leaders of the relevant business teams, who are responsible for prioritizing and addressing the risks identified.


text: Internal training and awareness – We provide training to our employees to help identify, avoid, and mitigate the risk from cybersecurity threats. Our employees are required to complete required cybersecurity awareness training upon hiring and also participate annually in required cybersecurity awareness training, unless on a leave of absence.


text: Vendor risk management program – We have implemented processes to identify and manage risks from cybersecurity threats associated with our use of third-party service providers. Our vendor risk management program establishes governance, processes and tools for managing various risks related to third-party service providers, including information security and supplier-related risks. As a condition of working with KORE, suppliers who access sensitive business or customer information are expected to meet certain information security requirements.


text: As of December 31, 2023, we have not identified risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. We are committed to investing in cybersecurity and to enhancing our internal controls and processes, which are designed to help protect our systems and information. For more information regarding the risks we face from cybersecurity threats, please see Part I, Item 1A, — "Risk Factors".


text: We recognize the critical importance of maintaining the safety and security of our systems and data and have a program for overseeing and managing cybersecurity and related risks, which is supported by both management and our Board.


text: Our cybersecurity functions are led by our Chief Operating Officer ("COO"), who reports to our Chief Executive Officer. Our COO's relevant experience in cybersecurity includes previous experience, such as having previously served as Chief Executive Officer of a company that provides geospatial intelligence software and as Chief Technology Officer at a global cloud-based enterprise software company. Our Vice President - IT Security & Compliance ("VPITSC"), under the direction of the COO, is responsible for overseeing our cybersecurity management program and the protection and defense of our networks and systems. The VPITSC's relevant experience in cybersecurity includes over twelve years of extensive experience at the Company in cybersecurity, in various progressive roles. The VPITSC manages a team of cybersecurity professionals with broad experience and expertise, including in cybersecurity threat assessments and detection, mitigation technologies, cybersecurity training, incident response, cyber forensics, insider threats and regulatory compliance.


text: Our Board is responsible for overseeing our enterprise risk management activities in general, and each of our Board committees assists the Board in its role of risk oversight. The full Board receives an update on the Company's risk management process and the risk trends related to cybersecurity at least annually from the COO.


text: Risk Assessment and Management – We comply with the international standard ISO 27001, an Information Security Management System (ISMS), which helps safeguard the confidentiality, integrity, and availability of information through a structured risk management process. This approach assures stakeholders that cybersecurity risks are effectively managed. To support this commitment, we conduct regular risk assessments to identify, evaluate, and mitigate potential threats.


text: Internal training and awareness – We provide training to our employees to help identify, avoid, and mitigate the risk from cybersecurity threats. Our employees are required to complete mandatory cybersecurity awareness training upon hiring and also participate annually in required cybersecurity awareness training, unless on a leave of absence.


text: Technical Security Controls – We employ layered security controls, including Managed Endpoint Detection and Response, firewalls, intrusion detection systems, encryption technologies, and a Security Operations Center that is operated 24 hours a day, seven days a week.


text: Vendor risk management program – We have implemented processes to oversee, identify and manage risks from cybersecurity threats associated with our use of third-party service providers. Our vendor risk management program establishes governance, processes and tools for managing various risks related to third-party service providers, including information security and supplier-related risks. As a condition of working with KORE, suppliers who access sensitive business or customer information are expected to meet certain information security requirements.


text: Incident Response – We have put in place a formal incident response plan to address and mitigate potential security breaches in a timely and effective manner. Communication protocols have been established to notify relevant stakeholders, including regulators and customers, as required. Our incident response team conducts regular simulations and exercises to ensure readiness and effectiveness.


text: As of December 31, 2024, we have not identified risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. We are committed to investing in cybersecurity and to enhancing our internal controls and processes, which are designed to help protect our systems and information. For more information regarding the risks we face from cybersecurity threats, please see Part I, Item 1A, — "Risk Factors".


text: Risk Management and Strategy We have established processes and policies for assessing, identifying, and managing material risks arising from cybersecurity threats and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on, or conducted through, our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: Blend Labs, Inc.

ticker: BLND


text: We conduct annual risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks. We also utilize threat modeling to evaluate changes to our applications or environments for new threats or risks, and our cybersecurity team monitors the threat landscape regularly using security industry sources and certain threat intelligence information. Blend conducts daily vulnerability assessments, prioritizes remediation, and engages in routine system and application patching as well as other proactive measures, where deemed appropriate, to mitigate reasonably foreseeable risks.


text: Blend maintains an incident response plan that is designed to contain and resolve any suspected security incident identified by the Company. This plan is tested at least annually. Our security operations team triages issues and invokes the incident response plan when necessary. This plan includes provisions for notifications of internal and external parties, including Blend leadership and the Audit Committee as required.


text: Following these risk assessments, or when we otherwise identify cybersecurity risks through the processes described in this "Risk Management and Strategy" section, we evaluate whether and how to re-design, implement, and maintain reasonable safeguards to minimize identified risks and reasonably address any identified gaps in existing safeguards. We devote significant resources and designate high-level personnel, including our Information Security Officer, who reports to our Head of Finance and Administration, to manage the risk assessment and mitigation process.


