text: Our management team takes steps to stay informed about and monitors efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our IT environment. Our Company has also established a data security team, comprised of cross-functional team members to address cybersecurity threats and incidents and engage third-party consultants as needed to address these risks.


text: Risk management and strategy We regularly assess risks from cybersecurity threats, monitor our information systems for potential vulnerabilities; and test those systems pursuant to our cybersecurity policies, processes and practices, which are integrated into our overall risk management program. To protect our information systems from cybersecurity threats, we use various security tools that are designed to help identify, escalate, investigate, resolve and recover from security incidents in a timely manner. Our Board of Directors assesses risks based on probability and potential impact to key business systems and processes as part of our overall risk management program overseen by the by the Risk Management Committee of the Board of Directors. Our Data Breach Response Team performs annual cybersecurity tabletop incident response exercises, pursuant to our Data Breach Response Policy and Plan. Risks that are considered high are incorporated into our overall risk management program. We collaborate with third parties to assess the effectiveness of our cybersecurity prevention and response systems and processes. These include cybersecurity assessors, consultants and other external cybersecurity experts to assist in the identification, verification and validation of cybersecurity risks, as well as to support associated mitigation plans when necessary. We have also developed a third-party cybersecurity risk management process to conduct due diligence on external entities, including those that perform cybersecurity services. Cybersecurity threats, including those resulting from any previous cybersecurity incidents, have not materially affected our Company, including our business strategy, results of operations or financial condition. See our risk factor "Cyber security risks and the failure to maintain the integrity of company, employee or guest data could expose us to data loss, litigation and liability, and our reputation could be significantly harmed" in Part I, Item 1A. "Risk Factors" for additional details regarding cybersecurity risks and potential impacts on our business.

companyName: NATURES SUNSHINE PRODUCTS INC

ticker: NATR

secItem: Item 1C


text: Our Board of Directors oversees our risk management process, including as it pertains to cybersecurity risks, which focuses on the most significant risks we face in the short-, intermediate- and long-term timeframe. Our Executive Director of Information and Technology Services ("IT Director"), who reports to our Chief Financial Officer, is responsible for the operational oversight of company-wide cybersecurity strategy, policy and standards across relevant departments to assess and help prepare us to address cybersecurity risks. Our IT Director has multiple university certifications in advanced cybersecurity with over 30 years' experience in cybersecurity and technology roles, most of which have been held with the Company. Meetings of our Risk Management Committee and Board of Directors include discussions and presentations by management regarding specific risk areas throughout the year, including, among others, those relating to cybersecurity threats and reports from management on our enterprise risk profile on an annual basis. The Board of Directors reviews our cybersecurity risk profile with management on a periodic basis using key performance and/or risk indicators. These key performance indicators are metrics and measurements designed to assess the effectiveness of our cybersecurity program in the prevention, detection, mitigation and remediation of cybersecurity incidents. We take a risk-based approach to cybersecurity and have implemented cybersecurity policies throughout our operations that are designed to address cybersecurity threats and incidents.


text: The following is a brief list of some of the cybersecurity risk management tools we employ to identify, assess and manage threat risks: –Third party system and network scanning tools that identify or automatically block potential cybersecurity threats; –Routine review and update of system access; –Multi-factor authentication; –Live 24-hour monitoring of corporate and field operations IT networks for cybersecurity threats; –Mandatory annual employee cybersecurity awareness training program that includes phishing simulations and other microlearning courses; –Monthly IT and cybersecurity meetings with management and IT professionals; –Completion of annual IT network cybersecurity assessment and vulnerability scan;

companyName: SANDRIDGE ENERGY INC

ticker: SD


text: Primary responsibility for assessing and integrating within enterprise risk management of our cybersecurity risks rests with our Director of Internal Audit, who oversees our governance programs, tests our compliance with standards, remediates known risks, and coordinates our employee training program. The Director of Internal Audit is a Certified Fraud Examiner with over 20 years of planning and managing information technology audits, including information technology general controls for SOX, and cybersecurity breach protocols, policies and assessments.


text: We recognize the critical importance of cybersecurity in safeguarding sensitive information, maintaining operational integrity, and ensuring the safety and efficacy of our medical devices. Our cybersecurity risk management program, which is based on recognized cybersecurity frameworks established by the National Institute of Standards and Technology ("NIST") and led by our Chief Information Officer (CIO), is fully integrated into our overall enterprise risk management program, and shares common reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, operational and financial risk areas. We are dedicated to maintaining the highest standards of cybersecurity to protect our customers and stakeholders. We will continue to adapt to evolving threats and regulations to ensure the safety and security of our products and information.

companyName: InfuSystem Holdings, Inc

ticker: INFU


text: Please see the Item 1A. Risk Factor above entitled "Cybersecurity risks and cyber incidents could adversely affect our business and disrupt operations" for more information regarding cybersecurity incident risks associated with InfuSystem.


text: Cybersecurity Risk Management • Risk Assessment: We regularly conduct comprehensive cybersecurity risk assessments, identifying potential vulnerabilities and threats that could impact the confidentiality, integrity, and availability of our medical devices and associated data. • Policies and Procedures: InfuSystem has established and maintains cybersecurity policies and procedures that align with industry best practices and regulatory requirements. These policies address areas such as data protection, access control, incident response, and vulnerability management. • Training and Awareness: We provide ongoing cybersecurity training and awareness programs to our employees and contractors, emphasizing the importance of their role in safeguarding sensitive information and reporting security incidents. • Use of Third-Parties: InfuSystem works with a third-party Cybersecurity risk partner whose systems ingest information regarding the current state of the Company's information and technology environment and using specialized algorithms provide assessments of the company's Cybersecurity risk exposure as well as providing targeted advice to mitigate any risks identified. • Third-Party Risk Management: InfuSystem evaluates the cybersecurity practices of third-party vendors and suppliers, ensuring that they meet our cybersecurity standards and pose no undue risk to our medical devices and data. • Incident Response Plan: We maintain a robust incident response plan that outlines the steps to be taken in the event of a cybersecurity incident. This plan includes procedures for reporting incidents, containing threats, and notifying affected parties as required by law.


