text: The Board of Directors is ultimately responsible for the oversight of cybersecurity risk management, with the Board Risk Committee assisting the Board with oversight of the Company's cybersecurity risk program and reporting. The Board of Directors appoints the CISO, and the CISO is given the full authority of the Board for administering and executing the Company's written information security program.. The CRO/CISO delivers an annual report to the full Board of Directors on the status and effectiveness of the Company's written information security program, and reports to the Board Risk Committee any emerging threats or cyber risks on a periodic basis throughout the year. The Board Risk Committee has also approved an Information Security and Cybersecurity Risk Appetite Statement.


text: At the management level, the Enterprise Risk Management Committee ("ERMC") is primarily responsible for cybersecurity risk management. The Committee is comprised of senior executives with risk management and information security expertise. The Information Technology Steering Committee ("ITSC") is a sub-committee of ERMC and is also comprised of senior executives and staff with risk management and information security expertise. ITSC governs the first line of defense cybersecurity risk management activities and furnishes approval items, status reports, and approved Committee minutes to ERMC following a meeting. ERMC governs the second line of defense cybersecurity risk management activities and furnishes key risk indicators, risk assessments, reports, issues and committee minutes to the Board Risk Committee. The CRO/CISO assigns quarterly cyber security training to all Company employees and ERMC reviews and approves the training curriculum on an annual basis. Additionally, the CRO/CISO ensures the Board receives annual cyber security training.

companyName: Capital Bancorp Inc

ticker: CBNK

secItem: Item 1C


text: We strive to minimize the occurrence of cybersecurity incidents and the risks resulting from such incidents. However, when a cybersecurity incident does occur, the Company has in place an incident response program to guide our assessment of and response to the incident. The CRO/CISO coordinates the Company's response to a cybersecurity incident, including investigating, recording and evaluating any potential, suspected or confirmed incidents involving non-public customer information or Company confidential information. The CRO/CISO informs senior management and the Board Risk Chair and Board Audit Committee Chair as soon as practical if a significant security incident occurs. Formal incident reports, if/when applicable, are reviewed by ITSC, ERMC, and the Board Risk Committee.


text: The Company employs third parties in fulfilling certain aspects of its information security and cybersecurity programs. For example, we engage third parties to: monitor our network 24/7/365, escalate security alerts, when applicable, perform penetration testing, conduct social engineering tests and assist management with technology upgrades/installations. The BISO assists the CRO/CISO in assessing and monitoring information risks posed by third parties and any non-compliance with the controls created to address such risks. With respect to cybersecurity incidents affecting our third-party service providers, the CRO/CISO works with our service providers to understand and document any incidents, along with managing the impact to us and reporting such significant incidents to senior management, ITSC, ERMC, and the Board Risk Committee.


text: Risk Management and Strategy The Company implements a comprehensive Information Security Program ("Program") to safeguard data confidentiality, integrity, and availability. The Program leverages recognized frameworks like National Institute of Standards and Technology (or NIST) and Federal Financial Institutions Examinations Council ("FFEIC") to identify, prevent, and mitigate cybersecurity threats. Regular assessments and updates ensure the Program's effectiveness in managing and reducing risk.

companyName: California BanCorp \ CA

ticker: BCAL


text: The Program integrates seamlessly with the company's enterprise risk management program. Continuous threat and vulnerability assessments inform system and control updates, effectively mitigating risks. Layered security controls work together to protect customer information and transactions. Additionally, third-party experts conduct periodic program evaluations through penetration testing, audits, and best practice consultations, with results driving program improvement initiatives. As a regulated entity, Bank of Southern California undergoes regular bank regulatory examinations evaluating the information security program and its compliance with federal regulations.


text: The Company's third-party risk management program oversees and identifies cybersecurity threats associated with service providers. While visibility into third-party operations is limited, risk-based evaluations are conducted. These evaluations involve reviewing security assessment questionnaires, testing summaries, audit reports, and information security policies.


text: Recognizing the importance of continuous security awareness, the Company provides comprehensive employee training. This includes mandatory cybersecurity and fraud training at onboarding, monthly email phishing tests, and annual computer-based training.


text: In addition, the Company has an incident response plan ("IRP") that is in effect if an event is identified by information technology or information security team or one of our third party vendors. The Company's Information Security Officer ("ISO") would activate the IRP and communicate with the team members in accordance with the IRP. If the incident is material, the Chief Risk Officer would disclose the incident to the management Disclosure Control Committee.


text: While no material cybersecurity incidents have been identified during the reported fiscal year, the Company acknowledges the ongoing and evolving nature of cyber threats and remains vigilant in its efforts.


text: The Company's internal controls incorporate a protocol for reporting and escalating information security matters to management and the Board of Directors for resolution and, if necessary, disclosure of any material incidents. The Board oversees continuous efforts to strengthen operational resilience and receives ongoing education to enhance their oversight capabilities in the face of evolving threats. The ISO, who reports directly to the Chief Risk Officer, periodically updates the Company's Information Technology Committee, the Company's Audit and Risk Committee ("ARC Committee") and the Board of Directors on information and cybersecurity risks, threats, exposures, and mitigation measures. The Company's IRP is regularly tested, incorporating cybersecurity scenarios.


text: The ISO leads program development, implementation, and reporting to the Board. The ISO possesses extensive experience with over 25 years securing information systems and data holding many industry certifications including Microsoft Certified Software Engineer + Security, Exchange Security, Comptia Security+, Pentest+, Cyber Security Analyst(CYSA+), Cisco Certified Network Admin + Security enhancement, Cisco Certified Design architect and Certified Ethical Hacker. Recognizing cybersecurity as a shared responsibility, the Company conducts periodic management-level simulations and tabletop exercises with external resources and advisors as needed.


text: The Board of Directors provides ultimate oversight and monitoring of the Program and its policies. The ARC Committee oversee areas like information technology activities, cybersecurity-related risks, and disaster recovery processes. Additionally, management-level technology and security personnel oversee program management and related assessments, while operational committees manage specific cybersecurity-related risks. While not currently experiencing material impacts, the Company acknowledges the existence of cybersecurity risks.


text: As part of our cybersecurity risk management program, we perform the following: • Cybersecurity risk assessment is performed on all new products and product updates; • Employ internal staff with security certifications, and we work with third parties to perform security vulnerability testing; • Changes to data protection laws are closely monitored and necessary changes are implemented; • Provide routine security training to employees and communicate any emerging threats; • Review the security posture of all third parties that we engage; • Maintain a comprehensive incident response plan; • Carry cybersecurity insurance to help mitigate any potential losses arising from cybersecurity incidents.

companyName: Phunware, Inc.

ticker: PHUN


text: As an externally managed company, our day-to-day operations are managed by our Manager and our executive officers under the supervision of our board of directors and its committees. Our executive officers are senior investment professionals provided to us through our Manager pursuant to our management agreement with our Manager. Our business is highly dependent on the communications and information systems of our Manager, its affiliates and third-party service providers. Our Manager is an affiliate of ORIX Corporation USA ("ORIX USA"), a diversified financial company and a subsidiary of ORIX Corporation ("ORIX") and participates in and is subject to ORIX USA's cybersecurity program. Accordingly, we rely and Manager relies on ORIX USA and its cybersecurity risk management program to identify, assess and manage material risks to our business from cybersecurity threats.

companyName: Lument Finance Trust, Inc.

ticker: LFT


text: To date, Cybersecurity threats, including as a result of any previous Cybersecurity incidents, have not had a material impact nor, are they anticipated to significantly affect the Company, including our business strategy, results of operations or financial condition. For a discussion of how risks from cybersecurity threats affect our business see, "Part I. Item IA. Risk Factors - the occurrence of cyber-incidents, or a deficiency in our Manager's Cybersecurity or those of any of our third party service providers, could negatively affect our business by causing a disruption to our operations, a compromise of our confidential information or damage to our business relationships or reputation, all of which could negatively impact our business and results of operations" in this Annual Report on Form 10-K.


