text: In accordance with its charter, the BOTC receives quarterly reports from (i) Technology, including the CIO or the CISO; (ii) Operations; and (iii) NFR. Such reporting includes updates on Morgan Stanley's Cybersecurity Program, risks from cybersecurity threats, our programs to address and mitigate the risks associated with the evolving cybersecurity threat environment, and NFR's assessment of cybersecurity risks. Senior officers in Technology and NFR also provide an annual report to the BOTC on the status of Morgan Stanley's broader information security program in compliance with the Gramm-Leach-Bliley Act, which includes a discussion of risks arising from cybersecurity threats. At least annually, senior management representatives in Technology and NFR discuss the status of the Cybersecurity Program and key cybersecurity risks with the Morgan Stanley board and, in accordance with such board's Corporate Governance Policies, all board members are invited to attend BOTC meetings and have access to meeting materials. The BOTC, which meets at least quarterly, also reviews and approves significant policies related to cybersecurity, receives an annual independent assessment of key aspects of Morgan Stanley's Cybersecurity Program from an independent third party and holds joint meetings with the BAC and BRC, as necessary and appropriate. The chair of the BOTC regularly discusses cybersecurity developments with senior Morgan Stanley management and reports to the Morgan Stanley board on cybersecurity risks and threats and other related matters.


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Company are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. During the fiscal year ended December 31, 2024, the Company has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition.

companyName: Morgan Stanley Direct Lending Fund

ticker: MSDL

secItem: Item 1C


text: As discussed under the "Risk Factors" heading in this Annual Report, our business has been and may again in the future be impacted by disruptions to our IT infrastructure or our third-party providers' IT infrastructures from (among other causes) cybersecurity-based risks, including attacks (i) on our IT infrastructure (ii) targeting the security, integrity and/or availability of hardware and software; (iii) exploiting weaknesses or vulnerabilities in products, or capturing information installed, stored or transmitted in our products (including after the purchase of those products and when they are installed into third-party products); and (iv) on facilities or similar infrastructure. Risk Management and strategy.

companyName: CARRIER GLOBAL Corp

ticker: CARR


text: We mitigate cybersecurity risks (and other material risks) through our enterprise risk management ("ERM") program, which is a company-wide effort, managed by senior executives and overseen by our Audit Committee and Board of Directors to identify, assess, manage, report and monitor material risks that may affect our ability to achieve our business objectives.


text: In connection with the ERM process, cybersecurity risks, including those relating to risks posed by our use of third-party service providers, are assigned to cross-functional management committees responsible for identifying and classifying the cybersecurity risks in accordance with our ERM risk rating methodology, and developing and administering risk mitigation and incident response plans. These cross-functional management committees regularly meet to review current and emerging cybersecurity risks and maintain policies and procedures governing the evaluation and classification of such risks.


text: Cybersecurity risks deemed to be critical are reviewed by a Critical Threat Committee, which is comprised of members of our senior leadership team including our Chief Financial Officer, Chief Legal Officer, Chief Digital Officer, Chief Operating Officer, Chief Technology Officer, and Controller. The Critical Threat Committee reviews the risk and mitigation plan with the applicable cross-functional management team and facilitates notification to the Audit Committee of emerging critical cybersecurity risks. The Audit Committee and the Board of Directors receive regular briefings on cybersecurity risks. See "—Governance" below for further discussion of governance of our cybersecurity program.


text: In the event of a cybersecurity incident, we maintain incident response plans to investigate, classify, respond to, and manage cybersecurity incidents that may compromise the availability or integrity of our information systems, network resources, or data. In accordance with the incident response plans, cross-functional management teams assess and assign a threat level to each cybersecurity incident. A cybersecurity incident (or incidents, if aggregated together) assigned a critical threat level is escalated to the Critical Threat Committee for review.


text: To ensure that our employees are equipped to identify and mitigate material cybersecurity incidents and to empower them to help us maintain a secure environment for our operations and data assets, we utilize a multifaceted training approach aimed at fostering a culture of security awareness and responsibility among all employees. These tailored programs are designed and updated to address evolving threats and industry best practices. In addition to annual cybersecurity training for employees and contractors and simulated phishing email campaigns, our cybersecurity teams conduct tabletop exercises with our senior management team. Our cybersecurity teams also oversee a security assessment process that is used to screen our third-party service providers for cybersecurity vulnerabilities based on the level of inherent risk they pose to the company or our customers, based on factors including but not limited to the products or services they provide and their ability to access our information systems, network resources, or data.


text: We engage and retain outside consultants and legal advisors and we are members of several cybersecurity industry groups to keep us apprised of emerging cybersecurity risks, defense and mitigation strategies and governance best practices. Many of our processes and procedures have been independently audited and assessed against some of the leading international cybersecurity standards and programs.


text: Cybersecurity threats are constantly evolving, are becoming more frequent and more sophisticated and are made by groups of individuals with a wide range of expertise and motives which increases the difficulty of detecting and successfully defending against them. However, to date, cybersecurity threats have not materially affected us, including our business, strategy, results of operations or financial condition.


text: Our cybersecurity programs, including the cross-functional management committees responsible for identifying, assessing, and mitigating cybersecurity risks and incidents, are owned by our Chief Information Officer. Day-to-day administration of the cybersecurity programs are led by our Chief Information Security Officer and Chief Product Security Officer who collectively possess over 30 years of experience related to cybersecurity issues in both the private and government sectors, and possess certifications including but not limited to Certified Information Systems Security Professional ("CISSP") and Certified Information Security Manager ("CISM").


text: Cybersecurity risk oversight continues to remain a top priority for the Board of Directors. Although the Audit Committee maintains primary responsibility for oversight of cybersecurity risks through the ERM program, responsibility related to oversight of cybersecurity risks is also delegated to other committees in alignment with their focus charter responsibilities. For example, the Technology and Innovation and Governance Committees assist with the cybersecurity programs through their oversight of our technology, digital, and innovation strategies and product integrity program, respectively.


text: The Critical Threat Committee is also responsible for evaluating the materiality of a cybersecurity incident based on criteria that has been reviewed with the Board of Directors, and for determining whether there are disclosure obligations under applicable securities laws. In the event that the Critical Threat Committee determines that a critical cybersecurity incident (or incidents, if aggregated together) is deemed to be material, the Critical Threat Committee will brief the Board of Directors and oversee the disclosure process. For all critical cybersecurity incidents that are not deemed to be material, the Critical Threat Committee will notify the Chairman of the Board to determine whether the Board of Directors will be notified of the critical incident during the next regularly-scheduled cybersecurity update to the Audit Committee, or sooner as circumstances warrant.


text: As discussed under the "Risk Factors" heading in this Annual Report, our business has been and may again in the future be impacted by disruptions to our Technology infrastructure or our third-party providers' Technology infrastructures from (among other causes) cybersecurity-based risks, including attacks (i) on our Technology infrastructure (ii) targeting the security, integrity and/or availability of hardware and software; (iii) exploiting weaknesses or vulnerabilities in products, or capturing information installed, stored or transmitted in our products (including after the purchase of those products and when they are installed into third-party products); and (iv) on facilities or similar infrastructure.


text: Risk Management and strategy We mitigate cybersecurity risks (and other material risks) through our enterprise risk management ("ERM") program, which is a company-wide effort, managed by senior executives and overseen by our Audit Committee and Board of Directors to identify, assess, manage, report and monitor material risks that may affect our ability to achieve our business objectives.


text: Cybersecurity risks deemed to be critical are reviewed by a Critical Threat Committee, which is comprised of members of our senior leadership team including our Chief Financial Officer, Chief Legal Officer, Chief Digital Officer, Senior Vice President of Operations, Chief Technology Officer, Chief Product Officer and Controller/Chief Accounting Officer. The Critical Threat Committee reviews the risk and mitigation plan with the applicable cross-functional management team and facilitates notification to the Audit Committee of emerging critical cybersecurity risks. The Audit Committee and the Board of Directors receive regular briefings on cybersecurity risks. See "Governance" below for further discussion of governance of our cybersecurity program.