text: Cybersecurity Governance InfuSystem maintains a dedicated cybersecurity governance framework. While senior management is primarily responsible for assessing and managing the Company's exposure to risk, our Board of Directors oversees our ERM, including cybersecurity risk management, and ultimately approves ERM policies and procedures. Our Board conducts much of its risk oversight activities, including cybersecurity risk oversight, through our Audit Committee. Given the ever-increasing volume of cyber threats and the magnitude of a potential breach, cybersecurity is a standing topic for the Board of Directors and Audit Committee.


text: As noted above, our CIO leads our cybersecurity risk management program. Our CIO has over a decade of executive-level experience managing information systems and cybersecurity programs in the healthcare industry. The CIO serves as an Executive Officer who reports directly to senior management and, at least quarterly, makes reports to the Audit Committee. Senior management reports to the full Board of Directors with respect to cybersecurity matters on at least a quarterly basis.


text: As of the date of this report, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to affect the Company, including our business strategy, results of operations or financial conditions.


text: We do not believe that any risks from cybersecurity threats, nor any previous cybersecurity incidents, have materially affected us. However, the sophistication of cyber threats continues to increase, and the preventative actions that we have taken and continue to take to reduce the risk of cyber incidents and protect its systems and information may not successfully protect against all cyber incidents. For more information on how cybersecurity risk may materially affect our business strategy, results of operations, or financial condition, please refer to Item 1A Risk Factors.

companyName: Bowman Consulting Group Ltd.

ticker: BWMN


text: Our CIO, who reports directly to the CEO, has significant professional experience including senior technical leadership roles at public companies and m aintains the certified information systems security professional (CISSP) certification. Under the direction of the CIO, our information technology department continuously analyzes cybersecurity and resiliency risks to our business, considers industry trends and implements controls, as appropriate, to mitigate these risks and conducts regular enterprise-wide training on cybersecurity threats for all employees. This analysis drives our long- and short-term cybersecurity strategies, which are executed through a collaborative effort within the department and are communicated to the board of directors regularly.


text: We evaluate the risks associated with technology and cybersecurity threats and monitor our information systems for potential weaknesses. We review and test our information technology system on an as-needed basis (and at least on an annual basis) and utilize internal team personnel to evaluate and assess the efficacy of our information technology system and enhance our controls and procedures. The results of these assessments are reported to our Audit Committee and, from time to time, our Board of Directors.

companyName: Beauty Health Co

ticker: SKIN


text: Our management team is responsible for assessing and managing our material risks from cybersecurity threats. The team (and team personnel who support our information security program) has primary responsibility for our overall cybersecurity program and supervises both our internal cybersecurity personnel and our retained external cybersecurity third party vendors and consultants. In addition, our team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal personnel, threat intelligence and other information obtained from governmental, public or private sources, including external vendors and consultants engaged by us, and alerts and reports produced by security tools deployed in the IT environment. The team is led by our Vice President of Technology, who also currently serves as our Chief Information and Security Officer, and has over 25 years of industry experience leading IT for organizations of similar sizes. Team personnel who support our information security program have relevant educational and industry experience, including holding similar positions at previous large companies and government entities.


text: Cybersecurity Risk Management and Strategy We have certain processes for assessing, identifying, and managing material risks from cybersecurity threats, which are integrated into our enterprise risk management processes. Specifically, we have processes for: • Identifying and Managing Cybersecurity Risks — We have implemented a cross-functional approach to assessing, identifying and managing material cybersecurity threats and incidents. We periodically review, assess, update and test our policies, standards, processes and practices in a manner intended to address cybersecurity threats and events. The results of such reviews, assessments and tests are evaluated by management and reported to our Audit Committee of the Board of Directors, or the Audit Committee, and our Board of Directors. • Technical Safeguards — We have integrated cybersecurity into our overall information technology operations and designed our processes and systems to help protect our information assets and operations from internal and external cyber threats, protect employee and patient information from unauthorized access or attack as well as secure our networks and systems. • Incident Response and Recovery Planning — To better facilitate our cybersecurity program, our cybersecurity team works collaboratively across our Company to implement programs designed to protect our information systems from cybersecurity threats and to promptly respond to any material cybersecurity incidents. We conduct periodic tabletop exercises, including incident simulations to test these plans and ensure personnel are familiar with their roles and responsibilities in a response scenario. • Third-Party Risk Management — We maintain a risk-based approach to identifying and overseeing material cybersecurity threats presented by third parties and the systems of third parties that could adversely impact our business in the event of a material cybersecurity incident affecting those third-party systems. Also, we engage certain external cybersecurity firms to enhance our cybersecurity oversight and cybersecurity breach detection over third party service providers. • Education and Awareness — We provide training regarding cybersecurity threats as a means to equip our employees and consultants with tools to make employees and consultants aware of and to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices. We also use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs.

companyName: Akebia Therapeutics, Inc.

ticker: AKBA


text: We adjust our cybersecurity policies, standards, processes, and practices as necessary based on the information provided by our assessments, audits and reviews. Such processes include (i) procedural and technical safeguards, (ii) response plans, (iii) periodic tests on our systems, (iv) incident simulations and (v) routine review of our cybersecurity policies and procedures to identify risks and improve our practices. We engage certain external cybersecurity firms to enhance our cybersecurity oversight. We include confidentiality provisions in all contracts with third-party service providers, and data protection provisions in certain contracts with third-party service providers where applicable, to help protect us and our employees and patients from any related vulnerabilities.


text: Our Board of Directors is responsible for exercising oversight of management's identification and management of, and planning for, risks from cybersecurity threats. While the full Board of Directors has overall responsibility for risk oversight, the Board of Directors has delegated oversight responsibility related to risks from cybersecurity threats to the Audit Committee of our Board of Directors. The Audit Committee reports to the Board of Directors at least annually, and notifies the Board of Directors as necessary regarding significant new cybersecurity threats or incidents. The Audit Committee meets annually to discuss our approach to overseeing cybersecurity threats with management, including with members of our internal cybersecurity team.


text: We use an internal management team to run our information technology and cybersecurity functions, which includes our information and cybersecurity team leads who have collectively served in various roles in information technology and information security for over 25 years, including at other public companies. Through ongoing communications with this management committee, senior management is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real-time and reports such threats and incidents to the Audit Committee, when appropriate. Management updates the Audit Committee quarterly regarding our cybersecurity threat risk management and strategy programs. Members of the Audit Committee are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related topics and discuss any updates to our cybersecurity risk management and strategy programs. The Audit Committee is notified between such updates regarding significant new cybersecurity threats or incidents that meet pre-established reporting thresholds and any ongoing updates regarding any risk, as needed.