text: Cybersecurity Governance Our board of directors is responsible for directing and overseeing our risk management. Our board of directors administers this oversight function directly, with support from its committees. In particular, the audit committee of our board of directors (the "audit committee") has the responsibility to consider and discuss our major financial risk exposures and the steps our Manager takes, or is required to take, to monitor and control these exposures, including guidelines and policies to govern the process by which risk assessment and management is undertaken. Our audit committee also monitors compliance with legal and regulatory requirements, in addition to overseeing the performance of our internal audit function. Pursuant to the management agreement between us and our Manager, our Manager is responsible for identifying, assessing, and managing our material risks from cybersecurity threats. Our Manager relies on ORIX USA and ORIX USA information and security team, including the ORIX USA CIO, to provide us with a comprehensive cybersecurity risk management program.


text: Periodically, at least annually, ORIX USA's CIO and/or other members of the ORIX USA information and cybersecurity team will present to the LFT audit committee on various topics relating to ORIX USA's technology risks, including ORIX USA's cybersecurity program (including the results of cybersecurity tabletop exercises), cybersecurity issues (including those relating to data protection, insider threats, regulatory changes and geopolitical cyber threat management) and risk management (including the results of periodic technology audits).


text: ORIX USA maintains a Cybersecurity incident response capability that includes detailed policies, plans and modular run books and maps designed around different types of Cyber Incidents. The plan and run books are tested annually through Cybersecurity tabletop simulations where incident response technical, and executive team members go through real-world scenarios focused on current Cyber threats. ORIX USA's Cybersecurity incident response plan provides for escalation of identified Cybersecurity threats and incidents, including, as appropriate, to our management. These discussions provide a mechanism for the identification of Cybersecurity threats and incidents, assessment of Cybersecurity risk profile or certain newly identified risks relevant to our company, and evaluation of the adequacy of our Cybersecurity program, including risk mitigation, compliance and controls. ORIX USA has established a notification decision framework to determine when the notifications regarding certain cybersecurity incidents, with different severity thresholds triggering notification to different recipient groups, including our Manager and officers of LFT.


text: The Company faces cybersecurity threats such as ransomware and denial-of-service. The Company's customers, vendors and business partners face similar cybersecurity threats, and a cybersecurity incident impacting the Company or any of these third-party entities could materially adversely affect our operations, performance and results of operations. In particular, the Company emphasizes the importance of cybersecurity as it may receive, store and transmit personal medical and other information relating to its customers, and believes it is imperative to protect this information from potential threats.

companyName: Verano Holdings Corp.

ticker: VRNO


text: Additionally, the Board recognizes the critical importance of maintaining the trust and confidence of the Company's customers, vendors, business partners and employees. The Board oversees the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM"). The Company's Cybersecurity Incident Response Plan (the "Cybersecurity Plan"), which includes the Company's standards, processes and practices are a component of the Company's ERM program and are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. In general, the Company's Cybersecurity Plan states that it seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on (i) preserving restrictions on information access and disclosing, including means for protecting the confidentiality of personal private and proprietary information, (ii) guarding against improper information modification or destruction, and (iii) ensuring timely and reliable access to the Company's information systems.


text: Preparing for Cybersecurity Risks: The Company's Cybersecurity Plan lays out on-going processes for incident response and prevention, including processes for bettering Company cybersecurity response following any cybersecurity incidents. All employees undergo training to aid in understanding the Company's expectations for safeguarding all data stored on Company cyber networks. In addition to its Cybersecurity Plan, the Company has established risk management guidelines (the "Risk Management Guidelines") that address the Company's response to risks, including a cybersecurity incident. The Risk Management Guidelines describe the Company's policy of managing enterprise risk, including external risks arising from cybersecurity threats and provide that the audit committee of the Board (the "Audit Committee") will coordinate with and assist the Board in its oversight of risk.


text: The Company's Risk Management Guidelines also dictate that the Board will conduct an annual performance evaluation of the Board's oversight of the Company's overall risk-taking tolerance and management, conducted in such manner as the Board deems appropriate.


text: Identify Risks and Notify Company of Risks: The Cybersecurity Plan dictates an approach to identify and confirm expected incidents, to determine the severity of the risk and promptly take basic initial containment steps. The Cybersecurity Plan includes notification processes for certain cybersecurity incidents which aim to inform and activate an incident response team consisting of officers and employees at the Company and certain external service providers.


text: Containment, Eradication and Recovery: The Company's Cybersecurity Plan includes processes for containing ongoing cybersecurity threats if they occur and preventing past malicious activity, providing proposed solutions to malicious activity, and recovering any business processes with the goal of restoring business operations.


text: Third-Party Risk Management: The Company's Cybersecurity Plan contemplates a Company response to cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.


text: Use of Third-Party Vendors: Per the Company's Risk Management Guidelines, the Board may, in its discretion, delegate all or a portion of its duties and responsibilities to other committees of the Board. While the Board has not yet engaged assessors, consultants auditors or other third parties to aid in processes related to cybersecurity threats, any such committee will have the resources and authority appropriate to discharge its duties and responsibilities, including the authority to select, retain, terminate, and approve the fees and other retention terms of special or independent counsel, accountants or other experts, as it deems appropriate, without seeking approval of the Board or management. The Company may, from time to time, engage third party vendors to assist in developing, identifying and managing risks.


text: Board Oversight: The Board has reviewed and discussed with management, the Company's risk assessment process, risk management framework and reporting mechanisms, implementation and monitoring, including as each of these relates to cybersecurity risks. The Audit Committee coordinates and assists the Board in its oversight of risk. The Board and Audit Committee each receive presentations and reports on Company risks, including cybersecurity risks. The Cybersecurity Plan also contemplates that the Board will also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. The Board has discussed the Company's approach to cybersecurity risk management with the members of management, including the Company's Executive Vice President of Information Technology.


text: Management: The Company has a Cyber Incident Response Team (the "IRT"), which is comprised of employees including, among others, the Executive Vice President of Information Technology, the Chief Financial Officer ("CFO"), the Chief Operations Officer ("COO") and the Chief Legal Officer ("CLO"), as well as potential outside advisors and service providers, as deemed appropriate. The Cybersecurity Plan contemplates that, in the case of a cybersecurity risk, Executive Vice President of Information Technology, in coordination with the IRT, will work collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity risk management program, the Cybersecurity Plan contemplates that multidisciplinary teams throughout the Company will be deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the Cybersecurity Plan dictates that the Executive Vice President of Information Technology and the IRT monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the Board when appropriate.


text: The Executive Vice President of Information Technology has served in various roles in information technology and information security for over 25 years, including serving as the Chief Information Officer of other public companies.


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. See Item 1A of Part 1 – "Risks Related to our Business and Operations – Information Technology, Cybersecurity and Intellectual Property" for additional information on risks related to cybersecurity threats.


text: Information Security Risk Management and Strategy The Company is committed to developing robust governance and oversight of cybersecurity risks and to implementing processes, controls and technologies designed to help assess, identify, and manage material risks. As described further in "—Information and Security and Governance Oversight" below, the Vice President of IT is responsible for Li-Cycle's information security program and as part of its broader risk oversight, the Board of Directors of the Company oversees risks from information security threats both directly and through the Audit Committee of the Board of Directors of the Company. Our information technology ("IT"), infrastructure, applications, and networks are susceptible to potential impacts due to the escalating sophistication and frequency of cyber-attacks and security incidents. Breaches in our technology systems, whether from circumventing security measures, denial-of-service attacks, hacking, phishing, computer viruses, ransomware, malware, employee errors, malfeasance, social engineering, vendor software supply chain compromises, physical breaches, or other actions, have the potential to compromise the confidentiality, availability, and integrity of crucial information. Such incidents may cause interruptions or malfunctions in our manufacturing systems, applications, and data processing, thereby disrupting other business operations. Additionally, critical information associated with our business operations is managed by some of our third-party vendors.