text: We engage and retain outside consultants and legal advisors and we are members of several cybersecurity industry groups to keep us apprised of emerging cybersecurity risks, defense and mitigation strategies and governance best practices. Many of our processes and procedures are independently audited and assessed on a periodic basis against leading international cybersecurity standards and programs.


text: Our cybersecurity programs, including the cross-functional management committees described above are the responsibility of our Chief Information Security Officer. Day-to-day administration of the cybersecurity programs are led by our Chief Information Security Officer and Chief Product Security Officer who collectively possess significant experience related to cybersecurity issues in both the private and government sectors, and possess certifications including but not limited to Certified Information Systems Security Professional ("CISSP") and Certified Information Security Manager ("CISM").


text: We rely on technology, including the internet and mobile services, to conduct much of our business activity and allow our customers to conduct financial transactions on our platform. As a result, our systems and operations as well as those of the third parties on which we rely to conduct certain key functions are vulnerable to cybersecurity incidents, which we have experienced in the past. We have a cybersecurity program that includes physical, technological, and administrative controls to detect, contain, respond to and remediate cybersecurity threats and incidents and defined processes to assess, identify and manage material risks from cybersecurity threats. These controls and processes include, among others: • maintaining a vulnerability management program that performs regular vulnerability scans and relies on our risk-based information security program to promote coverage of critical areas; • establishing an offensive security team that actively tests our security controls, imitating methods persons trying to achieve unauthorized access might use to identify any weaknesses; • our global privacy program supported by our privacy engineering and privacy legal teams and the Privacy Advisory Council, a cross functional team of senior leaders from legal, engineering, product, and compliance; • maintaining an incident response plan which includes required responses in the event of a cybersecurity incident; • conducting mandatory annual security and privacy training for all employees and contractors and, where appropriate, giving employees and contractors role-based training focused on content specific to their role at the Company; • undertaking an annual review of our consumer facing policies and statements related to cybersecurity; • requiring employees to treat customer information and data with care through policy, practice and contract (as applicable); • leveraging the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF") incident handling framework to help us identify, protect, detect, respond, and recover when there is an actual or potential cybersecurity incident; and • carrying information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident.

companyName: Robinhood Markets, Inc.

ticker: HOOD


text: Our cybersecurity program is managed by the Company's Security and Corporate Engineering organization, which is led by our CSO, who reports directly to the CEO. Currently, our CSO is Erika Dean. Ms. Dean, who joined the Company in 2021, has over twenty years of experience in the security industry. Prior to joining our Company, she held a variety of leadership positions in cybersecurity at Capital One, including as Vice President, Divisional Chief Information Security Officer. Additionally, several of Robinhood's subsidiaries, including RHC, RHF, and RHS, have a Chief Information Security Officer, who reports to the CSO, and a Risk Operating Committee ("ROC") that manages risks, including cybersecurity risks, specific to each entity. The Chief Information Security Officers have expertise in cybersecurity, industry and regulatory standards, risk management, and security operations. The Security organization elevates risks to the ROCs where applicable. Our cybersecurity program is aligned with industry standards and best practices, such as the NIST CSF, and we engage third-party consultants annually to conduct a NIST CSF maturity assessment of our cybersecurity program.


text: We maintain a Third Party Security and Privacy Policy and conduct security reviews of vendors, including for potential fourth-party risks, prior to and during their contracts with Robinhood and require all third-party service providers with access to personal, confidential or proprietary information to implement and maintain comprehensive cybersecurity practices consistent with applicable legal standards and industry best practices. Any identified security or privacy risks of doing business with a vendor, including potential fourth-party risks, are highlighted to business owners to help make informed risk-based decisions.


text: We also engage the assistance of third-party consultants to increase protection of our information and IT systems and network to help secure long-term value for our stakeholders. Services provided by third-party consultants include, but are not limited to: regular assessments to our cybersecurity program including cyber maturity assessments and penetration tests; risk scoring of our critical business partners and vendors; and participating in incident response processes.


text: Management is responsible for day-to-day risk operations and management processes. Management has established cybersecurity standards to improve the Company's cybersecurity risk posture and to help define and implement appropriate measures to protect the Company's systems and data from cyber threats. In addition to our Internal Audit and Compliance functions, the Company has a management ERC, which comprises senior leaders of the Company, including the CEO, CFO, CLO, CSO, Vice President of Risk and Audit, and CBO, among others, and reviews on at least a quarterly basis risks that are escalated by the Company's ERM function, including cybersecurity risks. ERM maintains a risk taxonomy and a scoring methodology design to ensure risks are elevated in a clear and transparent manner, and further escalates top risks to the Safety Committee, along with planned mitigants and monitoring procedures.


text: If a cybersecurity incident occurs, incident response procedures are in place to ensure that the occurrence is appropriately reported to the CSO, and business continuity plans are mobilized to minimize disruption to business operations. We have also implemented guidelines to outline communications responsibilities during incidents of all severity levels, including the escalation process for alerting senior management of high severity incidents.


text: If a significant cybersecurity incident occurs, we will conduct an assessment to determine if it is material to us. If a materiality assessment is required, the CSO will report such an incident to our Materiality Assessment Committee ("MAC"), which consists of the CFO, CLO, and CBO (in addition to the CSO). The MAC will then determine, without unreasonable delay, whether the incident is material to the Company. In making such determination, the MAC may consult with the CEO, other members of the Company's management, and the Company's outside professional advisors, in each case, as appropriate. The incident materiality determination will be made by considering all relevant quantitative and qualitative factors, including without limitation: the nature, size and scope of the incident; financial condition; results of operations; litigation or regulatory investigations/actions; the Company's reputation, and customer and vendor relationships; and competitiveness.


text: The principal role of our board of directors and the Safety Committee is one of oversight, recognizing that management is responsible for the design, implementation, and maintenance of an effective program for protecting against and mitigating data privacy and cybersecurity risks. The Safety Committee reviews management's exercise of its responsibility to identify, assess, manage, monitor and mitigate material risks not specifically allocated to the board of directors or another of its committees. The Safety Committee has been explicitly assigned the responsibility to oversee risks from cybersecurity threats, among others, and the full board of directors will be notified when the MAC is assessing a cybersecurity incident and informed of any required disclosures. Our board of directors and Safety Committee receive updates on relevant industry developments, threats, and material risks identified as needed each quarter. The board of directors and the Safety Committee also receive updates, including material legal and legislative developments, concerning data privacy and security, the rapidly evolving cybersecurity risk landscape, and the Safety Committee facilitates the board of directors' oversight responsibilities.


text: Our systems and those of our customers and third-party service providers have been and might in the future be vulnerable to cybersecurity threats. For more information about risks related to cybersecurity threats, including previous cybersecurity incidents (including the November 2021 Data Security Incident (defined below)), that have materially affected or are reasonably likely to materially affect our business, financial condition, and results of operations, see "Risk Factors–Our business could be materially and adversely affected by a cybersecurity breach or other cybersecurity incident involving our information systems or data or those of our customers or third-party or fourth-party service providers."


text: We rely on technology, including the internet and mobile services, to conduct much of our business activity and allow our customers to conduct financial transactions on our platform. As a result, our systems and operations as well as those of the third parties on which we rely to conduct certain key functions are vulnerable to cybersecurity incidents, which we have experienced in the past. Although no organization can eliminate cybersecurity and information technology risk completely, w e have a cybersecurity program that includes physical, technological, and administrative controls designed to detect, contain, respond to and remediate cybersecurity threats and incidents and defined processes to assess, identify and manage material risks from cybersecurity threats. These controls and processes include, among others: • maintaining a vulnerability management program that performs regular vulnerability scans and relies on our risk-based information security program to promote coverage of critical areas; • establishing an offensive security team that actively tests our security controls, imitating methods persons trying to achieve unauthorized access might use to identify any weaknesses; • our global privacy program supported by our privacy engineering and privacy legal teams; • maintaining an incident response plan which outlines the roles and responsibilities of key personnel in the event of a cybersecurity incident; • conducting mandatory annual security and privacy training for employees and contractors and, where appropriate, giving employees and contractors role-based training focused on content specific to their role at the Company; • undertaking an annual review of our consumer facing policies and statements related to cybersecurity; • requiring our employees to treat customer information and data with care through policy, practice and contract (as applicable); and • carrying cybersecurity insurance that provides some protection against potential losses arising from a cybersecurity incident.