text: Board Oversight of Cybersecurity Risks The audit committee of the Board of Trustees of the Company, or the Audit Committee, provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Audit Committee receives periodic updates from the FS Investments CISO and the Company's Chief Compliance Officer, or the CCO, regarding the overall state of the FS Investments cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.

companyName: KKR FS Income Trust


text: Management's Role in Cybersecurity Risk Management The Company's management, including the Company's CCO, is responsible for assessing and managing material risks from cybersecurity threats. The CCO oversees the Company's risk management function generally and relies on the FS Investments CISO to assist with assessing and managing material risks from cybersecurity threats. The CISO has over fifteen years of experience in activity managing cybersecurity and information security programs for financial services companies with complex information systems. The CCO has been responsible for this oversight function as CCO to the Company since its inception in 2022 and has worked in the financial services industry for over 40 years, during which the CCO has gained expertise in assessing and managing risk applicable to the Company.


text: Management's Role in Cybersecurity Risk Management The Company's management, including the Company's CCO, is responsible for assessing and managing material risks from cybersecurity threats. The CCO oversees the Company's risk management function generally and relies on the FS Investments CISO to assist with assessing and managing material risks from cybersecurity threats. The CISO has over fifteen years of experience in activity managing cybersecurity and information security programs for financial services companies with complex information systems. The CCO has been responsible for this oversight function as CCO to the Company since its inception in 2023 and has worked in the financial services industry for over 40 years, during which the CCO has gained expertise in assessing and managing risk applicable to the Company.

companyName: KKR FS Income Trust Select


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Senior Vice President and General Counsel, Chief Financial Officer, and Vice President, Finance and Controller. Our Senior Vice President and General Counsel has expertise as a Life Sciences executive, has had a key role in information technology and cybersecurity oversight for several years and has completed several cybersecurity trainings. Our Chief Financial Officer has several years of expertise performing audits as a public accountant, including audits over information technology controls, and has also completed several cybersecurity trainings. Our Vice President, Finance and Controller has expertise playing a key role with information technology general controls and control testing for the Company for many years, and has several years of expertise leading and performing audits as a public accountant, including audits over information technology controls. He has also completed several cybersecurity trainings.

companyName: Regulus Therapeutics Inc.


text: The audit committee receives periodic reports from the Senior Vice President and General Counsel, Chief Financial Officer, and Vice President, Finance and Controller concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The audit committee also receives and has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: Cybersecurity Risk Management and Strategy The Company has implemented information security programs to, among other actions, assess, identify and manage material risks from cybersecurity threats. These programs include periodic risk assessments, company-wide testing initiatives, periodic phishing tests and annual audits. As the Company assesses its risks and determines how to implement risk management programs, the following factors, among others, are considered: likelihood and severity of risk, impact on the Company and others if a risk materializes, feasibility and cost of controls, and impact of controls on operations and others. The Company also utilizes an independent cybersecurity advisor to provide periodic objective assessments of the Company's capabilities and to conduct advanced attack simulations.

companyName: PREFORMED LINE PRODUCTS CO

ticker: PLPC


text: Through October 2024, the Director of Global Information Systems had oversight responsibilities for PLP's information systems and cyber security, a role he held for 15 years. He attended regular education programs regarding enterprise cybersecurity and supporting technologies. The Director of Global Information Systems reported to the CFO and coordinated with the IT resources across all subsidiary operations to discuss risk management initiatives, testing and training, recent trends and technological developments, and periodic reviews of third-party providers. In October 2024, the Director of Global Information Systems left the Company to pursue other opportunities. During the interim period before a replacement was appointed, the CFO provided more active oversight to address the Director of Global Information System's responsibilities, including reporting to the Audit Committee. The vacancy was filled on February 3, 2025 and the new Director of Global Information Systems joined the Company with over 30 years of professional IT experience where he held Director and Chief Information Officer roles at large global companies and provided technology consulting and cybersecurity services to companies across various industries.


text: The Company's Infrastructure Director is responsible for managing cybersecurity risks, including the prevention, detection, mitigation, and remediation of cybersecurity incidents. The Infrastructure Director has 20 years of experience in the creation and management of enterprise security risk programs. The Infrastructure Director reports to the EVP, Global Supply Chain & Import, who oversees the Company's management of cybersecurity risk. Through these activities and monitoring, both internally and externally, any events or incidents identified will be escalated to the appropriate Business Team Member in accordance with the Company's Incident Management Plan.

companyName: LIFETIME BRANDS, INC

ticker: LCUT


text: The Company engages with third-party experts, including cybersecurity focused Security Operations Center (SOC) and leading-edge EDR providers, to assist in evaluating and detecting security risk and initiate corrective actions. These partnerships enable the Company to leverage specialized knowledge and insights, ensuring cybersecurity strategies and processes remain aligned with industry best practices. The collaboration with these third parties includes regular audits, threat assessments, and consultation on security enhancements.


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks, reasonably address any identified gaps in existing safeguards, and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel to manage the risk assessment and mitigation process.

companyName: GrowGeneration Corp.

ticker: GRWG


text: One of the key functions of our Board of Directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board of Directors administers its cybersecurity risk oversight function primarily through the Audit Committee. Our CFO, who oversees the information technology department as led by our Director of Information Technology, provides periodic briefings to the Audit Committee regarding our cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity policies and procedures, activities of third parties, and the like.


text: Our Director of Information Technology and the Information Technology team are primarily responsible for assessing and managing our material risks from cybersecurity threats. The collective team has extensive experience in information security and cybersecurity risk management, and they monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents on an ongoing basis using a combination of security tooling, automated systems and manual processes, including information technology log reviews from across teams or reports received from network systems and applications if any unusual activity occurs, such as email system notification of items opened that could be malicious.


text: Management's Role in Cybersecurity Risk Management Our management, including our CCO, is responsible for assessing and managing material risks from cybersecurity threats. The CCO oversees our risk management function generally and relies on the FS Investments CISO to assist with assessing and managing material risks from cybersecurity threats. The CISO has over 15 years of experience in actively managing cybersecurity and information security programs for financial services companies with complex information systems. The CCO has been responsible for this oversight function as our CCO for over 10 years and has worked in the financial services industry for over 40 years, during which the CCO has gained expertise in assessing and managing risk applicable to us.