companyName: Li-Cycle Holdings Corp.


text: Anticipating or preventing all cyber-attacks requires an ever-present focus. A cyber-attack or a security incident leading to a breach could disrupt our business operations, harm our reputation, necessitate compliance with data breach notification laws, and subject us to litigation, regulatory investigation, or other liabilities under laws, regulations, and contractual obligations. This could result in increased costs, significant legal and financial exposure, and reputational damage.


text: We invest in information security and data privacy measures to safeguard our systems and data. This includes organizational investments, incident response plans, technical defenses, and employee training. We also utilize a third party to conduct vulnerability scans. Our approach to cyber-security risk management is designed to identify, assess, prioritize and manage major risk exposures that could affect our ability to execute our corporate strategy and fulfill our business objectives.


text: For instance, we utilize our existing information security measures to oversee operational landscapes, address suspicious events, and generate necessary reports shared during our monthly meetings. Additionally, as deemed necessary, we request third-party service providers to furnish System and Organization Controls ("SOC") reports. Simultaneously, we are in the process of revising and formulating new IT policies, standards, and procedures in harmony with the National Institute of Standards and Technology Cybersecurity framework.


text: In 2023, we launched an ongoing enterprise-wide communication initiative focused on cyber threats, which aims to educate Li-Cycle employees on recognizing and responding to potential cyber threats effectively, and serves as a reminder of the critical role each individual plays in ensuring the safety of our organization.


text: We maintain the availability of cybersecurity consultants as required and regularly conduct vulnerability scans within our environment to identify areas for ongoing enhancements. Additionally, our IT General Controls (ITGC) undergo audits, encompassing processes that overlap with cybersecurity concerns such as access control, permissions, and robust password management. The insights derived from these and other assessments guide us in refining our information security practices, procedures, and technologies.


text: Information Security and Governance Oversight The Vice President of IT is responsible for Li-Cycle's information security program. In this capacity, the executive oversees the enterprise-wide cybersecurity strategy, ensuring the development of policies and standards, the implementation of processes, and the management of architectural elements. The Vice President of IT is responsible for assessing and managing material risks from cybersecurity threats, and is supported in delivering this function with a dedicated internal IT team. The Vice President of IT has over eight years of leadership experience as a Chief Information Officer and Chief Technology Officer, with experience overseeing information security, risk management, and compliance functions. The Cybersecurity Steering Committee convenes no less than quarterly to evaluate and address significant risks stemming from cybersecurity threats.


text: Additionally, as part of its broader risk oversight, the Board of Directors of the Company oversees risks from information security threats both directly and through the Audit Committee of the Board of Directors of the Company. As reflected in its charter, the Audit Committee is required to periodically review and receive reports from management regarding risks and exposures related to information technology and cyber security.


text: The Vice President of IT submits reports to the Audit Committee and other senior management members as appropriate. These reports provide insights into the evolving threat landscape, updates on the organization's cyber risks and threats, evaluations of the information security program, and the status of initiatives aimed at improving the information security program and its systems.


text: As an externally advised company, our day-to-day operations are managed by our adviser and our executive officers under the oversight of our board of directors. Our executive officers are senior FS Investments professionals and our adviser is an affiliate of FS Investments. As such, we are reliant on FS Investments for assessing, identifying and managing material risks to our business from cybersecurity threats.

companyName: FS Credit Real Estate Income Trust, Inc.


text: Our business is dependent on the communications and information systems of the adviser, as an affiliate of FS Investments. We also rely on the communications and systems of other third-party service providers. FS Investments has implemented a cybersecurity program that applies to all of its subsidiaries and affiliates, including us and our operations.


text: Cybersecurity Program Overview FS Investments has instituted a cybersecurity program designed to identify, assess, and manage cybersecurity risks applicable to us. The cybersecurity risk management program involves, among other things, risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which we rely. FS Investments actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by us.


text: We rely on FS Investments to engage external experts, including cybersecurity assessors, consultants and auditors to evaluate cybersecurity measures and risk management processes, including those applicable to us. We are also included in the FS Investments risk management program and processes, which include cybersecurity risk assessments.


text: We depend on and engage various third parties, including suppliers, vendors and service providers, to operate our business. We rely on the expertise of the third-party risk management, legal, information technology and compliance personnel of the adviser and FS Investments, including the Chief Information Security Officer ("CISO"), of FS Investments, when identifying and overseeing risks from cybersecurity threats associated with our use of such entities.


text: To date, cybersecurity risks, including as a result of any previous cybersecurity incidents, have not materially affected and we believe are not reasonably likely to affect the Company, including its business strategy, results of operations or financial condition.


text: Board Oversight of Cybersecurity Risks The audit committee of the board of directors (the "Audit Committee"), provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Audit Committee receives periodic updates from the FS Investments CISO and our Chief Compliance Officer ("CCO") regarding the overall state of the FS Investments cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting us.


text: Management's Role in Cybersecurity Risk Management Our management, including our CCO, is responsible for assessing and managing material risks from cybersecurity threats. The CCO oversees our risk management function generally and relies on the FS Investments CISO to assist with assessing and managing material risks from cybersecurity threats. The CISO has over 10 years of experience in actively managing cybersecurity and information security programs for financial services companies with complex information systems. The CCO has been responsible for this oversight function as our CCO for over 10 years and has worked in the financial services industry for over 40 years, during which the CCO has gained expertise in assessing and managing risk applicable to us.


text: Management is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents impacting us, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, information technology and/or compliance personnel of the adviser and FS Investments.


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on us are assessed on an ongoing basis, and how such risks could materially affect our business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, we have not identified any impact from cybersecurity threats, including as a result of previous cybersecurity incidents, that we believe have materially affected, or are reasonably likely to materially affect us, including our business strategy, operational results, and financial condition.


text: We have processes in place to identify, assess and manage material risks from cybersecurity threats. Our business is dependent on the communications and information systems of FS/EIG Advisor, as an affiliate of FS Investments. We also rely on the communications and systems of other third-party service providers. FS Investments has implemented a cybersecurity program that applies to all of its subsidiaries and affiliates, including us and our operations.

companyName: FS Specialty Lending Fund

ticker: FSEN


text: Cybersecurity Program Overview FS Investments has instituted a cybersecurity program designed to identify, assess and manage cybersecurity risks applicable to us. The cybersecurity risk management program involves, among other things, risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which we rely. FS Investments actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by us.


text: We depend on and engage various third parties, including suppliers, vendors and service providers, to operate our business. We rely on the expertise of the third-party risk management, legal, information technology and compliance personnel of FS/EIG Advisor and FS Investments, including the Chief Information Security Officer, or the CISO, of FS Investments, when identifying and overseeing risks from cybersecurity threats associated with our use of such entities.


text: Board Oversight of Cybersecurity Risks The audit committee of the board of trustees, or the Audit Committee, provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Audit Committee receives periodic updates from the FS Investments CISO and our Chief Compliance Officer, or the CCO, regarding the overall state of the FS Investments cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting us.


text: Management is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents impacting us, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, information technology and/or compliance personnel of FS/EIG Advisor and FS Investments.


text: We recognize the critical importance of cybersecurity in protecting our business and our stakeholders' information. We are committed to maintaining a robust cybersecurity risk management program and implementing a comprehensive strategy to mitigate cyber threats and vulnerabilities. Our cybersecurity policies, standards, processes and practices are fully integrated into our overall enterprise risk management program, as described below. This disclosure outlines our cybersecurity risk management approach, strategy, and governance structure.

companyName: FORWARD AIR CORP

ticker: FWRD


text: The Board and the Audit Committee of the Board ("Audit Committee") are actively involved in oversight of our cybersecurity risk management. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on protecting our security and the information that we collect as well as proactively identifying and preventing cybersecurity threats.