text: Our cybersecurity program is managed by the Company's Security and Corporate Engineering organization, which is led by our CSO, who reports directly to the CEO. Our CSO has over twenty years of experience in the security industry and has held a variety of leadership positions in cybersecurity at Capital One, including as Vice President, Divisional Chief Information Security Officer. Additionally, several of Robinhood's subsidiaries, including RHC, RHF, and RHS, have a Chief Information Security Officer, who reports to the CSO, and a Risk Operating Committee ("ROC") that manages risks, including cybersecurity risks, specific to each entity's business. Each of our Chief Information Security Officers has expertise in cybersecurity, industry and regulatory standards, risk management, and security operations. The Security organization elevates risks to the relevant ROCs where applicable. Our cybersecurity program is aligned with industry standards and best practices, such as the NIST CSF, and we engage third-party consultants annually to conduct a NIST CSF maturity assessment of our cybersecurity program.


text: We maintain a Third Party Security and Privacy Standard and conduct security reviews of vendors, including for potential fourth-party risks, prior to and during their contracts with Robinhood and require all third-party service providers with access to personal, confidential or proprietary information to implement and maintain cybersecurity practices consistent with applicable legal standards and industry standards. Any identified security or privacy risks of doing business with a vendor, including potential fourth-party risks, are highlighted to business owners to help make informed risk-based decisions.


text: We also engage the assistance of third-party consultants to increase protection of our information and IT systems and network to help secure long-term value for our stakeholders. Services provided by third-party consultants include, but are not limited to: regular assessments of our cybersecurity program including cyber maturity assessments and penetration tests; risk scoring of our critical business partners and vendors; and participating in incident response processes.


text: Our management is responsible for the Company's day-to-day risk operations and management processes. Management has established cybersecurity standards to improve the Company's cybersecurity risk posture and to help define and implement appropriate measures to protect the Company's systems and data from cyber threats. In addition to our Internal Audit and Compliance functions, the ERM team partners with various front-line risk teams and risk owners across Robinhood, to foster consistent risk management practices across Robinhood. In particular, the ERM team provides governance over risk management practices and reports on a quarterly basis on top risks to the Safety Committee, along with planned mitigants and monitoring procedures.


text: If a cybersecurity incident occurs, incident response procedures are in place to facilitate the appropriate reporting to the CSO, and business continuity plans are mobilized to minimize disruption to business operations. We have also implemented guidelines to outline communications responsibilities during incidents of all severity levels, including an escalation process for alerting senior management of high severity and material incidents.


text: If a significant cybersecurity incident occurs, we will conduct an assessment to determine if it is material to us. If a materiality assessment is required, the CSO will report such an incident to our Materiality Assessment Committee ("MAC"), which consists of the CFO, CLO, and CBO (in addition to the CSO) and notify the CEO. The MAC will then determine, without unreasonable delay, whether the incident is material to the Company. In making such determination, the MAC may consult with the CEO, other members of the Company's management, and the Company's outside professional advisors, in each case, as appropriate. The incident materiality determination will be made by considering all relevant quantitative and qualitative factors, including without limitation: the nature, size and scope of the incident; financial condition; results of operations; litigation or regulatory investigations/actions; the Company's reputation, and customer and vendor relationships; and competitiveness.


text: The principal role of our board of directors and the Safety Committee, a board-level committee composed solely of independent directors, is one of oversight, recognizing that management is responsible for the design, implementation, and maintenance of an effective program for protecting against and mitigating data privacy and cybersecurity risks. The Safety Committee reviews management's exercise of its responsibility to identify, assess, manage, monitor and mitigate material risks not specifically allocated to the board of directors or another of its committees. The Safety Committee has been explicitly assigned the responsibility to oversee risks from cybersecurity threats, among others, and the full board of directors will be notified when the MAC is assessing a cybersecurity incident and informed of any required disclosures. Our board of directors and Safety Committee receive updates on relevant industry developments, threats, and material risks identified as needed each quarter, including material legal and legislative developments, concerning data privacy and security, the rapidly evolving cybersecurity risk landscape, and the Safety Committee facilitates the board of directors' oversight responsibilities.


text: Risk Management and Strategy The Company maintains a cybersecurity program that establishes safeguards for protecting the confidentiality, integrity, and availability of the Company's data, technology, and information systems, and the material risks associated with the threats identified from time to time under the cybersecurity program are incorporated into the Company's corporate risk register. The program includes general controls for managing changes in and access to the Company's information technology environment, cybersecurity awareness and training programs to help employees identify and mitigate against cybersecurity threats, cybersecurity incident response plans and third-party incident response retainers to help expedite the Company's response in the event of a cybersecurity incident, and guidelines regarding system vulnerability management, third-party threat intelligence, endpoint detection and response solutions, and network security measures.

companyName: APA Corp

ticker: APA


text: The program also establishes protocols for identifying and managing material risks related to cybersecurity threats associated with the Company's use of third-party service providers. The Company monitors and oversees the material risks related to vulnerabilities, threats, and incidents impacting its third-party service providers via onboarding reviews, threat intelligence reports, and annual assessments. As an example of the Company's efforts to manage third-party cybersecurity risks, when third parties are engaged to provide software-as-a-service offerings, the Company's standard licensing terms require such third parties to utilize safeguards to protect the Company's data, in compliance with applicable standards from the International Organization for Standardization (ISO) regarding security techniques, and to notify the Company within 24 hours of becoming aware of a cybersecurity incident impacting the Company's data.


text: As of December 31, 2023, no risks from cybersecurity threats or incidents have materially affected or are reasonably likely to materially affect the Company's business strategy, results of operations, or financial condition.


text: In 2023, the Company's Board of Directors established a standing Cybersecurity Committee to assist with oversight of the Company's cybersecurity program and the material risks associated with the threats identified under the program. Given the Cybersecurity Committee's chair's previous military experience in positions relevant to information security and his NACD-sponsored CERT Certificate in Cybersecurity Oversight from Carnegie Mellon University's Software Engineering Institute, the committee benefits from his perspectives, skills, and training when reviewing and managing the Company's exposure to cybersecurity risks.


text: As stated in its charter, the Cybersecurity Committee's responsibilities include: • providing oversight of the Company's cybersecurity policies, procedures, and plans, including the quality and effectiveness of the cybersecurity program; • reviewing the Company's policies and procedures related to its preparation for, defense against, response to, and recovery from material cybersecurity incidents; • reviewing with management the plans and methodology for periodic assessments of the Company's cybersecurity program by outside professionals, including the findings of such assessments and plans to remediate any material deficiencies identified by such assessments; • overseeing the Company's management of risks related to its cybersecurity systems and processes; • reviewing with management any cybersecurity insurance program the Company may procure, including with respect to coverage and limits; and • overseeing the preparation of the Company's disclosures in its reports filed with the Securities and Exchange Commission relating to the Company's cybersecurity systems.


text: The Cybersecurity Committee also has authority to retain cybersecurity and other consultants and advisors to assist and advise the committee in its evaluation of the Company's cybersecurity program.


text: The Cybersecurity Committee receives regular reports from Company management regarding the Company's cybersecurity systems and programs, and the committee from time to time also receives updates from external cybersecurity specialists on cybersecurity trends and incidents, including those that may be particularly relevant to the Company's industry or operations. In addition, in exercising its oversight responsibilities, the Cybersecurity Committee has full access to Company management and may inquire into any matter that it considers to be of material concern to the committee or the full Board of Directors.