companyName: FS Specialty Lending Fund

ticker: FSEN


text: Cybersecurity risk management is a critical part of our overall risk management efforts. We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our key systems and information. This program leverages the security-control principles outlined by the National Institute of Standards and Technology ("NIST") Cybersecurity Framework 2.0 and other industry-recognized standards, as applicable. Our program prioritizes detection, analysis, and response to known, anticipated or unexpected threats. Some of the processes in place to manage risks from cybersecurity threats include identity and access management, logging and monitoring, penetration testing, vulnerability scanning, security monitoring, employee awareness training, and professional services from third-party providers. As cybersecurity threats evolve, we assess our program and make enhancements as needed to address emerging risks, adopt best practices, and strengthen our overall security posture.

companyName: Karat Packaging Inc.

ticker: KRT


text: Risk Assessment and Management At least annually, we conduct a cybersecurity risk assessment to identify key cybersecurity risks, assess the likelihood of the identified risks, and the potential business impact, and develop related mitigation and enhance plans. Our cyber risk management initiatives are integrated within the Company's overall risk management process.


text: The Company uses various techniques to identify cybersecurity risks, including but not limited to input from internal stakeholders, known and potential information security vulnerabilities identified through historical incidents and self-performed assessments, evaluations from third-party consultants, as well as external data including reported security incidents impacting other companies, and industry trends. The results of the assessment are used to drive alignment on prioritization of initiatives to enhance our security controls and measures, make recommendations to senior management, and if necessary, but at least annually, inform the Audit Committee and Board of Directors.


text: Incident Response and Recovery Planning We maintain a comprehensive Incident Response and Recovery Plan (IRR Plan) designed to guide our preparation for, detection, response to, and recovery efforts in the event of cybersecurity incidents. The IRR Plan establishes clear roles and responsibilities for a cross-functional team (IR Team) tasked with handling cybersecurity incidents. The plan outlines a structured approach to managing incidents from the technical perspective, including monitoring, identification, investigation, assessment, containment, remediation, and mitigation. Additionally, the IRR Plan also addresses compliance with legal and reporting obligations, including any required notifications to affected parties, regulatory agencies, or the public, and reporting requirements with the SEC. Cybersecurity incidents are evaluated based on their severity, potential impact, and likelihood of escalation, and are prioritized for response, remediation, and disclosure as necessary. The IRR Plan is regularly reviewed and updated as necessary to incorporate improvements and enhance the organization's overall incident response capabilities.


text: Should a cybersecurity event occur, the IR Team would review and assess the incident and determine whether further escalation and regulatory reporting is required. Any incident assessed as potentially being or becoming material is immediately escalated to the Audit Committee, and meetings of the Audit Committee and/or full Board of Directors would be held, as required.


text: We periodically engage third-party cybersecurity experts to assess and enhance our cybersecurity risk management program, and to ensure compliance with industry best practices and applicable standards. These partnerships enable us to stay ahead of evolving threats and implement robust strategies to protect critical systems and data in the event of cybersecurity incidents.


text: Internally, our cybersecurity initiatives are led by our Information Technology ("IT") team headed by our experienced IT Manager, who is a Microsoft Certified Professional and holds certifications in CompTIA Network+ and Cisco Networking. During 2024, we also onboarded a Director of IT Research & Development with over 15 years of experience in IT, systems development, and cybersecurity frameworks, including senior roles at Fortune 500 companies. Both these IT leaders play a key role in driving strategies and solutions for system protection and incident management.


text: We have also established an IT steering committee consisting of members from various key departments including IT, Finance, Operations, and Human Resources. The IT steering committee convenes regularly to review and align on IT strategic priorities, including the cybersecurity risk management program. This cross-functional approach ensures that cybersecurity efforts are integrated across the organization and that emerging risks are addressed proactively.


text: In addition, we emphasize a company-wide culture of cybersecurity awareness. Employees are required to participate in mandatory training sessions at least annually, covering topics such as phishing recognition and threat response protocols. Other regular and ongoing security communications are also provided to reinforce these lessons and ensure that cybersecurity remains a priority at every level of the organization.


text: Further, we work closely with third-party software as a service providers and other service partners to manage and mitigate security risks by implementing robust policies and procedures. Our process includes conducting thorough risk assessments during onboarding and requiring providers to maintain and implement strong security measures within their respective organizations. We mandate contractual obligations for timely notification of any material data breaches, enabling us to respond quickly to protect our data and operations.


text: Impact of Cybersecurity Risks and Threats As of the date of this report, we are not aware of any cybersecurity threats or incidents that have materially affected our business, financial condition, results of operations or cash flows. We acknowledge that cybersecurity threats are continually evolving, and the possibility of future cybersecurity incidents remains. Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cybersecurity attack will not occur. There can also be no guarantee that our policies and procedures under our cybersecurity risk management program will be properly followed in every instance or that those policies and procedures will be effective. While we devote resources to our security measures designed to protect our systems and information, no security measure is infallible. See Item 1A "Risk Factors" for additional information about the risks to our business associated with a breach or other compromise to our information and operational technology systems.


text: Our risk management program also assesses third-party risks, and we perform third-party risk management to identify and mitigate risks from third parties such as vendors, suppliers and other business partners associated with our use of third-party service providers. Cybersecurity risks are evaluated when determining the selection and oversight of service providers when handling and/or processing our employee, business or customer data. Further, in February 2024, we formalized our policy of monitoring third-party cybersecurity risks by requiring its consideration and approval by the IT change control board as a part of vendor selection and solution procurement.

companyName: Bridger Aerospace Group Holdings, Inc.

ticker: BAER


text: Our cybersecurity risk management and strategy processes are coordinated by our Director of Technology. He maintains the Certified Information Systems Security Professional certification and has nine years of senior leadership experience in defensive cyber security in both the private sector and Department of Defense. He is supported by leaders from our Information Technology, Document Management and Compliance teams, as well as management's Disclosure Committee who have extensive work experience in various roles involving information technology, including security, auditing, compliance, systems and programming. They draw on their knowledge of daily information technology operations, ongoing cybersecurity initiatives and various monitoring tools to ultimately report through the Director of Technology and Director of Internal Controls to the Audit Committee on the monitoring, prevention, mitigation, detection and remediation of cybersecurity incidents. In the event the Audit Committee determines that a cybersecurity incident has occurred, the Audit Committee will evaluate whether to escalate the cybersecurity incident to the full Board.