text: Cybersecurity Risk Management and Strategy Our cybersecurity program is focused on protecting critical assets, including data, systems and applications; minimizing the impact of cyberattacks; understanding and preparing for the evolving threat landscape and complying with applicable law. The program includes the following key areas: • Governance: As discussed in more detail under the heading "Governance," the Board delegated oversight of cybersecurity risk management to the Audit Committee, which regularly interacts with our Chief Information Security Officer ("CISO"), other members of management and relevant management committees and councils, including the Information Security Governance team and the Cybersecurity Risk Management team. • Collaborative Approach: We have implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also continuously improving our cybersecurity program and maintaining a strong cybersecurity posture. Key to this approach is to broadly assess the potential impact of cybersecurity incidents on business operations and financial stability as well as any legal and regulatory requirements regarding cybersecurity. • Technical Safeguards: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion detection and prevention systems, encryption, access controls, secure coding practices and other security controls, which are regularly evaluated and improved through vulnerability assessments and penetration testing designed to identify weaknesses in our systems and networks. • Incident Response and Recovery Planning: We have a dedicated Incident Response Team dedicated to responding to and recovering from cybersecurity incidents. • Third-Party Risk Management: We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including our vendors who handle our data and systems through due diligence and vendor assessments. • Education and Awareness: We provide regular, training for all employees and contractors, which is designed to equip our personnel with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices.


text: We regularly identify and assess cybersecurity risks through a comprehensive program that includes: • Vulnerability assessments and penetration testing: We conduct regular vulnerability assessments and penetration testing to identify and address weaknesses in our systems and networks. • Threat intelligence: We subscribe to threat intelligence feeds and maintain relationships with security partners to stay informed about emerging cyber threats. • Third-party risk assessments: We engage various outside consultants, including contractors, assessors, auditors, outside attorneys and other third parties to assist us in identifying, assessing and managing cybersecurity risks. We conduct initial and regular due diligence on third-party vendors who handle our data and systems. • Business impact analysis: We regularly assess the potential impact of cyberattacks on our business operations and financial stability. • Legal and regulatory risk assessment: We assess the legal and regulatory risks associated with cybersecurity incidents and ensure compliance with applicable laws and regulations.


text: As discussed above, our cybersecurity governance structure is integrated into several facets of us, which include: • Board of Directors: The Board has ultimate oversight responsibility for cybersecurity. The Board has delegated to the Audit Committee the responsibility for monitoring and overseeing our cybersecurity and other information technology risks, controls, strategies and procedures. • Audit Committee: The Audit Committee is responsible for monitoring the effectiveness of our information system controls and security, including a periodic review of our cybersecurity and other information technology risks, controls, initiatives and action plans. • Chief Information Security Officer (CISO): Casey O'Malley is our CISO and is responsible for the day-to-day management of the cybersecurity program. Casey has had a distinguished career holding IT management positions since 2015 and has been employed in the cybersecurity field since 2001. Casey holds a Bachelor of Science in Information Technology from Penn State University. • Information Security Governance: The Information Security Governance team is comprised of our senior executives and oversees the development and implementation of the cybersecurity strategy. • Cybersecurity Risk Management Team: The Cybersecurity Risk Management Team is responsible for identifying, assessing, and mitigating cybersecurity risks. • Incident Response Team: The Incident Response Team is responsible for responding to and recovering from cyberattacks.


text: The management team reports to the Board on cyber risk quarterly. Reports include: • Overall cybersecurity posture: Current state of our security controls and identified vulnerabilities. • Incident reports: Summary of recent cyber incidents, including their nature, impact, and mitigation efforts. • Risk assessments: Updated assessments of potential cyber threats and their potential impact on us. • Security budget and resource allocation: Plans and investments for maintaining and enhancing our cybersecurity program.


text: The management team is required to update the Board immediately once a material breach occurs. The Board is provided timely updates until the incident is considered resolved.


text: Management evaluates cyber incidents based on their materiality, considering factors such as: • Financial impact: Potential losses in revenue, profits, or assets. • Reputational damage: Impact on our brand image and customer trust. • Regulatory compliance concerns: Potential violations of data privacy regulations or other legal requirements. • Operational disruption: Impact on business continuity and ability to deliver services.


text: Based on the materiality assessment, we determine the appropriate disclosure to regulatory agencies, stakeholders, and the public, ensuring transparency and minimizing potential harm.


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents have in the past affected our business. On December 15, 2020, we detected a ransomware incident (the "Ransomware Incident") impacting our operational and information technology systems, which caused service delays for our customers. We suffered unexpected costs and impacts from the Ransomware Incident and may in the future incur costs in connection with any future cybersecurity incidents, including infrastructure investments, remediation efforts and legal claims resulting from the above. It is reasonably likely to affect us, including our business strategy, results of operations or financial condition. For more information about our cybersecurity risks, see Item 1A, Risk Factors - "Our business is subject to cybersecurity risks."


text: Risk Management and Strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and clinical trial data ("Information Systems and Data").

companyName: Adverum Biotechnologies, Inc.

ticker: ADVM


text: Our information security function, which includes our Executive Director of Information Technology ("IT") and third-party service providers, helps identify, assess, and manage the Company's cybersecurity threats and risks. Our information security function identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example conducting audits, evaluating threats, and performing vulnerability assessments.


text: Depending on the environment, systems, and data at issue, we implement and maintain various technical, physical, and organizational measures, processes, and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident detection and response, access controls, employee training, penetration testing, and systems monitoring.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, our Executive Director of IT, works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example managed cybersecurity service providers, penetration testing firms, and cybersecurity consultants.


text: We use third-party service providers to perform a variety of functions throughout our business, such as contract research organizations, contract manufacturing organizations, and supply chain resources. We have a vendor management process to manage cybersecurity risks associated with our use of these providers. The process includes risk assessments for certain vendors and reviewing security assessments and reports. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the risk factor entitled: If our information technology systems or those third parties upon which we rely, or our data, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; material disruption of our product development programs; and other adverse consequences.


text: Our Board of Directors addresses the Company's cybersecurity risk management as part of its general oversight function. The Board of Directors is responsible for overseeing Company's cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Executive Director of IT, who holds a Bachelor of Science in Computer Methods from California State University-Long Beach and has previously served as the Associate Director of IT for a large pharmaceutical company.


text: Our management, including our Chief Operating Officer and Executive Director of IT, is responsible for hiring appropriate information security personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and helping prepare for cybersecurity incidents.


text: Our cybersecurity incident response processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our Executive Director of IT and General Counsel, who works with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response process includes reporting to the Audit Committee of the Board of Directors for certain cybersecurity incidents.


text: The Board of Directors receives periodic reports from the management concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The Board of Directors also has access to various reports, summaries or presentations related to cybersecurity threats, risk, and mitigation.


text: Risk Management and Strategy We regularly assess risks from cybersecurity threats, monitor our information systems for potential vulnerabilities and tests those systems pursuant to our cybersecurity policies, processes and practices. We also use security tools intended to protect our information systems from cybersecurity threats, and to help us identify, escalate, investigate, resolve and recover from security incidents in a timely manner.

companyName: Argo Group International Holdings, Inc.


text: In particular, our information security program and approach is based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST Framework"). The NIST Framework establishes core requirements related to information protection, processes and technologies. In addition, we maintain a Data Protection Framework and various policies, including Information Security Policy, Privacy Policy, and Records & Information Management Policy, to appropriately manage personal information necessary to operate our business and comply with applicable regulations. We also maintain a Third-Party Risk Management Program, including a Vendor Management Policy, which allows us to better oversee, monitor, identify and control certain risks related to the processing of personal information and customer information by our authorized third parties.


text: In accordance with these policies, we share personal information with affiliates, business partners, third-party service providers, or vendors only when we have a legitimate business purpose for doing so and it is permissible by law. We require third parties to maintain similar standards to ours to protect personal information. We have implemented a risk mitigation process to identify and assess the cyber posture of third parties providing commodities or services to our legal entities. We also have implemented multiple layers of data protection measures.