text: The Cybersecurity Committee reports regularly to the full Board of Directors, with respect to such matters as are relevant to the committee's discharge of its responsibilities and with respect to such recommendations as the committee deems appropriate for consideration by the Board of Directors. The Cybersecurity Committee also refers to the Audit Committee any matters that come to the attention of the Cybersecurity Committee that fall within the purview of the Audit Committee, including any matters related to the Company's internal control over financial reporting.


text: APA's Chief Information Officer (the CIO) is primarily responsible for the day-to-day operation of the Company's cybersecurity program and for identifying, assessing, and managing the material risks associated with the cybersecurity threats and incidents identified from time to time thereunder. The CIO manages the Company's Information Security Team, which is comprised of cybersecurity professionals responsible for managing the Company's threat intelligence, vulnerability management, forensics, and security architecture systems and processes. The CIO has a Bachelor of Science in Computer Science and over 25 years of experience managing data and technology in the energy industry. He also receives regular updates from external cybersecurity specialists on emerging trends, threats, and technologies in the cybersecurity industry. The CIO reports directly to APA's Executive Vice President, Administration, who, along with the CIO, presents all relevant information to the Cybersecurity Committee.


text: Additionally, in 2023, the Company established its CyberSmart Defender Network, which is a multi-disciplinary team that includes representatives from across the Company's various departments, responsible for raising awareness of cybersecurity issues, sharing learnings, and gaining access to advanced cybersecurity information and training.


text: Under the direction of the CIO, management's responsibilities with respect to the Company's cybersecurity program include (i) identifying and managing cybersecurity risks, (ii) coordinating cybersecurity incident response, (iii) assessing the health and maturity of the Company's cybersecurity policies, procedures, and plans, including the program, and (iv) reporting overall progress to the Cybersecurity Committee and to the full Board of Directors.


text: For additional information regarding relevant cybersecurity risks, see Item 1A Risk Factors "A cyberattack targeting systems and infrastructure used by the Company or others in the oil and gas industry may adversely impact the Company's operations."


text: Risk Management and Strategy As a wholly owned subsidiary of APA, the Company relies on APA for its information systems in connection with the Company's day-to-day operations. Consequently, the Company also relies on the processes undertaken by APA for assessing, identifying, and managing material risks from cybersecurity threats. The Company's executive officers are executive officers of APA, and one of such officers (John J. Christmann IV) is also a member of APA's board of directors (the APA Board of Directors).

companyName: APACHE CORP


text: APA maintains a cybersecurity program that establishes safeguards for protecting the confidentiality, integrity, and availability of APA's data, technology, and information systems, and the material risks associated with the threats identified from time to time under the cybersecurity program are incorporated into APA's corporate risk register. The program includes general controls for managing changes in and access to APA's information technology environment, cybersecurity awareness and training programs to help employees identify and mitigate against cybersecurity threats, cybersecurity incident response plans and third-party incident response retainers to help expedite APA's response in the event of a cybersecurity incident, and guidelines regarding system vulnerability management, third-party threat intelligence, endpoint detection and response solutions, and network security measures.


text: APA's Chief Information Officer (the CIO) is primarily responsible for the day-to-day operation of APA's cybersecurity program and for identifying, assessing, and managing the material risks associated with the cybersecurity threats and incidents identified from time to time thereunder.


text: In 2023, the APA Board of Directors established a standing Cybersecurity Committee to assist with oversight of APA's cybersecurity program and the material risks associated with the threats identified under the program. The Cybersecurity Committee receives regular reports from APA management, including the CIO, regarding APA's cybersecurity systems and programs, and the committee from time to time also receives updates from external cybersecurity specialists on cybersecurity trends and incidents.


text: Our management team is involved in assessing and managing the Company's material risks from cybersecurity threats, including by hiring appropriate personnel, considering cybersecurity risk in our enterprise risk management strategy, helping prepare for cybersecurity incidents, and participating in the cybersecurity incident response and remediation process for incidents escalated to it including determining materiality. Our management that is involved in these processes includes our Chief Technology Officer, Chief Financial Officer and General Counsel. Management also escalates, as appropriate, reports relating to cybersecurity incidents or threats to our Board or to its Audit Committee.

companyName: Mediaco Holding Inc.

ticker: MDIA


text: While we have not yet experienced any material impacts from a cyber-attack, any one or more future cyber-attacks could materially adversely impact the Company, including a loss of trust among our customers, departures of key employees, general diminishment of our reputation and financial losses from remediation actions, loss of business or potential litigation or regulatory liability. Further, evolving market dynamics are increasingly driving heightened cybersecurity protections and mandating cybersecurity standards for our products, and we may incur additional costs to address these increased risks and to comply with such demands.


text: See the section titled Item IA. Risk Factors, including "Our business is dependent upon the proper functioning of our internal business processes and information systems. The modification, change of, or interruption of such systems may disrupt our business, processes and internal controls," for additional information about the risks from cybersecurity threats that may materially affect our business.


text: Our management team is involved in assessing and managing the Company's material risks from cybersecurity threats, including by hiring appropriate personnel, considering cybersecurity risk in our enterprise risk management strategy, helping prepare for cybersecurity incidents, and participating in the cybersecurity incident response and remediation process for incidents escalated to it including determining materiality. Our management that is involved in these processes includes our Chief Technology Officer, Chief Financial Officer and General Counsel. Our Senior Vice President of Information Technology and Infrastructure brings over 25 years of expertise in media, information security, technology risk management, spearheading our cybersecurity program. In close collaboration with the senior executive team, IT leadership is responsible for ensuring compliance, addressing identified risks, and driving comprehensive employee training initiatives. Management also escalates, as appropriate, reports relating to cybersecurity incidents or threats to our Board or to its Audit Committee.


text: We have certain processes for the identification, assessment, and mitigation of cybersecurity risks which are incorporated into our overall risk management processes in coordination with our information technology function. Such processes include physical, procedural and technical safeguards, and routine review of our policies and procedures to identify risks and improve our practices. We conduct cybersecurity training and testing for all of our employees covering timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, and mobile security, and we educate employees on the importance of reporting all incidents immediately. We also use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs. We engage third-party consultants to enhance our cybersecurity oversight and conduct penetration testing and vulnerability assessments. Further, we consider the cybersecurity practices of our third-party service providers, including through a general security assessment and contractual requirements, as appropriate, before engaging them in order to help protect us from any related vulnerabilities.

companyName: Werewolf Therapeutics, Inc.

ticker: HOWL


text: We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations or financial condition. For more information about the cybersecurity risks we face, see the risk factor entitled "Our internal computer systems, or those used by our third-party research institution collaborators, CROs or other contractors or consultants, may fail or suffer security breaches" in the section titled "Risk Factors" in Part 1, Item 1A of this Annual Report.


text: Our Director of Operations leads the operational oversight of the company-wide cybersecurity strategy, policy, standards and processes. The Director of Operations role is currently held by an individual who has over two decades of professional IT management experience and possesses the requisite education, skills and experience expected to perform such a duty. In addition, our Director of Operations as well as leaders from our operations, finance, and legal departments, are responsible for documenting, reviewing, and assessing our cybersecurity processes, monitoring for cybersecurity incidents, and periodically reporting on cybersecurity risks and risk management to the audit committee of our board of directors. The audit committee of the board of directors provides oversight of our cybersecurity risk as part of its periodic review of enterprise risk management. The audit committee provides regular updates to our board of directors regarding such oversight, including updates on the status of ongoing cybersecurity projects, the results of cybersecurity risk assessments, and the emerging cybersecurity threat landscape. Additionally, the board of directors reviews our enterprise risk management processes periodically and is notified by management between management updates regarding significant new cybersecurity threats or incidents.