text: The processes described above have not indicated, as of the date of this Annual Report on Form 10-K, any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that we believe have materially affected us in the year ended December 31, 2024 or are reasonably likely to materially affect our company, including its business strategy, results of operations or financial condition. For more information on our cybersecurity risks, see the section of this Annual Report on Form 10-K entitled "Risk Factors—We rely on our IT systems to manage numerous aspects of our business. A cyber-based attack of these systems could disrupt our ability to deliver services to our customers and could lead to increased overhead costs, decreased sales and harm to our reputation."


text: Risk Management and Strategy Our risk management program is designed to identify, assess, and mitigate risks across various aspects of our company, including financial, operational, regulatory, reputational, and legal. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential cyber threats. Our Information Security Officer ("ISO") is primarily responsible for this cybersecurity component and is a key member of the risk management organization, reporting directly to the Chief Executive Officer.

companyName: Southern States Bancshares, Inc.


text: Our ISO is accountable for managing our enterprise information security department and delivering our information security program. The responsibilities of this department include cybersecurity risk assessment, defense operations, incident response, vulnerability assessment, threat intelligence, identity access governance, third-party risk management, and business resilience. The foregoing responsibilities are covered on a day-to-day basis by a first line of defense program. This endpoint program is monitored 24/7 and would notify IT staff of an incident. Most incidents would be mitigated by monitoring staff of the endpoint program, but IT staff would have to be involved in more severe incidents. This mitigation is resolved from an always updating database. In severe cases, the device that triggers the incident would be locked down and a plan of action would be put in place. The second line of defense is a monitored firewall. This would also notify IT staff of an incident. Last line of defense is IT Staff. The department is augmented by an information security specialist that is on a monthly retainer. Individuals within the department are generally subject to professional education requirements.


text: Our board of directors has approved a committee comprised of directors and management called the Information Technology Committee. This committee provides oversight and governance of the technology program and the information security program. This committee meets quarterly to provide oversight of the risk management strategy, standards, policies, practices, controls, and mitigation and prevention efforts employed to manage security risks. More frequent meetings may occur from time to time in accordance with the Business Continuity Plan in order to facilitate timely informing and monitoring efforts. The ISO reports summaries of key issues, including significant cybersecurity and/or privacy incidents.


text: The ISO has served in various roles in information technology and information security for over 21 years and holds a Bachelor of Science degree in Management Information Systems from Auburn University. The ISO is also a graduate of the Alabama Banking School of the University of South Alabama. The ISO also holds multiple professional certifications, including specialized certifications in vendor risk management and community banking technology.


text: Our Chief Information Security Officer (CISO) oversees our information security program and is responsible for leading and implementing, with a cross functional team, our cybersecurity strategy, policy, architecture, and risk management processes. Our CISO has over 20 years of experience in cybersecurity, serving as a security consultant to Fortune 100 companies, and a subject matter expert in computer forensics to law firms and U.S. Government agencies.

companyName: GoPro, Inc.

ticker: GPRO


text: Risk Management and Strategy Our periodic assessment and testing of policies, standards, processes, and practices that are designed to address cybersecurity threats and incidents include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing, simulated attacks and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We regularly engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits, and independent reviews of our information security control environment and operating effectiveness.


text: Risks from Cybersecurity Threats No previous cybersecurity incidents have materially affected us, including our business strategy, results of operations or financial condition. Future cybersecurity threats or incidents may materially affect our business strategy, results of operations or financial condition. For further detail on the potential risks, see Part I, Item 1A of this Annual Report on Form 10-K for the year ended December 31, 2024.


text: Risk Management and Strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, or Information Systems and Data.

companyName: SANGAMO THERAPEUTICS, INC

ticker: SGMO


text: Our assessment and management of material risks from cybersecurity threats are integrated into our risk management protocols. Our cybersecurity risk management program shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational and financial risk areas, including the involvement of cross-functional teams and, depending on the nature and severity of an incident, an escalation path to notify our executive and senior management teams and our board of directors. For example, the information technology department works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact on our business.


text: We use third-party service providers to assist us to identify, assess, and manage material risks from cybersecurity threats, including for example: professional service firms, including legal counsel, cybersecurity software providers and managed cybersecurity service providers.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Associate Director of IT, who has over 25 years of technology experience which includes extensive cybersecurity implementation and oversight.


text: Our Vice President of Finance & Corporate Controller is responsible on an interim basis for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. Our Associate Director of IT is responsible for helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports. Our Chief Financial Officer is responsible for approving budgets related to the foregoing.


text: Our cybersecurity incident response and vulnerability management protocol are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the executive leadership team. The executive leadership team works with the incident response team to help us mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response and vulnerability management protocol include reporting to the Audit Committee of the Board of Directors for certain cybersecurity incidents.


text: The Audit Committee of our Board of Directors receives periodic reports from the Associate Director of IT concerning Sangamo's significant cybersecurity threats and risk and the processes we have implemented to address them. The Board of Directors also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: Board Oversight and Governance Getty Images' Board of Directors has delegated the oversight of cybersecurity risks to the Audit Committee. The Audit Committee assists Getty Images' Board of Directors in its oversight of the policies and practices used by Getty Images to identify, assess and manage key risks facing Getty Images, including cybersecurity risks. Members of management, including the Company's Chief Technology Officer ("CTO"), provide the Audit Committee with updates on cybersecurity and information technology matters. In turn, the Audit Committee and management also provide updates to Getty Images' B oard of Directors. In addition to reporting to the Audit Committee and Getty Images' Board of Directors, the CTO provides periodic reports to our Chief Executive Officer and other members of our senior management as appropriate. The Audit Committee, or Getty Images' Board of Directors, is notified of cybersecurity incidents, as appropriate, in accordance with the Company's incident response processes.

companyName: Getty Images Holdings, Inc.

ticker: GETY


text: Cybersecurity Oversight Management plays an important role in assessing and managing Getty Images' material risks from cybersecurity threats. The CTO is responsible for oversight of the design and implementation of the security program and strategy. Getty Images' current CTO has served in various roles in technology for over 25 years, and has had had oversight of information technology and information security for both Getty Images (7+ years) and other organizations.