text: We have in the past, and may in the future, engage third parties to assess the effectiveness of our cybersecurity prevention and response systems and processes. As part of continuous improvement initiative, we strive to mature and build a robust and resilient environment to protect and defend against bad actors. We engage third parties to perform internal and external testing to improve security operations, disaster recovery, and incident response programs.


text: To date, we are not aware of risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, results of operations or financial condition. Refer to the risk factors under "Operational Risks" in Part I, Item 1A. "Risk Factors" for additional description of cybersecurity risks and potential related impacts on the Company.


text: Our Board oversees the Company's risk management process, including on cybersecurity risks, directly and through committees to which the Board has delegated authority. In connection with Brookfield Reinsurance's acquisition of the Company, the Company's Audit Committee was dissolved and all authority previously granted to the Company's Audit Committee was delegated to the Audit Committee of Brookfield Reinsurance. The Brookfield Reinsurance Audit Committee is responsible for overseeing our internal controls, including cybersecurity and data protection programs, and reviews the effectiveness of our financial reporting processes and internal controls, including data privacy, information technology security and control. Meetings of the Brookfield Reinsurance Audit Committee often include discussions of specific risk areas, including, among others, those relating to cybersecurity. The Brookfield Reinsurance Audit Committee also frequently discusses, in accordance with its duties and responsibilities as enumerated in its committee charter, the policies, guidelines and process by which management assesses and manages risks related to data protection and cybersecurity, including assessments of the overall threat landscape, steps management has taken to monitor or mitigate its risk exposure and related strategies and investments. Our Chief Security Officer regularly reports on data protection and information technology security matters to the Brookfield Reinsurance Audit Committee and to Argo senior management via Security Governance Council meetings.


text: As discussed above, our information security program and approach is based on the NIST Framework, and we have implemented cybersecurity policies, processes and practices designed to monitor and address cybersecurity threats and incidents. Our Chief Security Officer, in coordination with the Head of Risk, Chief Information Officer, Head of Operations, and General Counsel, is responsible for leading the assessment and management of cybersecurity risks. Our Chief Security Officer has extensive experience in information security, data protection and privacy, and regularly receives reports from our threat intelligence resources, in concert with enterprise risk, and legal departments, on cybersecurity threats and incidents.


text: In addition, plans have been authored to assist our security, legal, and finance functions in assessing and managing Argo's material risks from cybersecurity threats, and we conduct tabletop exercises and training sessions on a regular basis to help ensure effectiveness of said plans. Additionally, we also utilize outside resources to assist and participate in the determination of materiality of incidents stemming from cybersecurity threats.


text: Risk Management and Strategy We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as defined in Item 106(a) of Regulation S-K, and are integrating them into our overall risk management systems and processes by implementing and maintaining various technical, physical, and organizational safeguards, such as policies, standards, and practices relating to: • risk assessments; • incident detection and response; • vulnerability management; • internal controls within our IT, Security and other departments; • network security controls; • access controls; • physical security; • asset management; • system monitoring; • employee cybersecurity awareness and training; • phishing tests; • the use of the internet, social media, email and wireless devices; • firewalls and intrusion prevention systems; • endpoint detection and response systems; and • anti-malware functionality.

companyName: Bridger Aerospace Group Holdings, Inc.

ticker: BAER


text: As part of this process, we engaged external consultants who assessed our internal cybersecurity programs and alignment with applicable practices and standards, such as the Internal Control - Integrated Framework issued by the Committee of Sponsoring Organizations of the Treadway Commission framework. We have also retained external service providers to monitor identified risk exposures, provide ongoing recommendations and software tools for their detection and mitigation, as well as evaluating the impact and coordinating the recovery from any incidents or breaches, should they occur.


text: Our risk management program also assesses third-party risks, and we perform third-party risk management to identify and mitigate risks from third parties such as vendors, suppliers, and other business partners associated with our use of third-party service providers. Cybersecurity risks are evaluated when determining the selection and oversight of service providers when handling and/or processing our employee, business or customer data. Further, in February 2024, we formalized our policy of monitoring third-party cybersecurity risks by requiring its consideration and approval by the IT change control board as a part of vendor selection and solution procurement.


text: Our Audit Committee is responsible for the oversight of risks from cybersecurity threats. It receives updates on matters of cybersecurity from senior management during regular quarterly meetings and in the interim, if warranted. This includes existing and new cybersecurity risks, how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any) and key information security initiatives. Our Board members also engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.


text: Our cybersecurity risk management and strategy processes are coordinated by our Director of Technology. He maintains the Certified Information Systems Security Professional certification and has eight years of senior leadership experience in defensive cyber security in both the private sector and Department of Defense. He is supported by leaders from our Information Technology, Document Management, and Compliance teams, as well as management's Disclosure Committee who have extensive work experience in various roles involving information technology, including security, auditing, compliance, systems and programming. They draw on their knowledge of daily information technology operations, ongoing cybersecurity initiatives and various monitoring tools to ultimately report through the Director of Technology and Director of Internal Controls to the Audit Committee on the monitoring, prevention, mitigation, detection and remediation of cybersecurity incidents. In the event the Audit Committee determines that a cybersecurity incident has occurred, the Audit Committee will evaluate whether to escalate the cybersecurity incident to the full Board.


text: The processes described above have not indicated, as of the date of this Annual Report on Form 10-K, any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that we believe have materially affected us in the year ended December 31, 2023 or are reasonably likely to materially affect our company, including its business strategy, results of operations, or financial condition.. For more information on our cybersecurity risks, see the section of this Annual Report on Form 10-K entitled "Risk Factors—We rely on our IT systems to manage numerous aspects of our business. A cyber-based attack of these systems could disrupt our ability to deliver services to our customers and could lead to increased overhead costs, decreased sales, and harm to our reputation."


text: Risk Management and Strategy We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, operational risks; intellectual property theft; fraud; extortion; harm to associates or customers; violation of privacy or security laws; other litigation and legal risk; and reputational risks. These cybersecurity risks and other company risks are monitored and integrated into our enterprise risk management process. As part of this process, appropriate personnel will consult with subject matter specialists as necessary to gather insights for identifying and assessing material cybersecurity threat risks, their severity, and potential mitigations.

companyName: WILLIAMS SONOMA INC

ticker: WSM


text: Our cybersecurity risk management approach includes: (i) an enterprise risk management process, which includes cybersecurity risks and is periodically refreshed; (ii) system vulnerability scanning; (iii) cybersecurity training for employees; (iv) penetration testing, which simulates cyber threats; and (v) third-party risk management for suppliers, vendors, and other partners, which includes risk-based diligence and contractual provisions that allow for periodic auditing. We work to continually improve each of these processes with the goal of ensuring our cybersecurity strategy remains consistent with industry best practices.


text: Our incident response plan coordinates the activities we take to prepare for, detect, respond to, and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate, and remediate the incident. Further, we conduct periodic tabletop exercises to test our cyber incident response plan.


text: As part of our cybersecurity risk management strategy, we periodically engage with assessors, consultants, auditors, and other third-parties to evaluate and test our systems. We also engage an independent Qualified Security Assessor to review our Payment Card Industry, or PCI, compliance.


text: To date, risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the company, including our business strategy, results of operations, or financial condition. See "Risks Related to Technology" included as part of our risk factor disclosures in Item 1A of this Annual Report on Form 10-K, which are incorporated by reference herein.


text: In the last three fiscal years, we have not experienced any material cybersecurity incidents, and the expenses we have incurred from cybersecurity incidents were immaterial.


text: Cybersecurity is an important part of our risk management processes and an area of increasing focus for our Board of Directors and management. Our Audit and Finance Committee is responsible for the oversight of risks from cybersecurity threats. At least quarterly, the Audit and Finance Committee receives an overview covering current and emerging cybersecurity threat risks and the Company's ability to mitigate those risks, and discusses these topics with our Chief Information Security Officer and Chief Technology and Digital Officer. Cybersecurity risk management is also considered at least annually during separate Board meeting discussions with management.