text: We have certain processes for the identification, assessment, and mitigation of cybersecurity risks which are incorporated into our overall risk management processes in coordination with our information technology function. Such processes include physical, procedural and technical safeguards, and routine review of our policies and procedures to identify risks and improve our practices. We conduct cybersecurity training and testing for all of our employees covering timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, and mobile security, and we educate employees on the importance of reporting all incidents immediately. We also use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs. We engage third-party consultants to enhance our cybersecurity oversight and conduct penetration testing and vulnerability assessment s. Further, we consider the cybersecurity practices of our third-party service providers, including through a general security assessment and contractual requirements, as appropriate, before engaging them in order to help protect us from any related vulnerabilities.


text: We do not believe that there are currently any risks from known cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations or financial condition. For more information about the cybersecurity risks we face, see the risk factors entitled "Our business could be negatively affected by cyberattacks or a deficiency in our cybersecurity" and "Our internal computer systems, or those used by our third-party research institution collaborators, CROs or other contractors or consultants, may fail or suffer security breaches" in the section titled "Risk Factors" in Part 1, Item 1A of this Annual Report.


text: The Company's Board recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Board is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to risk management. Our Manager maintains cybersecurity policies, standards, processes and practices that are based on recognized security frameworks such as the National Institute of Standards and Technology cybersecurity framework (the "NIST CF") and the Azure Security Benchmark. In general, our Manager seeks to address cybersecurity risks of the Company through a comprehensive, cross-functional approach that is focused on continually assessing the Company's information systems to detect, prevent and mitigate cybersecurity threats and effectively respond to cybersecurity incidents when they occur.

companyName: NexPoint Real Estate Finance, Inc.

ticker: NREF


text: As one of the critical elements of the Company's overall risk management, our Manager's cybersecurity program is focused on the following key areas:


text: Governance: The Board's oversight of cybersecurity risk management is supported by the Audit Committee of the Board (the "Audit Committee"), which interacts with our Manager's Director of Information Technology and Chief Compliance Officer and other members of management of our Manager that implement and oversee our Manager's cybersecurity program.


text: Risk Assessment: No less frequently than annually, our Manager completes an assessment to identify potential cybersecurity threats and vulnerabilities to better prioritize and mitigate the Company's cybersecurity risk. The assessment includes, among other things, evaluating the nature, sensitivity and location of information the Company collects, processes and stores and the resiliency of the underlying technologies, the validity and effectiveness of the Company's security policies, controls and processes and the cybersecurity preparedness of the third-party vendors used by the Company and our Manager. To supplement our Manager's internal assessment, our Manager also periodically engages third-party consultants to assess system configurations through configuration review and penetration testing.


text: Technical Safeguards: Our Manager deploys technical safeguards that are designed to protect the Company's and our Manager's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.


text: Incident Response and Recovery Planning: Our Manager has established and maintains comprehensive business continuity plans that address potential impacts should the information or technology systems become compromised, and such plans are tested and evaluated on a regular basis.


text: Third-Party Risk Management: Our Manager maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including key vendors, service providers and other external users of the Company's and the Manager's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.


text: Education and Awareness: Our Manager provides regular, mandatory training for its employees regarding cybersecurity threats as a means to equip its employees with effective tools to address cybersecurity threats, and to communicate our Manager's evolving information security policies, standards, processes and practices.


text: Our Manager engages in the periodic assessment and testing of our Manager's policies, standards, processes and practices that are designed to address the Company's cybersecurity threats and incidents. These efforts include a wide range of activities, including annual penetration and third-party compliance testing and ongoing internal testing and creation and modification of polices and procedures. The results of the annual assessments are reported to the Audit Committee and the Board, and our Manager adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments and ongoing testing.


text: The Audit Committee oversees the Company's risk management policies, including the management of risks arising from cybersecurity threats. The Audit Committee receives presentations and reports on cybersecurity risks, which address a wide range of topics including annual assessments of internal and third-party policies, vulnerability assessments, technological trends and information security considerations arising with respect to the Company and our Manager. The Audit Committee also receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, the Board and the Audit Committee discuss the Company's approach to cybersecurity risk management with our Manager, including the Manager's Director of Information Technology.


text: The Manager's Director of Information Technology, in coordination with relevant senior management and personnel of the Manager, which includes our Manager's Chief Financial Officer, Senior Infrastructure Engineer, and Chief Compliance Officer, work to conceive, implement, and monitor the effectiveness of a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any security incidents in accordance with the Company's business continuity plan. To ensure the effectiveness of these controls, the Manager's technology team continually monitors, hardens, and evolves systems' security postures to model and mirror various security frameworks such as NIST CSF and Azure Security Benchmark. The Manager's Director of Information Technology will promptly notify our General Counsel of any cybersecurity events, with material cybersecurity events promptly communicated to the Audit Committee and publicly disclosed as deemed necessary.


text: The Manager's Director of Information Technology has served in various roles in information technology and information security for 25 years, including serving as Global Technology Manager at a multi-national publicly traded broker-dealer, and 15 years as the Director of Information Technology at a privately held financial services firm. The Manager's Director of Information Technology holds an undergraduate degree in biochemistry and has attained numerous information technology certifications over the years including Microsoft Certified Systems Engineer (MCSE) and Cisco Certified network Professional (CCNP). The Manager's Senior Infrastructure Engineer has over 20 years industry experience, holds an undergraduate degree in radiology, and has completed various Microsoft related information technology certifications. Combined, our Manager's information technology team has over 50 years of experience covering all major aspects of network architecture and management.


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. However, the risk of cybersecurity threats could be significant if the cyber-attack disrupts the Company's critical operations, service or financial systems. See Item 1A. "Risk Factors—General Risks—We are highly dependent on information technology and security breaches or systems failures could significantly disrupt our business, which may, in turn, negatively affect the market price of our securities and our ability to pay dividends."


text: Governance: The Board's oversight of cybersecurity risk management is supported by the Audit Committee of the Board (the "Audit Committee"), which interacts with our Manager's Director of Information Technology and other members of management of our Manager that implement and oversee our Manager's cybersecurity program.


text: Incident Response and Recovery Planning: Our Manager has established and maintains comprehensive business continuity plans that address potential impacts should the information or technology systems become compromised, and the technological components of such plans are tested and evaluated on a regular basis.


text: Our Manager engages in the periodic assessment and testing of our Manager's policies, standards, processes and practices that are designed to address the Company's cybersecurity threats and incidents. These efforts include a wide range of activities, including annual penetration and third-party compliance testing and ongoing internal testing and creation and modification of policies and procedures. The results of the annual assessments are reported to the Audit Committee and the Board, and our Manager adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments and ongoing testing.


text: Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected, and we do not believe are reasonably likely to materially affect, us, including our business strategy, results of operations or financial condition. However, the risk of cybersecurity threats could be significant if the cyber-attack disrupts the Company's critical operations, service or financial systems. See Item 1A. "Risk Factors—General Risks—We are highly dependent on information technology and security breaches or systems failures could significantly disrupt our business, which may, in turn, negatively affect the market price of our securities and our ability to pay dividends."


text: Cybersecurity Risk Management and Strategy Our management and board of directors recognize the critical importance of maintaining the trust and confidence of our customers, partners, and employees, including the importance of managing cybersecurity risks, and we have integrated these policies and procedures into our overall risk management systems and processes. While everyone at our company is expected to play a part in managing cybersecurity risks, our board of directors, as discussed in more detail under "—Governance" below, through delegation to the cybersecurity committee of the board of directors (the cybersecurity committee), and key members of our senior management team, are involved in the oversight of our information security program. Our information security program is based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards, and is integrated into our overall enterprise risk management program. We utilize an overarching framework to address enterprise information security governance, which seeks to protect information assets and systems against attacks and incidents while establishing appropriate security as a priority for our information technology infrastructure and throughout the product development process. Our information security team, including a "red team" of dedicated engineers, and certain cross-functional employees routinely assess material risks from cybersecurity threats, and assess and update our cybersecurity risk management program in response to emerging trends and changes in our operations. We also engage third parties, including consultants and auditors, to evaluate the effectiveness of our risk management program, control environment, and cybersecurity practices through security audits, penetration testing, and other engagements.