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with our human resources and information technology functional groups. Personnel at all levels and departments are made aware of our cybersecurity policies through training. Specific training is required for users of higher-risk systems or individuals associated with specific security processes such as incident response.


text: Our cybersecurity program includes processes for identifying and managing risks from third parties and is integrated into our overall risk management framework. Our program defines key risk objectives and if cybersecurity risk exceeds defined thresholds, risks are documented and escalated into the enterprise risk program and Blend's internal audit team. We require all third-party service providers with access to our systems or processing sensitive data on our behalf to align with our cybersecurity objectives and adhere to industry best practices via contractual obligations that are entered into in connection with as a mandated review prior to engaging such service providers. We re-evaluate each such service provider at least annually and when the role or purpose of a service provider changes, and have processes to require service providers maintaining sensitive data on our behalf to delete such data at the time of termination of the contract.


text: We engage assessors or other third-party service providers in connection with our risk assessment and cybersecurity assessment or audit processes. These service providers assist us to evaluate risks and identify where our current security program may be improved. We consult with these service providers as required to verify mitigation approaches, to compare Blend's security posture against industry peers, and to provide overall feedback for the security program. Additionally, we utilize outside service providers, as well as a bug bounty program, to penetration test our network infrastructure and applications and provide prioritized security vulnerability findings reports that we include as part of our risk assessment processes. Some Blend customers also perform annual security testing on Blend's infrastructure and applications.


text: Like other technology companies, we have experienced cybersecurity incidents in the past. We have not, however, been materially impacted by any previous cybersecurity incidents. For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this Annual Report on Form 10-K,including the risk factors entitled "Risks Related to Our Business and Operations: A cyberattack, security breach, or incident affecting us or the third parties we rely on or partner with could expose us or our customers and consumers to a risk of loss or misuse of confidential information and have an adverse effect on our reputation, brand, business, financial condition, and results of operations."


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight function through the Audit Committee.


text: Our Information Security Officer and our cybersecurity team (which consists of our security policy manager, security operations manager, and red team lead) are primarily responsible for assessing and managing our material risks from cybersecurity threats. Our Information Security Officer has over 20 years of expertise within the cybersecurity field, and manages an experienced team with expertise in relevant security practices such as penetration testing, security operations, policy, etc.


text: Our Information Security Officer and our cybersecurity team oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The processes by which our Information Security Officer and our cybersecurity team are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents include monitoring of network, system and application logs, review of vulnerability scans and penetration test results, review of industry sources for vulnerability and threat indicators, and use of third-party service providers for audit or assessment purposes. In the event of a significant cybersecurity incident that is identified by the Company, Blend leadership and the Audit Committee is informed by the Information Security Officer or our manager of security operations to support swift and informed decision-making.


text: Our Information Security Officer provides quarterly briefings to the Audit Committee regarding our cybersecurity risks and activities, including our progress on mitigating threats identified by external cybersecurity risk audits, any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like, in each case as applicable. Our Audit Committee provides regular updates to the board of directors on such reports.


text: Blend maintains an incident response plan that is designed to contain and address any suspected security incident identified by the Company. This plan is tested at least annually. Our security operations team triages issues and invokes the incident response plan when deemed necessary. This plan includes provisions for notifications of internal and external parties, including Blend leadership and the Audit Committee as required.


text: Our cybersecurity program includes processes for identifying and managing risks from third parties and is integrated into our overall risk management framework. Our program defines key risk objectives and if cybersecurity risk exceeds defined thresholds, such risks are documented and escalated into the enterprise risk program and Blend's internal audit team. We contractually obligate third-party service providers with access to our systems or processing sensitive data on our behalf to align with our cybersecurity objectives and adhere to industry best practices. We re-evaluate each such service provider at least annually and when the role or purpose of a service provider changes, and have processes to require service providers maintaining sensitive data on our behalf to delete such data upon contract termination.


text: We engage assessors or other third-party service providers in connection with our risk assessment and cybersecurity assessment or audit processes. These service providers assist us to evaluate risks and identify where our current security program may be improved. We consult with these service providers as required to verify mitigation approaches, to compare Blend's security posture against industry peers, and to provide overall feedback for the security program. Additionally, we utilize outside service providers, as well as a bug bounty program, to penetration test our network infrastructure and applications and provide prioritized security vulnerability findings reports. Some Blend customers also perform annual security testing on Blend's infrastructure and applications.


text: Our Information Security Officer and our cybersecurity team (which consists of our security policy manager, security operations manager, and red team lead) are primarily responsible for assessing and managing our material risks from cybersecurity threats. Our Information Security Officer has over 20 years of expertise within the cybersecurity field, and manages an experienced team with expertise in relevant security practices such as penetration testing, security operations, and policy.


text: Our Information Security Officer and our cybersecurity team oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The processes by which our Information Security Officer and our cybersecurity team are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents include monitoring of network, system and application logs, review of vulnerability scans and penetration test results, review of industry sources for vulnerability and threat indicators, and use of third-party service providers for audit or assessment purposes. In the event of a significant cybersecurity incident that is identified by the Company, Blend leadership and the Audit Committee are informed by the Information Security Officer or our manager of security operations to support swift and informed decision-making.