text: Our cybersecurity risk management strategy process is led by our Chief Information Security Officer, and Chief Technology and Digital Officer, and leverages the expertise of our Chief Financial Officer, General Counsel, and Chief Accounting Officer. Our Chief Information Security Officer and Chief Technology and Digital Officer have extensive prior work experience in roles involving managing information security, developing cybersecurity strategy, and implementing effective information and cybersecurity programs as well as several relevant degrees and certifications, including Certified Information Security Manager, Certified Information Systems Auditor, Certified Information Systems Security Professional, Global Information Assurance Certification, and Certified Ethical Hacker.


text: Cybersecurity Risk Management and Strategy We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats. We invest in cybersecurity to protect intellectual property, customer data, manage reputational risk, and maintain business continuity across our devices, applications, and corporate networks. We strive to ensure ongoing compliance with the requirements under relevant standards including the Payment Card Industry Data Security Standards and relevant data privacy and protection laws and regulations. Additionally, our teams reference the standards, guidelines, and practices from the NIST Cybersecurity Framework (CSF) to align our cybersecurity program and risk management practices.

companyName: Grove Collaborative Holdings, Inc.

ticker: GROV


text: The foundation of our cybersecurity framework is based on written policies that govern different cybersecurity process areas. Risks are identified through various processes that employees perform through their daily operations and are mitigated, managed and/or governed through these established processes.


text: Identifying and assessing cybersecurity risk is part of our overall risk management systems and processes. Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through a combination of third party assessments, IT security, governance, risk and compliance reviews, external audits and assessments, penetration tests, vulnerability scans, and recurring review from our internal cybersecurity working group. We respond to cybersecurity incidents and address identified cybersecurity risks through our internal cybersecurity working group and report any material findings and incidents to the audit committee of our board of directors.


text: The cybersecurity incident response process is governed by our incident response plan and overseen by leaders from our IT security and legal teams.


text: We also conduct tabletop exercises annually, to simulate responses to cybersecurity incidents and ensure accuracy and continuous improvement of the incident response plan. Our team of cybersecurity professionals then collaborate with other stakeholders across our organization to further analyze the risk to the Company and form detection, mitigation and remediation strategies.


text: We are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. However, we cannot provide assurance that we will not be materially affected in the future by such risks or any future material incidents.


text: Leveraging our cybersecurity risk management processes, cybersecurity risk factors were identified, which are inherent to our business and industry. The risk factors discussed in this section should be considered together with information included elsewhere in this Annual Report on Form 10-K and should not be considered the only risks to which we are exposed. Additionally, mitigation of these risk factors is tracked by management as part of our cybersecurity maturity roadmap.


text: • Disruptions in the Company's supply chain could result in an adverse impact on results of operations. • Network compromise or equipment sabotage could impact the operations of the fulfillment center sites which could impact the revenue. • Cybersecurity incidents, including breaches of confidential information, sensitive data, personal information, or intellectual property could damage the company's reputation, disrupt operations, increase costs, and impact revenues.


text: As part of the above processes, we regularly engage external auditors and consultants to assess our internal cybersecurity programs and compliance with applicable regulatory requirements and industry standards.


text: Our cybersecurity risk management program evaluates the risk associated when selecting third-party service providers. In addition to new vendor onboarding, critical vendors are reviewed annually to ensure understanding of their cybersecurity posture, and their responsibility in protecting our asset appropriately.


text: As of the date of this filing, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For additional information, see Part I, Item 1A, Risk Factors-Risks Related to Our Business.


text: Cybersecurity Governance Cybersecurity is an area of focus for our board of directors, audit committee, and management. As part of our board of directors' overall responsibility for oversight of management's general risk identification and management activities, our the audit committee of our board of directors is responsible for the oversight of risks from cybersecurity threats. Members of the audit committee review and discuss with management and our auditors quarterly the Company's cybersecurity risks and the steps that management has taken to protect against threats to the Company's information systems and security and review risk and mitigation steps taken by management related to data privacy.


text: Our cybersecurity risk management and strategy processes are overseen by leaders from our IT Security, external advisors, and legal teams. These individuals are informed about, and monitor the identification, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above.


text: Risk management and strategy We recognize the importance of developing, implementing, and maintaining robust cybersecurity measures to help safeguard our information systems and protect the confidentiality, integrity, and availability of those systems and our data maintained on them.

companyName: HashiCorp, Inc.


text: Managing Material Risks & Integrated Overall Risk Management We maintain risk management activities to identify, assess, prioritize, and address cybersecurity risks and we incorporate them into our overall risk management processes. Our Security team is responsible for performing cybersecurity risk assessments over various systems and processes on an ongoing basis. The results from risk assessment activities are reviewed to prioritize the mitigation of identified risks, and the need for risk mitigation may influence business or operational strategy, project roadmaps and timelines, or other decision-making, as needed.


text: Our Security Risk Committee is comprised of senior leaders across the company, and our Chief Security Officer briefs this committee on emerging risk topics and the company's top security risks on a quarterly basis. The Chief Security Officer also participates in our Risk Management Committee and presents on security risks as part of that group's discussion of enterprise risk.


text: Engagement of Third-parties on Risk Management We engage cybersecurity assessors, and other service providers, as needed, in evaluating and testing our risk management systems. These engagements help us to leverage specialized knowledge and insights to better align our cybersecurity strategies and processes with applicable industry standards. Our collaboration with these third parties includes regular control assessments, threat and vulnerability assessments, and consultation on security enhancements.


text: Oversee Third-party Risk We maintain standard processes to oversee and manage risks associated with use of third-party service providers. We conduct security assessments of third-party service providers with access to our information systems or sensitive data before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. Such practices include recurring assessments of critical third-party service providers' cybersecurity programs and ongoing monitoring, detection, and response capabilities used by our security engineers. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third-party service providers. In addition, our Legal team reviews the associated vendor contracts to ensure they include appropriate terms, including applicable security provisions.


text: Risks from Cybersecurity Threats We have not encountered risks from cybersecurity incidents or challenges that have materially impaired our business strategy, results of operations, or financial condition. Such risks may evolve in the future to have material impact, and our cybersecurity risk management processes, including those described here, may not always operate as designed or be effective. For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K, including the risk factor entitled "Risks Related to Our Business and Operations: Problems with our internal systems, networks, or data, including actual or perceived breaches or failures by us or our partners, could cause our products to be perceived as insecure, underperforming, or unreliable, which would damage our reputation, and our financial results."


text: Given the potential significance of cybersecurity threats to our operational integrity and stakeholder confidence, our Board of Directors has established oversight mechanisms to promote effective governance in managing such risks.


text: Board of Directors Oversight and Management's Role Managing Risk The Audit Committee is central to the Board's oversight of cybersecurity risks and bears the primary responsibility for this domain. The CSO is responsible for informing the Audit Committee on cybersecurity risks and presents to the committee at least semi-annually. Additional discussions with the Audit Committee or the full Board of Directors may occur on an as-needed basis. These briefings encompass various topics, including: Current cybersecurity landscape and emerging threats; Status of ongoing cybersecurity initiatives and strategies; Incident reports and learnings from any cybersecurity events; and Compliance with regulatory requirements and industry standards.


text: The Audit Committee reviews and advises on Management's strategic decisions related to cybersecurity, offering guidance and approval for major initiatives when deemed appropriate.


text: Risk Management Personnel Cybersecurity risk management practices are ultimately led by our CSO, who has tenured experience in the cybersecurity field and is recognized within the industry. The CSO is supported by personnel across the Security organization in assessing, monitoring, and managing cybersecurity risks. Security personnel have relevant experience and credentials to perform their associated risk management responsibilities, and with the help of these individuals and teams, the CSO oversees governance programs, confirms compliance with relevant security requirements, manages known risks, and educates the company on cybersecurity.