companyName: BILL Holdings, Inc.

ticker: BILL


text: Our information security program is managed by a dedicated Chief Information Security Officer (CISO), who reports to our Chief Technology Officer and oversees a team responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. Our foundational security engineering, governance risk and compliance, product security and security operations teams report into our CISO and provide regular updates on significant or potentially significant threats and incidents. Our CISO has over 20 years of experience in information security, serving in roles of increasing responsibility within several public companies including companies in the cybersecurity and software fields. In addition, our Deputy CISO has nearly 20 years of experience serving in information security roles in healthcare and technology companies.


text: Our information security program includes an incident response program that coordinates activities across multiple teams in responding to cybersecurity incidents in accordance with a defined Incident Management Policy. This program is designed to detect, analyze, and escalate cybersecurity events, and includes a cybersecurity incident response team responsible for containment and recovery activities, and a crisis response team to liaise with business stakeholders, secure priority resources, and validate completion of any post-incident activities. In addition, we have established an executive security risk management committee composed of senior representatives of our legal, finance, information security, product, and marketing teams which meets on a quarterly basis to review our information security program and any noteworthy developments in the quarter. Finally, we coordinate internal simulations of cybersecurity incidents periodically to test the processes we have established.


text: We maintain a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. We conduct initial due diligence on the cybersecurity profile of our vendors as they are onboarded and provide continuous monitoring of critical third-party infrastructure and monitor any known breaches of those third-party systems. We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. We also provide regular, mandatory training for our personnel regarding cybersecurity threats as a means to equip our personnel with effective tools to address cybersecurity threats and to communicate our evolving information security policies, standards, processes and practices.


text: Although we are subject to ongoing and evolving cybersecurity threats, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to affect us, including our business strategy, result of operations or financial condition. If we or our partners were to experience a material cybersecurity incident in the future, such incident may have an adverse effect, including on our business operations, operating results, or financial condition. For more information regarding cybersecurity risks that we face and the related potential impacts on our business, see the risk factor titled "We, our partners, our customers, and others who use our services obtain and process a large amount of sensitive data. Any real or perceived improper or unauthorized use of, disclosure of, or access to such data could harm our reputation as a trusted brand and adversely affect our business, operating results, and financial condition."


text: In light of the critical importance of cybersecurity to our business, in the spring of 2023, our board of directors formed a standing cybersecurity committee. The cybersecurity committee meets quarterly and is responsible for reviewing with management our cybersecurity and other information technology risks, controls and processes, including the processes used to prevent or mitigate cybersecurity risks and respond to cybersecurity events. These reports include updates on our information security risks and threats, any notable incidents, escalations or third-party risks, the status of projects to strengthen our information security systems, assessments of the information security program, the emerging threat landscape and company security culture. The CISO provides reports at least quarterly to the cybersecurity committee as well as to our Chief Executive Officer, Chief Technology Officer, and other members of our senior management, as appropriate. The cybersecurity committee also receives quarterly updates from our legal department and third-party experts. Our cybersecurity committee provides regular updates to the board of directors on such reports, and coordinates with the audit committee of the board of directors with respect to any risks with implications for our financial reporting, accounting, internal controls or other matters presenting significant financial risk.


text: Our information security program is regularly evaluated by internal and external parties with the results of certain reviews reported to senior management and the cybersecurity committee. We also actively engage with key vendors and industry participants as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures. Our cybersecurity committee will also receive prompt and timely information regarding any material cybersecurity threats or incidents, as well as ongoing updates regarding any such threat or incident until it has been mitigated, resolved, or otherwise addressed. To mitigate the impact of any cybersecurity incidents, we maintain cybersecurity insurance in amounts that we believe are appropriate of our business, which provides coverage for such incidents.


text: Our information security program is managed by our interim Chief Information Security Officer (CISO), who reports to our Chief Technology Officer and oversees a team responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. Our foundational security engineering, governance risk and compliance, product security and security operations teams report into our interim CISO and provide regular updates on significant or potentially significant threats and incidents. Our interim CISO has nearly 20 years of experience serving in information security roles in healthcare and technology companies.


text: In light of the critical importance of cybersecurity to our business, in the spring of 2023, our board of directors formed a standing cybersecurity committee. The cybersecurity committee meets quarterly and is responsible for reviewing with management our cybersecurity and other information technology risks, controls and processes, including the processes used to prevent or mitigate cybersecurity risks and respond to cybersecurity events. These reports include updates on our information security risks and threats, any notable incidents, escalations or third-party risks, the status of projects to strengthen our information security systems, assessments of the information security program, the emerging threat landscape and company security culture. The interim CISO provides reports at least quarterly to the cybersecurity committee as well as to our Chief Executive Officer, Chief Technology Officer, and other members of our senior management, as appropriate. The cybersecurity committee also receives quarterly updates from our legal department and third-party experts. Our cybersecurity committee provides regular updates to the board of directors on such reports, and coordinates with the audit committee of the board of directors with respect to any risks with implications for our financial reporting, accounting, internal controls or other matters presenting significant financial risk.


text: We assess, identify and manage the material risks from cybersecurity threats relevant to our businesses through robust programs, including enterprise risk management ("ERM"), our risk assessment process ("RAP") and our cybersecurity program. To date, risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition.

companyName: Vontier Corp

ticker: VNT


text: There is strong engagement in risk management from company leadership, including the CEO, executives and senior leaders. This ERM program is driven by Vontier's Executive Risk Committee, which is led by the SVP, Chief Administrative Officer and comprised of business and functional leaders. Our Audit Committee oversees the ERM program and the Board of Directors have regular updates on topics that are identified through the RAP and overall risk management process.


text: Through the RAP, which is a tool in our ERM program, we identify and assess cybersecurity risks at a business unit level, evaluating the likelihood and potential impact of a risk universe encompassing finance, human capital, operations, information technology, legal and regulatory compliance, and strategy. Risks are individually analyzed from both inherent and residual perspectives, considering existing controls and mitigation processes in place. The businesses leverage the results from the assessment process to identify and implement efforts to further mitigate risks. Progress on mitigation projects is monitored and regularly reported to leadership as part of the RAP. In addition to our ERM and RAP, we have a cybersecurity program led by our Chief Information Officer ("CIO"), who reports to our Chief Financial Officer. Our current CIO has over 20 years of experience with large global companies where he worked extensively in providing strategic IT leadership and management in the areas of digital transformation, cybersecurity, risk management and ERP implementation. Our CIO oversees our Information Security department, chairs the Vontier Information Security Executive Committee ("VISEC"), which includes cross-functional leaders from finance, internal audit, information security, information technology, and legal and corporate affairs, and works with the businesses to conduct enterprise product security assessments, perform penetration testing and advance our cybersecurity policies and procedures. We have developed information security policies and standards based on the NIST Cybersecurity Framework, an internationally recognized framework; and we engage with third parties on our incident response processes, cybersecurity maturity assessment, as well as on our cyber security awareness, data security governance and vendor cyber risk management. Additionally, we review our cybersecurity maturity assessment on an ongoing basis to measure the Company's ability to detect, protect, respond and recover from a cyber incident.


text: The VISEC addresses relevant cybersecurity issues and provides guidance and updates on information security programs and projects. Additionally, the VISEC oversees the coordination of information security mitigation efforts arising from internal assessment, including from the RAP, as applicable. The Board has delegated to the Audit Committee the responsibility of exercising oversight with respect to the Company's cybersecurity risk management and risk controls. Our CIO provides multiple updates each year to the Audit Committee regarding cyber risk management governance and the status of projects that strengthen cybersecurity effectiveness. The full Board regularly receives briefs from the Audit Committee and management regarding the Company's cybersecurity program, including the Company's monitoring, auditing, implementation and communication processes, controls, and procedures.