text: Potential information security incidents are identified in a number of ways, including, but not limited to: users reporting security violations, system weaknesses, violations of our Acceptable Use Policy which addresses the boundaries of acceptable use of our information technology assets, automated system alerts, and monitoring of both system generated and manually generated logs. Our Information Security Program mandates that any potential information security incident be reported to a member's direct supervisor, IT Management, or the Information Security Officer, to initiate the internal communication and investigation stage, during which such events undergo initial investigation for validation, including related to the scope and depth of such incident and to ensure that it has not resulted from a false positive. Internal communications regarding the potential incident are led by the Information Security Officer and the Incident Response Team ("IRT") in accordance with the CIRP.

companyName: Community West Bancshares

ticker: CWBC


text: Following this initial stage, we gather and update impact information and related documentation for such incidents. We use an incident classification matrix to determine the initial classification of a potential information security incident, which considers users, customers, and systems affected, the sensitivity of data at risk, and the potential business impacts to the Company including financial, legal, regulatory, operational, and reputation. The resulting classification of severity level "One," "Two," or "Three" identifies next steps for escalation and communication following the initial investigation of the potential incident. Upon escalation of an incident, per our Information Security Program, the IRT and ISO review and validate the initial determination of the priority of the incident prior to entering into subsequent investigative and response stages. Upon validation, the IRT and ISO will engage the Company's technology service provider to respond to the incident and notifications or communications are made to either additional personnel or any external entities. Depending on the specific details of any such incident, we may notify additional members of our management team, our board of directors, the Audit Committee, state and federal regulators, technology service providers, or the SEC. The timing of such communications varies based on the details of a particular incident and applicable regulations governing such disclosure. Following this classification and communication stage, we enter the recovery stage to determine containment and a response to the incident, the Company's technology service provider assigns technical staff to address such incident, implement containment, eradicate the incident source, and recover from such incident. Following any such incident and as determined by the Security Incident Forms, we engage in predefined follow-up activities to communicate with law enforcement and notify impacted third parties and customers, as appropriate, in addition to further investigating the cause of the incident, documenting takeaways, and engaging in remediation.


text: Our Information Security Officer ("ISO") coordinates with other members of our Incident Response Team identified in our Information Security Program to document, validate, respond, and manage actual or potential security incidents according to their threat classifications as described above, and report to our board of directors and the Audit Committee on an ad hoc basis. The ISO also provides annual reports on the status of our Information Security Program and its compliance with regulatory requirements to our board of directors in connection with our board's general risk management oversight role, as described in further detail below. The ISO is responsible for overseeing day-to-day operations of the Information Security Program, coordinating or contributing to reviews, audits, risk assessments, and other risk management material, development of departmental policies and procedures for board approval, and periodic updates to our Information Technology Steering Committee and the Board of Directors Technology Committee. The ISO reports to the Senior Risk Officer.


text: Cybersecurity Risk Oversight Our executive management team is responsible for the development of our policies and procedures and for managing any exception to the same. In particular, our ISO, nonmember of the executive management team, oversees information security compliance, as described above. The board of directors of the Company has ultimate oversight of cybersecurity-related risk and activities, including the review and approval of our policies and procedures related to cybersecurity. The Information Security Program is approved on an annual basis. Cybersecurity risk management is also incorporated into our overall enterprise risk management model, which is updated on an annual basis and subject to oversight by our board of directors.


text: In the ordinary course of business, our board of directors receives annual updates from the ISO regarding the Information Security Program and compliance with relevant regulations, as described above. Our Information Technology Steering Committee consists of members of the Executive Management Team and department heads with relevant technology experience, and meets on a bimonthly cadence with minutes, reports, and presentations flowing up to the Board of Directors Technology Committee which also meets on a bimonthly cadence. If an incident occurs, depending on its priority as identified through the procedures described above, management may inform our board of directors via the Directors Technology subcommittee or Audit Committee sooner than its next bimonthly update.


text: Notwithstanding our defensive measures and processes, the threat posed by cyber-attacks is severe. Our internal systems, processes, and controls are designed to mitigate loss from cyber-attacks and, while we have experienced cybersecurity incidents in the past, to date, risks from cybersecurity threats have not materially affected us. For further discussion of risks from cybersecurity threats, see the section captioned "A failure in or breach of our operational or security systems, or those of our third-party service providers, including as a result of cyber-attacks, could disrupt business, result in the disclosure or misuse of confidential or proprietary information, damage our reputation, increase costs and cause losses" in Item 1A of this Annual Report.


text: Relevant Regulations As a regulated financial institution, the Bank is also subject to financial privacy laws, and our cybersecurity practices are subject to oversight by the federal banking agencies. In addition, in 2023 the SEC recently enacted rules requiring public companies to disclose material cybersecurity incidents that they experience on Form 8-K within four business days of determining that a material cybersecurity incident has occurred and to disclose on an annual basis material information regarding their cybersecurity risk management, strategy, and governance.


text: We maintain policies regarding our information security practices, including an incident response plan to coordinate response and mitigation efforts in the event we experience a cybersecurity incident. These policies require notification of cybersecurity incidents to our information security team, and if warranted based on the perceived level of severity of the incident, to members of our executive leadership. We have not identified any cybersecurity incidents or threats that have materially affected us, including our business strategy, results of operations, or financial condition. However, like other companies in our industry, we and our third-party vendors have from time to time experienced threats and security incidents that could affect our information or systems. For more information, please consult "ITEM 1A. RISK FACTORS."

companyName: AlTi Global, Inc.

ticker: ALTI


text: Risk Management and Strategy In the ordinary course of our business, we use, store and process data including data of our employees, partners, collaborators, and vendors. We have implemented a cybersecurity risk management program that is designed to identify, assess, and mitigate risks from cybersecurity threats to this data and our systems.

companyName: Absci Corp

ticker: ABSI


text: Our cybersecurity risk management program includes a number of components, including information security program assessments and continuous monitoring of critical risks from cybersecurity threats using automated tools. We periodically engage third parties to conduct risk assessments on our systems, including penetration testing on an annual basis. We also conduct cybersecurity simulation exercises, including in connection with our disaster recovery procedures.