text: CLEAR's information security program is managed by a dedicated Chief Information Security Officer ("CISO"), whose team is responsible for leading the Company's Enterprise Risk Management Program ("ERM Program"), which includes cybersecurity strategy, policy, standards, architecture, and processes. Our current CISO, together with his team, continues to implement, monitor, and maintain our cybersecurity program while we search for his successor. Cybersecurity risks are identified, discussed and assessed regularly as part of CLEAR's ERM Program. We also monitor and evaluate our cybersecurity posture and performance on an ongoing basis through regular vulnerability scans, penetration tests and threat intelligence feeds. We utilize a range of external experts, such as cybersecurity assessors, consultants and auditors, in evaluating and testing our cybersecurity systems. In addition, the Company has established the CLEAR Security Advisory Board, which provides guidance and advice on security risk and privacy to our Board and our CISO.

companyName: Clear Secure, Inc.

ticker: YOU


text: The Audit Committee of the Board predominantly oversees risk, including data security and oversight of cybersecurity risks, providing regular updates to the Board. The CISO provides periodic reports to our Board and Audit Committee, as well as our Chief Executive Officer and other members of our senior management as appropriate. These reports include updates on the Company's cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape. In addition, the top 10 cybersecurity risks identified as part of the ERM Program are identified to our Audit Committee on a quarterly basis.


text: CLEAR's information security program is managed by a dedicated Chief Security Officer ("CSO"), who has over 27 years of experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs, as well as relevant academic degrees, formal military training, and industry certifications. Our CSO's team is responsible for leading the Company's Enterprise Risk Management Program ("ERM Program"), which integrates our cybersecurity strategy, policy, standards, architecture and processes, and through which we regularly discuss and assess identified cybersecurity risks. Our CSO attends ERM Program meetings where cybersecurity (and other) risks are identified. We also monitor and evaluate our cybersecurity posture and performance on an ongoing basis through regular vulnerability scans, penetration tests and threat intelligence feeds, utilize a range of external experts, such as cybersecurity assessors, consultants and auditors, in evaluating and testing our cybersecurity systems. Further, CLEAR recognizes the importance of managing cybersecurity risks associated with third-party relationships as part of its broader risk management framework, as we are an organization that relies on a variety of third-party vendors, service providers, and business partners, and are aware that these relationships present potential risks to the security and integrity of our information systems. To mitigate these risks, the company works closely with vendors using our risk framework to identify, assess, and monitor potential cybersecurity threats that arise from relationships with external entities. Our approach includes conducting due diligence, enforcing contractual cybersecurity requirements, and implementing third-party cybersecurity best practices designed to align with CLEAR's risk management objectives.


text: In addition, the Company has established the CLEAR Security Advisory Board, which provides guidance and advice on security risk and privacy to our Board and our CSO. The CSAB is currently comprised of three external members with a range of executive national and international expertise in areas such as aviation and transportation security, physical security operations, cyber security, and privacy and data security. The CSAB meets in-person, together with management of the Company, at least annually, in addition to quarterly meetings by phone. The CSAB reports annually to our Board or our Audit Committee, and is an available resource to both management and members of the Board at any time.


text: The full Board provides oversight of the cybersecurity program while the Audit Committee of the Board predominantly oversees risk, including data security and oversight of cybersecurity risks, providing regular updates to the full Board. The CSO is actively engaged in discussions with the Board regarding the identification, assessment, and mitigation of cybersecurity risks to ensure that appropriate resources are dedicated to managing such risks and addressing any potential adverse effects, and provides periodic reports to our Board and Audit Committee, as well as our Chief Executive Officer and other members of our senior management as appropriate. These reports include updates on the Company's cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape.


text: Although CLEAR has not experienced any material cybersecurity breaches during the reporting period, we acknowledge that cyber incidents, if they were to occur, could have a material adverse effect on our financial results.


text: The Company is exposed to cybersecurity threats and incidents that can range from uncoordinated individual attempts to gain unauthorized access to information systems to sophisticated and targeted measures known as advanced persistent threats, directed at the Company or its third party service providers. Our customers, strategic relationships and regulators expect us to maintain a suitable cybersecurity posture to identify, protect, detect, respond and recover from incidents that may impact the confidentiality, integrity and availability of sensitive information we possess. We evaluate the risks of data theft (including theft of sensitive, proprietary and other data categories, in addition to personal data), harm to customer or third party relationships and litigation or regulatory investigation or actions that could materially adversely affect our financial condition, results of operations and reputation. Cybersecurity risk is assessed and managed primarily through our operations, risk management, and audit teams and is overseen by our Board of Directors.

companyName: Finwise Bancorp

ticker: FINW


text: The Bank's Information Security Officer (or ISO), who reports to our Chief Compliance & Risk Officer, is directly responsible for assessing and managing cybersecurity risks pursuant to the Company's Information Security Program, which is approved by our Board of Directors periodically. The current ISO has more than 5 years of cybersecurity experience and holds multiple industry certifications.