text: In the event of a cyber incident, our CIO leads the execution of our cyber response plan, which includes a cross-functional group and triggers for escalation. We also have established a business continuity program to assess the cyber risks associated with our critical facilities' ability to recover and resume operational functionality. We continue to engage and educate employees internally on relevant cybersecurity threats.


text: There is strong engagement in risk management from company leadership, including the CEO, executives and senior leaders. The ERM program is driven by Vontier's Executive Risk Committee, which is led by the SVP, Chief Administrative Officer and comprised of business and functional leaders. Our Audit Committee oversees the ERM program and the Board of Directors have regular updates on topics that are identified through the RAP and overall risk management process.


text: Through the RAP, which is a tool in our ERM program, we identify and assess cybersecurity risks at an operating company level, evaluating the likelihood and potential impact of a risk universe encompassing finance, human capital, operations, information technology, legal and regulatory compliance, and strategy. Risks are individually analyzed from both inherent and residual perspectives, considering existing controls and mitigation processes in place. The businesses leverage the results from the assessment process to identify and implement efforts to further mitigate risks. Progress on mitigation projects is monitored and regularly reported to leadership as part of the RAP. In addition to our ERM and RAP, we have a cybersecurity program led by our Chief Information Officer ("CIO"), who reports to our Chief Financial Officer. Our current CIO has over 20 years of experience with large global companies where he worked extensively in providing strategic IT leadership and management in the areas of digital transformation, cybersecurity, risk management and ERP implementation. Our CIO oversees our Information Security department, chairs the Vontier Information Security Executive Committee ("VISEC"), which includes cross-functional leaders from finance, internal audit, information security, information technology, and legal and corporate affairs, and works with the businesses to conduct enterprise product security assessments, perform penetration testing and advance our cybersecurity policies and procedures. We have developed information security policies and standards informed by the NIST Cybersecurity Framework, an internationally recognized framework; and we engage with third parties on our incident response processes, cybersecurity maturity assessment, as well as on our cyber security awareness, data security governance and vendor cyber risk management. Because we are aware of the risks associated with third-party service providers, we implement processes to oversee and manage these risks. We conduct security assessments of third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. Additionally, we review our cybersecurity maturity assessment on an ongoing basis to measure the Company's ability to detect, protect, respond and recover from a cyber incident.


text: Index to Financial Statements There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information.

companyName: Arcutis Biotherapeutics, Inc.

ticker: ARQT


text: The Audit Committee receives at least quarterly reports from our Chief Digital & Technology Officer and internal security staff on developments in our information technology infrastructure and cybersecurity program. This includes updates, as appropriate, on key information technology initiatives, new and existing cybersecurity risks, and how management is managing risks. In addition, the Chief Digital & Technology Officer updates the Audit Committee, as necessary, regarding any material cybersecurity incidents per our established severity and response framework, as well as any incidents with lesser impact potential.


text: The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program and an annual report from management on our cybersecurity risks.


text: Our security technology team, led by the Head of Core Technology & Security ("Head of CT&S"), is responsible for managing and directing day-to-day assessment and management of materials risks from cybersecurity threats, including oversight of our cybersecurity tools, controls and strategies to protect organization assets, networks and data. The Head of CT&S reports to our Chief Digital and Technology Officer. The Head of CT&S has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. He is an ISACA certified security manager and has over 20 years of experience in information technology, with over 10 years specifically focused on cybersecurity risk management.


text: Our management supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: Key elements of our cybersecurity risk management program include but are not limited to the following: • risk assessments designed to help identify material risks from cybersecurity threats to our critical systems and information; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, including incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for key service providers based on our assessment of their criticality to our operations and respective risk profile, suppliers, and vendors. • Risk assessments designed to help identify material risks from cybersecurity threats to our critical systems and information, as well as risks of data leakage and unauthorized access to sensitive information. • Ongoing review of the controls framework to support the security of emerging technologies, including artificial intelligence (AI) and generative AI (GenAI), ensuring alignment with evolving risks and regulatory expectations.


text: There can be no assurance that our and our third-party service providers', strategic partners', contractors', consultants', and collaborators' cybersecurity risk management program and processes, including policies, controls, or procedures, will be fully implemented, complied with, or effective in protecting our systems and information.


text: The Audit Committee receives at least quarterly reports from our Chief Digital & Technology Officer and internal security staff on developments in our information technology infrastructure and cybersecurity program. This includes updates, as appropriate, on key information technology initiatives, new and existing cybersecurity risks, and how management is managing risks. In addition, the Chief Digital & Technology Officer updates the Audit Committee, where it deems appropriate, regarding any cybersecurity incidents it considers to be significant or potentially significant per our established severity and response framework.


text: The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also periodically receives briefings from management on our cyber risk management program and an annual report from management on our cybersecurity risks.


text: Our security technology team, led by the Head of Core Technology & Security (Head of CT&S), is responsible for managing and directing day-to-day assessment and management of materials risks from cybersecurity threats, including oversight of our cybersecurity tools, controls and strategies to protect organization assets, networks and data. The Head of CT&S reports to our Chief Digital and Technology Officer. The Head of CT&S has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. He is an ISACA certified security manager and has over 20 years of experience in information technology, with over 10 years specifically focused on cybersecurity risk management.


text: Our management takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our IT environment.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan. There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information.

companyName: Immuneering Corp

ticker: IMRX


text: We design and assess our cybersecurity risk management program based in part on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). This does not, nor is it in any way intended to, imply that we currently or may in the future meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and/or financial risk areas.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, potential products, services, and our broader enterprise IT environment; • a cyber security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, as we believe appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • risk management processes with respect to third party service providers, suppliers, and vendors.


text: The Audit Committee receives periodic reports from management on our cybersecurity risks. In addition, management is tasked with updating the Audit Committee, if and as necessary, regarding any material cybersecurity incidents, as well as other incidents with lesser impact potential.


text: The Audit Committee periodically reports to the full Board of Directors regarding its activities, which may include those related to cybersecurity. The full Board of Directors may also from time to time receive briefings from management related to our cyber risk management program. Directors may receive presentations on cybersecurity topics from our management, internal cyber security / information technology staff, or external experts as part of continuing education on topics that impact public companies.


text: Our management team, including our Executive Director of IT with supervision by our Chief Legal Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The management team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and external cybersecurity consultants. Our Executive Director of IT has previous experience managing information technology infrastructure and cybersecurity, as well as responding to cybersecurity incidents, at other biopharmaceutical companies.


text: Our process for identifying, assessing and managing material risks from cybersecurity threats is part of our broader risk management system and processes. We use a risk management framework based on applicable laws and regulations and informed by industry standards and industry-recognized practices, for managing cybersecurity risks within our offerings, infrastructure and corporate resources. As part of our risk management process, we conduct application security assessments, vulnerability management, penetration testing, security audits and risk assessments. We also maintain a variety of incident response plans, playbooks and processes that are utilized if and when incidents are detected.

companyName: Rush Street Interactive, Inc.

ticker: RSI


text: In addition, we have processes in place to govern our third-party vendor security risks. We generally gather information, usually through questionnaires, from certain third parties who contract with the Company and receive sensitive data from us or have access to or integrate with our systems, in order to help us assess potential risks associated with their security processes. We also generally require third parties to, among other things, maintain security controls to protect confidential information and data, and generally notify us of any data breaches that may impact our data through obligations that are documented in data processing or other agreements. We also carry insurance that provides certain, limited protection against losses arising from a cybersecurity incident.


text: Internally, we also have a security awareness program which includes training that reinforces our information technology and security policies, standards and practices, and we require that our employees comply with these policies. The security awareness program offers training on how to identify potential cybersecurity risks and protect our resources and information. These trainings are mandatory for all employees and take place throughout the year, and it is supplemented by testing initiatives, including periodic phishing tests. We also provide access to specialized training for certain employee roles, such as application developers. Finally, our privacy and data protection program requires all employees to take periodic awareness training on data privacy. This training includes information about confidentiality and security, as well as responding to unauthorized access to or use of information.