text: We maintain policies and processes for assessing, identifying, and managing risks from cybersecurity threats, and have integrated these policies and processes into our overall risk management strategy. Our cybersecurity program is informed by standards established by the National Institute of Standards and Technology (NIST) and the Center for Internet Security (CIS).


text: Although risks from cybersecurity threats have not materially affected, and are not reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, to date, we have, from time to time, experienced threats to and security incidents related to our and our third-party vendors' information systems. For more information about the cybersecurity risks we face, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K, including the risk factor titled "Cybersecurity incidents, data breaches, loss of data and other disruptions could compromise sensitive information related to our business or prevent us from accessing critical information and expose us to liability, which could adversely affect our business and our reputation."


text: Under the ultimate direction of our chief executive officer, or CEO, and our executive management team (including our Chief Legal Officer who serves as our Chief Compliance Officer), with oversight from our audit committee of the board of directors (Audit Committee), our Head of Information Technology (Head of IT) has primary responsibility for assessing, operating and managing our cybersecurity threat management program. Our Head of IT meets periodically with our Chief Legal Officer to discuss current developments in the cybersecurity landscape and our cybersecurity risk management program, including providing updates regarding the sources and nature of critical risks we face and how the IT department assesses those risks, including the likelihood of such risks, the severity of impact, and progress on vulnerability remediation.


text: As we are in the process of hiring a new Director of Information Technology, our Chief Legal Officer is fulfilling these functions in the interim with assistance from third-party information technology and cybersecurity experts. Although our Chief Legal Officer does not have direct cybersecurity expertise obtained through certifications, her experience as a member of our company's senior management team and overseeing enterprise risks, which includes consulting and coordinating as necessary with third-party information technology and cybersecurity experts, enables her to assess and manage material risks from cybersecurity threats. We maintain an established process to notify management of identified cybersecurity incidents and to provide an assessment of the potential criticality and impact of such incidents. We have also implemented procedures for response and containment efforts to address the actual or potential impact of identified cybersecurity incidents, as applicable.


text: As part of our board of directors' enterprise risk management program, our board of directors has responsibility for oversight of cybersecurity risk management. Our board of directors has delegated to our Audit Committee oversight of our cybersecurity risk management program, including oversight of information security and cybersecurity threats and related compliance and disclosure requirements. On an annual basis, our Chief Legal Officer provides an update to our Audit Committee regarding our cybersecurity risk management program, including as relates to critical cybersecurity risks, ongoing cybersecurity initiatives and strategies, and applicable regulatory requirements and industry standards. The Audit Committee periodically reports on cybersecurity risk management to the full board of directors.


text: Risk Management and Strategy The AIR Operating Partnership takes a risk-based approach to cybersecurity and has implemented cybersecurity policies throughout its operations that are designed to address cybersecurity threats and incidents. We regularly assesses risks from cybersecurity threats, monitors its information systems for potential vulnerabilities, and tests those systems according to our cybersecurity policies, standards, processes, and practices, which are integrated into our overall approach to enterprise risk management. To protect its information systems from cybersecurity threats, We use various security tools that help it identify, escalate, investigate, resolve, and recover from security incidents in a timely manner. Our cybersecurity program is designed to align with the National Institute of Technology Standards Cybersecurity Framework 2.0, which provides a structured approach for governing, assessing, identifying, and managing material risks from cybersecurity threats.

companyName: Apartment Income REIT, L.P.


text: The AIR Operating Partnership's technology team, under the leadership of our Senior Vice President of Technology and Chief Technology Officer, who has over 30 years of technology management experience, defines an annual work plan designed to maintain strong cybersecurity maturity, set improvement objectives of key controls and systems, including feedback from third-party assessments, and identify and implement on-going investments to replace or upgrade systems or technologies and proactively maintain strong security. As part of our annual planning, management conducts regular tabletop testing of our incident response plan to increase awareness, establish key decision-making criteria, ensure effective communication among key stakeholders, and comply with our disclosure obligations. We also partner with third-party experts to assess the effectiveness of our cybersecurity prevention and response systems and processes (e.g., periodic penetration testing and assessments of IT general controls). We also engage vendors to enhance cybersecurity safeguards and improve incident response and updates or replaces systems and applications as appropriate to improve data processing and storage management and enhance security. To further protect our information systems, we structure and monitor our relationships with third-party service providers and periodically conduct due diligence on their cybersecurity architecture and process design.


text: To date, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us and we believe are not reasonably likely to have a material adverse effect on us, including its business strategy, results of operations, or financial condition. For additional information on cybersecurity risks and potential related impacts on AIR Operating Partnership, refer to "Our business and operations would suffer in the event of significant disruptions or cyberattacks of our information technology systems or our failure to comply with laws, rules and regulations related to privacy and data protection." in Part I, Item 1A, Risk Factors.


text: Our Senior Vice President of Technology and Chief Technology Officer, in coordination with other members of AIR Operating Partnership's management, is responsible for leading the assessment and management of cybersecurity threats. AIR Operating Partnership has implemented a governance program for its cybersecurity efforts. This includes regularly updating privacy notices, terms of use, and lease documents, as well as identifying responsible teammates to facilitate the implementation of cybersecurity priorities. These teammates report regularly to senior management on risk identification, safeguards, and mitigation steps. AIR Operating Partnership has developed and implemented policies to identify and mitigate cybersecurity risks and provides training to teammates at onboarding and annually thereafter. Updates are communicated to all teammates, and actionable guidance is provided when new risks arise. Our Board of Directors (i.e., the Board of Directors of AIR, with AIR as the sole member of the sole member of the General Partner) will receive updates on the AIR Operating Partnership's cybersecurity profile risk assessment and technology environment and the broader technology landscape as and when appropriate.


text: Cybersecurity Risk Management and Strategy We recognize the importance of identifying, assessing, and managing material risks associated with cybersecurity threats. We invest in cybersecurity to protect intellectual property, customer and employee data, manage reputational risk, and maintain business continuity across our environment. We strive to ensure ongoing compliance with the requirements under applicable standards including the Payment Card Industry Data Security Standards and relevant data privacy and protection laws and regulations. Additionally, our teams reference the standards, guidelines, and practices from the NIST Cybersecurity Framework (CSF) to align our cybersecurity program and risk management practices. The foundation of our cybersecurity framework is based on written policies that govern different cybersecurity process areas.