text: Monitor Cybersecurity Incidents The CSO implements and oversees processes for the regular monitoring of our information systems, primarily through Security's Threat Detection & Response (TDR) team. This includes the deployment of technical security monitoring and alerting measures to identify potential incidents. In the event of a cybersecurity incident, the Security organization and relevant teams throughout the company follow a formalized, documented incident response plan. This plan includes immediate actions to assess and mitigate the impact of an incident, as well as subsequent actions to remediate and help prevent future incidents of a similar nature.


text: Risk Management and Strategy We have established a cybersecurity program, which includes maintaining policies and processes for assessing, identifying, and managing risks from cybersecurity threats, and have integrated these policies and processes into our overall risk management strategy. Our cybersecurity program is informed by standards established by the National Institute of Standards and Technology (NIST) and the Center for Internet Security (CIS).

companyName: Absci Corp

ticker: ABSI


text: We maintain processes for conducting internal and external cybersecurity risk assessments to identify cybersecurity threats that may adversely impact the confidentiality, integrity, or availability of our information systems or data residing therein. We generally conduct internal cybersecurity risk assessments and audits on at least a quarterly basis, which may include penetration testing and vulnerability assessments. We also regularly conduct cybersecurity simulation exercises, including in connection with our disaster recovery procedures. Additionally, we engage third-party service providers to support these efforts, including to conduct security testing on an annual basis.


text: We also engage assessors, consultants, auditors, or other third parties in connection with our risk assessment processes to assist us in our design and implementation of our cybersecurity policies and procedures and in our assessment and testing of our security safeguards. This includes a third-party managed detection and response team (MDR) to conduct ongoing network monitoring and to support incident management and threat assessment. Additionally, as a public company, we are subject to regulatory requirements and undergo audits of our financial statements, which include a review of related cybersecurity controls and information technology systems.


text: We maintain a cybersecurity awareness training program for employees, which is provided during onboarding and on an annual basis thereafter. Our training program includes simulated phishing campaigns, which are designed to increase awareness and detection and to equip our personnel with effective tools to identify and address cybersecurity threats.


text: Although risks from cybersecurity threats have not materially affected, and are not reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, to date, we have, from time to time, experienced threats to and security incidents related to our and our third-party vendors' information systems. For more information about the cybersecurity risks we face, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K, including the risk factors entitled "Security breaches, loss of data and other disruptions could compromise sensitive information related to our business or prevent us from accessing critical information and expose us to liability, which could adversely affect our business and our reputation."


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors administers its cybersecurity risk oversight function directly as a whole, as well as through our audit committee.


text: Our Director of Information Technology is responsible for monitoring and assessing the the day-to-day management of cybersecurity risks. The individual who currently holds the position of Director of Information Technology has approximately fifteen years of IT management and cybersecurity experience. Our IT Committee, which is comprised of senior leadership team members across our Information Technology, Finance, Law and Innovation departments, is responsible for overseeing our cybersecurity policies and processes. Our IT Committee meets regularly with our Director of Information Technology to evaluate cybersecurity threats. We maintain an established process to notify the IT committee of identified cyber incidents and to provide an assessment of the potential criticality and impact of such incidents. We have also implemented procedures for response and containment efforts to address the actual or potential impact of identified cybersecurity incidents, as applicable.


text: Representatives from our IT Committee provide briefings regarding cyber matters to our audit committee on a quarterly basis, and directly to the full board of directors on an annual basis. Such briefings may include a discussion of cyber risks and applicable risk assessments, key updates regarding our cyber strategy and related initiatives, and the emerging cybersecurity threats that may impact our business.


text: Our legal department, a management committee (composed of our Senior Vice President and General Counsel, our Chief Financial Officer, and our Vice President, Finance and Controller) and a third-party service provider (collectively, the "Cybersecurity Risk Management Team") help identify, assess and manage the Company's cybersecurity threats and risks. Our Cybersecurity Risk Management Team identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example, manual tools, automated tools, conducting scans of the threat environment, evaluating our and our industry's risk profile, evaluating threats reported to us, conducting internal audits, conducting third party threat assessments, and conducting vulnerability assessments to identify vulnerabilities.

companyName: Regulus Therapeutics Inc.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example, a cybersecurity incident response plan, incident detection and response, a disaster recovery and business continuity plan, risk assessments, implementation of security standards, encryption of data, network security controls, data segregation, access controls, physical security, asset management, tracking and disposal, systems monitoring, employee training, penetration testing, cybersecurity insurance, and systems monitoring.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, (1) cybersecurity risk is addressed as a component of the Company's enterprise risk management program; (2) the Cybersecurity Risk Management Team works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business; (3) our Senior Vice President and General Counsel, our Chief Financial Officer and our Vice President, Finance and Controller evaluate material risks from cybersecurity threats against our overall business objectives and reports to the audit committee of the board of directors, which evaluates our overall enterprise risk.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example professional services firms, including legal counsel and cybersecurity consultants.


text: We use third-party service providers to perform a variety of functions throughout our business, such as hosting companies, contract research organizations, contract manufacturing organizations and supply chain resources. We have a vendor management program to manage cybersecurity risks associated with our use of these providers. The program includes risk assessment for each vendor, system and organization controls reporting, and audits. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider, as well as contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "Cybersecurity risks and the failure to maintain the security, confidentiality, integrity, and availability of our information technology systems or data, and those maintained on our behalf, could result in material adverse impact to our business, including without limitation regulatory investigations or actions, a material interruption to our operations, including clinical trials, damage to our reputation and/or subject us to costs, fines and penalties or lawsuits."


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Senior Vice President and General Counsel, Chief Financial Officer, Vice President, Finance and Controller. Our Senior Vice President and General Counsel has expertise as a Life Sciences executive, has had a key role in information technology and cybersecurity oversight for several years and has completed several cybersecurity trainings. Our Chief Financial Officer has several years of expertise performing audits as a public accountant, including audits over information technology controls, and has also completed several cybersecurity trainings. Our Vice President, Finance and Controller has expertise playing a key role with information technology general controls and control testing for the Company for many years, and has several years of expertise leading and performing audits as a public accountant, including audits over information technology controls. He has also completed several cybersecurity trainings.


text: These positions are responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. They are also responsible for preparing and approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the Senior Vice President and General Counsel, Chief Financial Officer and Chief Executive Officer. The Cybersecurity Risk Management Team and others work with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response processes include reporting to the audit committee of the board of directors for certain cybersecurity incidents.


text: The audit committee receives periodic reports from the Senior Vice President and General Counsel, Chief Financial Officer, Vice President, Finance and Controller concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The audit committee also receives and has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: Risk Management and Strategy Cibus has processes designed to protect its information systems, data, assets, infrastructure, and computing environments from cybersecurity threats and risks while maintaining confidentiality, integrity, and availability practices. The Company's cybersecurity team has dedicated personnel whose responsibilities include preventing and monitoring cybersecurity threats. The team has a cybersecurity incident response plan, which is a dynamic and flexible basic framework that includes processes designed to address interdiction and remediation, conducting initial investigations, gathering and analyzing data, reporting incidents to management, mitigating damage to the Company's informational assets and infrastructure, restoring normal services and system integrity, and implementing actions designed to prevent future cybersecurity incidents.

companyName: Cibus, Inc.

ticker: CBUS


text: Cibus has established procedures to identify, assess, and manage risks across the business, including risks related to cybersecurity. The Company's cybersecurity strategy includes risk management methodologies and analytics, which are designed to facilitate cyber resilience, minimize attack surfaces, and provide flexibility and scalability in its ability to address cybersecurity risks and threats. Organizational risk assessments help management to assess threats and identify and investigate potential vulnerabilities to make risk management decisions and assign resources to mitigate risk. The Company's cybersecurity risk management strategy is incorporated into its business continuity plans, which include plans designed to address disaster recovery at its data centers and its holistic risk assessment procedures. Further, Cibus has a security awareness platform that provides its employees training on a variety of topics.