text: From time to time, we engage assessors, consultants, auditors, or other third-party service providers to enhance risk mitigation efforts. For instance, we periodically perform simulations and tabletop exercises for our technical teams and senior leaders to prepare for a possible cyber crisis and incorporate external resources and advisors as needed. We also engage third-party consultants and service providers to assist with penetration testing, security audits and vulnerability assessments in certain jurisdictions.


text: While our full Board has overall responsibility for risk oversight and is currently overseeing our business continuity, regulatory and compliance risks, it is supported in this function by our Audit Committee, Compensation Committee and NCG Committee. Our Audit Committee periodically reviews our cybersecurity, information technology, data protection, privacy and compliance risk management, as well as performs other risk oversight functions. Through its regular meetings with management, including the accounting and finance, legal, internal audit, regulatory compliance and information technology and security functions, the Audit Committee reviews and discusses our cybersecurity risk management practices and policies and periodically updates the Board or relevant members or committees thereof, about any material risks and the appropriate mitigating factors.


text: Our Chief Information Officer, who has information technology, engineering, product and security knowledge, experience and skills gained over a decade of experience leading product and engineering organizations, and certain members of his team as well as outside advisors who have cybersecurity experience are responsible for implementing and maintaining cybersecurity and data protection practices at the Company and reporting on cybersecurity matters to the relevant members of management. This team is supported, from time to time, by third-party consultants and service providers with specific areas of cybersecurity expertise. Management is responsible for identifying, assessing and managing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures, and maintaining cybersecurity policies and procedures. Management also regularly communicates cybersecurity risks and activities with other members of management and, as appropriate, to our Board or relevant members or committees thereof, including the Audit Committee.


text: We, like many other companies in the gaming and entertainment space, experience routine cybersecurity threats such as DDOS, phishing or social engineering attacks. While our business strategy, results of operations and financial condition have not been materially affected by risks from any such cybersecurity threats, including as a result of previously identified cybersecurity incidents, we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, see Item 1A Risk Factors of this Annual Report on Form 10-K.


text: In addition, we have processes in place to govern our third-party vendor security risks. We generally gather information, usually through questionnaires, from certain third parties who contract with the Company and receive sensitive data from us or have access to or integrate with our systems, in order to help us assess potential risks associated with their security processes. We also generally require third parties to, among other things, maintain security controls to protect confidential information and data, and generally notify us of any data breaches that may impact our data through obligations that are documented in data processing or other agreements. In addition, we carry insurance that provides certain, limited protection against losses arising from a cybersecurity incident.


text: Internally, we have a security awareness program, which includes training that reinforces our information technology and security policies, standards and practices, and we require that our employees comply with these policies. The security awareness program offers training on how to identify potential cybersecurity risks and protect our resources and information. These trainings are mandatory for all employees and take place throughout the year, and it is supplemented by testing initiatives, including periodic phishing tests. We also provide access to specialized training for certain employee roles, such as application developers. Finally, our privacy and data protection program requires all employees to take periodic awareness training on data privacy. This training includes information about confidentiality and security, as well as responding to unauthorized access to or use of information.


text: Our Chief Information Officer, who has information technology, engineering, product and security knowledge, experience and skills gained over a decade of experience leading product and engineering organizations, our Chief Information Security Officer, who also has over two decades of cybersecurity experience in both public and private organizations, and certain members of their teams as well as outside advisors who have cybersecurity experience are responsible for implementing and maintaining cybersecurity and data protection practices at the Company and reporting on cybersecurity matters to the relevant members of management. This team is supported, from time to time, by third-party consultants and service providers with specific areas of cybersecurity expertise. Management is responsible for identifying, assessing and managing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures, and maintaining cybersecurity policies and procedures. Management also regularly communicates cybersecurity risks and activities with other members of management and, as appropriate, to our Board or relevant members or committees thereof, including the Audit Committee.


text: We, like many other companies in the gaming and entertainment space, including some of our market access partners and suppliers, experience routine cybersecurity threats such as DDOS, phishing or social engineering attacks. While our business strategy, results of operations and financial condition have not been materially affected by risks from any such cybersecurity threats, including as a result of previously identified cybersecurity incidents, we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, see Item 1A Risk Factors of this Annual Report on Form 10-K.


text: Commitment to Security Security is a foundation on which ZoomInfo builds and maintains customers' trust. We are committed to protecting our information and our customers' information from both intentional and unintentional misuse and have implemented a robust Information Security Management System ("ISMS") that meets the ISO 27001 Standard requirements as well as the ISO 27701 (Privacy) and ISO 27017 (Cloud Security) standards. We have also earned AICPA's SOC 2 attestation regarding the security, availability, and confidentiality controls around our services and meet the security requirements of the Cloud Security Alliance (CSA) STAR program.

companyName: ZoomInfo Technologies Inc.

ticker: GTM


text: Risk Management Framework Our security program is risk-driven and integrated into our overall enterprise risk management (ERM) process. We emphasize risk detection, which serves as the foundation for risk management-related business decisions. Our ISMS provides the structure for our overall security program and serves to assess, manage, monitor, and minimize our cybersecurity risks. The program includes: • Context of the organization • Leadership • Planning • Support • Operation • Performance evaluation • Improvement


text: The ISMS consists of a set of policies and procedures that serve as a foundation for risk identification and remediation across all company assets. ZoomInfo's ISMS implementation allows for the appropriate integration of security controls into existing or newly created business processes. ZoomInfo's risk management platform is based on the ISO 31000 Risk Management Standard, and continuous risk assessment activities are conducted in partnership and coordination with risk owners in various functions.


text: Cybersecurity Team and Internal Operations Our Cybersecurity team is comprised of a diverse group of security veterans with experience managing all facets of information risk including, but not limited to, Application Security, Data Governance, Security Engineering, Security Processes and Services, Secure Software Development (S-SDLC), Governance Risk and Compliance (GRC), Risk Management, Cyber Threat Intelligence, Breach Readiness, Cyber Defense Center for monitoring (CDC), Offensive Security, and Security Awareness.


text: We also consult with outside experts to identify and implement best practices, help gauge the security climate, and identify effective methods for related skill development and information sharing.


text: Our information security policies outline the roles and responsibilities within the organization, and our security team works directly with specific members of senior management we call "security ambassadors" to help ensure that the various information security directives are executed as required in their respective departments. Our security partners help to establish, assess, and enhance business processes by ensuring the required information security risk management practices are suitably embedded within their respective processes.


text: All employees and contractors are required to participate in continuous and dynamic security awareness training. The training includes an overview of key security topics, policies, and responsibilities. Regular security bulletins are disseminated to employees and contractors with security alerts, tips and best practices, external resources, security procedures, and contact information so that they can ask security-related questions or raise concerns.


text: Prevention, Detection, and Response ZoomInfo has implemented preventative security and detection measures, including asset protection and access controls in the following key areas: • Critical Assets • Data Protection • Application Protection • Cloud Security • Network Security • End Point Devices • Perimeter Defense • Physical Protection We also maintain written incident response plans and conduct periodic cross-functional tabletop exercises to help assess our incident response plans, processes, and capabilities in addressing cybersecurity threats.


text: As part of our security framework and evaluation of our supply chain risks, we review our service providers' security practices and require appropriate certifications from them. We, and also perform an analysis of controls to manage our third-party security risks.


text: Cybersecurity Risks For information related to whether risks from cybersecurity threats have materially affected or are reasonably likely to materially affect ZoomInfo, see "Risk Factors—Cyber-attacks and security vulnerabilities could result in serious harm to our reputation, business, and financial condition" in Part I, Item 1A of this Annual Report on Form 10-K.