text: Cibus engages external resources that contribute to and provide evaluation of, its existing cybersecurity practices and organizational risk assessment systems. Further, Cibus has processes designed to identify, assess, and manage third party service provider risks when third parties handle, possess, process, and store the Company's material information.


text: As of the date of this Annual Report, Cibus does not believe that any past cybersecurity incidents have had, or are reasonably likely to have had, a material adverse effect on the Company's business, operations, or financial condition. However, there can be no assurance that the Company's cybersecurity processes will prevent or mitigate cybersecurity incidents or threats, and it is possible that these events may occur and could have a material adverse effect on the Company's business, operations, or financial condition. See "Risk Factors—Risks Related to Cibus' Organization and Operations—Cibus' internal computer systems, or those of its third party contractors or consultants, may fail or suffer security breaches, which could result in a material disruption of Cibus' operations." under the heading "Risk Factors" of this Form 10-K.


text: The Company's cybersecurity team is headed by its Director of Information Technology & Information Security, who works with the Company's cybersecurity team to identify cybersecurity risks and who has been in the information technology and cybersecurity industry for over 25 years and holds numerous technical certifications and cybersecurity-related certificates. The team members report via its established cybersecurity triage and outage workflow to the Cibus Cyber Security Council, which consists of the Company's CEO, President and COO, EVP and CSO, and members of the Company's legal and human resources teams. The Company's Cyber Security Council meets regularly to discuss the status of the cybersecurity program, emerging cybersecurity threats, long-term cybersecurity investments and strategies, and oversight of the Company's cybersecurity program. The Company's Cyber Security Council is also responsible for identifying, assessing, and managing the Company's exposure to material risks from cybersecurity threats, including monitoring the prevention, detection, mitigation, and remediation of cybersecurity threats.


text: The Company's full Board of Directors oversees enterprise risks and has delegated oversight to the Audit Committee of the Cibus Board of the Company's data privacy and cybersecurity risks and provides input on the Company's cyber and information security strategy. The Council reports the status of the Company's cybersecurity program to the Audit Committee and, periodically, to the Board. The Board and Audit Committee regularly review these reports and discuss policies with respect to cybersecurity and information technology risks, including how these risks are being identified, assessed, and managed.


text: Cybersecurity Risk Management and Strategy Our management recognizes the impact that cybersecurity threats could have on our business operations, our compliance with regulations, and our reputation. We have identified cybersecurity as a critical business risk as part of our overall risk management strategy, which our board of directors oversees.

companyName: X4 Pharmaceuticals, Inc

ticker: XFOR


text: We have implemented a cybersecurity program in accordance with our risk profile and business that includes, among other things, written policies, monitoring and filtering procedures, and employee training. We have also developed an incident response policy and procedure designed to facilitate the timely reporting and assessment of cybersecurity incidents.


text: Our cybersecurity risk management program, which is part of our enterprise risk management program, aims to identify risks related to the Company, including risks from cybersecurity threats. Our cybersecurity risk management program includes a number of components, including informal self-assessments and audits, penetration testing, and vulnerability assessments, that are conducted periodically by both internal and external resources. The Company also analyzes current and emerging cyber threats that pose a risk to the organization using various threat intelligence tools and services.


text: As part of our cybersecurity risk management program, we take a risk-based approach to the evaluation of third-party vendors, and apply mitigations and processes based on our evaluation of the sensitivity of the data accessed by the vendor and the maturity of the vendor's programs. Our vendor evaluation procedures include, as appropriate, the review of vendors' SOC 2 Type 2 reports if available, and a vendor security questionnaire. We are in the process of expanding the use of the security questionnaire to additional vendors.


text: Governance Related to Cybersecurity Risks Our director of information technology ("Director of IT") is responsible for the strategic leadership and direction of the Company's information technology organization. The Director of IT has helped organizations define and implement information technology strategies for over twenty years. Prior to joining the Company, he served in senior information technology roles for several biotechnology companies. Along with members of our finance, legal, and operations teams, the Director of IT sits on a newly-formed cyber subcommittee ("subcommittee"). The subcommittee reports to the Chief Operating Officer ("COO") and Chief Financial Officer ("CFO"), and outputs from the Committee are provided by the COO and CFO to the Company's executive team and the board.


text: The board is responsible for informed oversight of our risk management process. The board administers this oversight function through various board standing committees that address risks inherent in their respective areas of oversight. The board has delegated oversight for cybersecurity risk management to the Audit Committee. The Audit Committee reviews the Company's policies and procedures with respect to cybersecurity risk management.


text: Although risks from cybersecurity threats have to date not materially affected us, our business strategy, results of operations or financial condition, we have, from time to time, experienced threats to and breaches of our and our third-party vendors' data and systems. For more information, see Item 1A. Risk Factors. The pharmaceutical industry is highly competitive and is subject to rapid and significant technological change, which could render our technologies and products obsolete or uncompetitive.


text: Cybersecurity Risk Management and Strategy The Company has implemented a cybersecurity risk management program that is designed to identify, respond to, protect against and manage cybersecurity threats and incidents. Our cybersecurity risk management processes include regular assessments of our cyber threat detection and response capabilities.

companyName: AlTi Global, Inc.

ticker: ALTI


text: We have established cybersecurity risk assessment processes, which include annual risk assessments using third-party consultants. Our Chief Information Security Officer ("CISO") has oversight over our information security policies and works with our internal IT resources and third-party managed IT support providers to facilitate the implementation of our cybersecurity risk assessment and management processes. Our cybersecurity risk management processes are designed to protect systems and data and contain preventive and detective controls, including internal and external testing. We also provide cybersecurity awareness training to our employees during onboarding and periodically thereafter, including through simulated phishing attacks.


text: We maintain processes designed to evaluate the security practices and controls of our critical third-party vendors that have access to our confidential information, which includes security questionnaires and third-party information security assessments, as applicable.


text: We maintain policies regarding our information security practices, including an incident response plan to coordinate response and mitigation efforts in the event we experience a cybersecurity incident. These policies require notification of cybersecurity incidents to our information security team, and if warranted based on the perceived level of severity of the incident, to members of our executive leadership. We have not identified any cybersecurity incidents or threats that have materially affected us, including our business strategy, results of operations, or financial condition. However, like other companies in our industry, we and our third-party vendors have from time to time experienced threats and security incidents that could affect our information or systems. For more information, please consult "ITEM 1A. RISK FACTORS".


text: Cybersecurity Governance Related to Cybersecurity Risks Our Board considers cybersecurity risk as part of its overall risk oversight, and has delegated to the Audit, Finance and Risk Committee ("AFRC") responsibility for oversight of major risk exposures, including in relation to security, cybersecurity and privacy. At the management level, we have also established an Executive Risk and Compliance Committee ("ERCC"), which oversees the development and implementation of our risk oversight and management processes, including in relation to cybersecurity. The ERCC is comprised of members of our executive leadership from across the organization. Our CISO reports to the ERCC on identified material cyber risks (if any) and on the implementation of cybersecurity priorities. The members of the ERCC, in turn, are responsible for updating the AFRC, and, where required, our Board on key milestones and progress regarding identified material cyber threats.


text: Our CISO is responsible for advising on the strategic and operational processes related to our cyber risk management program. Our CISO has over two decades of cybersecurity experience, has served on a cybersecurity advisory board for a university, and is a Certified Information Systems Security Professional.


text: Cybersecurity Program Overview As an externally managed company, our day-to-day operations are managed by our Advisor and our executive officers under the oversight of our board of directors. Our executive officers are senior Nuveen Real Estate professionals and our Advisor is a subsidiary of TIAA. As such, we are reliant on TIAA for assessing, identifying and managing material risks to our business from cybersecurity threats. Below are details TIAA has provided to us regarding its cybersecurity program that are relevant to us.

companyName: Nuveen Global Cities REIT, Inc.