companyName: Grove Collaborative Holdings, Inc.

ticker: GROV


text: Identifying and assessing cybersecurity risk is part of our overall risk management systems and processes. Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through a combination of third party assessments, IT Security Risk reviews, external audits and assessments, penetration tests, vulnerability scans, security monitoring activities and recurring review from our internal cybersecurity working group. We respond to cybersecurity incidents and address identified cybersecurity risks through our internal cybersecurity working group and report any material findings and incidents to the audit committee of our board of directors.


text: The cybersecurity incident response process is governed by our Incident Response Plan ("IRP") and overseen by leaders from our IT security and legal teams. The IRP guides how security events are evaluated, ranked by severity and prioritized for response and remediation. Incidents are evaluated to determine materiality as well as operational and business impact and reviewed for privacy impact.


text: As part of the above processes, we regularly engage external advisors and consultants to assess our internal cybersecurity programs and compliance with applicable regulatory requirements and industry standards. Our external advisors also act as an extension of our teams to support on daily related security activities, by working closely with our Chief Information Officer and the leader of IT Operations.


text: Our cybersecurity risk management program evaluates the risk associated when selecting third-party service providers. In addition to new vendor onboarding, critical vendors are reviewed annually to ensure we understand their cybersecurity posture, and their responsibility in protecting our assets appropriately.


text: Cybersecurity Governance Cybersecurity is an area of focus for our board of directors, audit committee, and management. As part of our board of directors' overall responsibility for oversight of management's general risk identification and management activities, the audit committee of our board of directors is responsible for the oversight of risks from cybersecurity threats. Members of the audit committee review and discuss with management and our auditors quarterly the Company's cybersecurity risks and the steps that management has taken to protect against threats to the Company's information systems and security and review risk and mitigation steps taken by management related to data privacy.


text: To manage our material risks from cybersecurity threats and to protect against, detect, and prepare to respond to cybersecurity incidents, we undertake the below listed activities: • Monitor emerging data protection laws and implement changes to our processes to comply; • Conduct periodic data handling and use requirement training for our employees; • Conduct annual cybersecurity management and incident training for employees involved in our systems and processes that handle sensitive data; and • Conduct regular phishing email simulations for all employees.

companyName: American Strategic Investment Co.

ticker: NYC


text: Our incident response plan coordinates the activities that we and our third-party cybersecurity providers take to prepare to respond and recover from cybersecurity incidents, which include processes to triage, assess severity, investigate, escalate, contain, and remediate an incident, as well as to comply with potentially applicable legal obligations.


text: Our Audit Committee of the Board of Directors is responsible for oversight of our risk assessment, risk management, disaster recovery procedures and cybersecurity risk s. Members of the Board regularly engage in discussions with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.


text: During the reporting period of this Annual Report on Form 10-K, we have not encountered risks from cybersecurity threats that have materially affected us, or are reasonably likely to materially affect, our business strategy, results of operations or financial position. However, we cannot assure you that we will not experience any such threats or incidents in the future. See "Item 1A. Risk Factors" in this Annual Report on Form 10-K, for additional discussion about cybersecurity-related risks.


text: As an externally managed company, our day-to-day operations are managed by our Manager and our executive officers under the supervision of our board of directors and its committees. Our executive officers are senior investment professionals provided to us through our Manager pursuant to our management agreement with our Manager. Our business is highly dependent on the communications and information systems of our Manager, its affiliates and third-party service providers. Our Manager is an affiliate of ORIX USA, a diversified financial company and subsidiary of ORIX and participates in and is subject to ORIX USA's cybersecurity program. Accordingly, we rely and Manager relies on ORIX USA and its cybersecurity risk management program to identify, assess and manage material risks to our business from cybersecurity threats.

companyName: Lument Finance Trust, Inc.

ticker: LFT


text: To date, cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected nor, are they reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. For a discussion of how risks from cybersecurity threats affect our business see, "Part I. Item IA. Risk Factors - the occurrence of cyber-incidents, or a deficiency in our Manager's Cybersecurity or those of any of our third party service providers, could negatively affect our business by causing a disruption to our operations, a compromise of our confidential information or damage to our business relationships or reputation, all of which could negatively impact our business and results of operations" in this Annual Report on Form 10-K.


text: Cybersecurity Governance Our board of directors is responsible for directing and overseeing our risk management. Our board of directors administers this oversight function directly, with support from its committees. In particular, the audit committee of our board of directors (the "Audit Committee") has the responsibility to consider and discuss our major financial risk exposures and the steps our Manager should take, or is required to take, to monitor and control these exposures, including guidelines and policies to govern the process by which risk assessment and management is undertaken. Our Audit Committee also monitors compliance with legal and regulatory requirements, in addition to overseeing the performance of our internal audit function. Pursuant to the Management Agreement, our Manager is responsible for identifying, assessing, and managing our material risks from cybersecurity threats. Our Manager relies on ORIX USA and ORIX USA Information Technology and Cybersecurity Team, including the ORIX USA Chief Technology Officer ("CTO"), to provide us with a comprehensive cybersecurity risk management program.


text: Periodically, at least annually, ORIX USA's CTO and/or other members of the ORIX USA Information Technology and Cybersecurity Team will present to the Audit Committee on various topics relating to ORIX USA's technology risks, including ORIX USA's cybersecurity program (including the results of cybersecurity tabletop exercises), cybersecurity issues (including those relating to data protection, insider threats, regulatory changes and geopolitical cyber threat management) and risk management (including the results of periodic technology audits).


text: Cybersecurity Risk Management and Strategy ORIX USA has engaged HCLTech ("HCL") to manage all infrastructure and cybersecurity services for ORIX USA and its subsidiaries, under the governance of the ORIX information and cybersecurity leadership team. HCL has over twenty-five years' experience in cybersecurity, nine cybersecurity delivery centers strategically placed across the globe, and employs over 7,000 cybersecurity professionals. The ORIX information and cybersecurity leadership team and HCL are considered the "ORIX USA Information Technology and Cybersecurity Team".


text: HCL will deliver the managed security services to ORIX USA from its Offshore Management Center (OMC) and Cybersecurity Fusion Centers (CSFC) providing 24x7 operations that cover ORIX USA's cybersecurity landscape including network security, email security, endpoint security, data security, application security, cloud security, privileged access management, vulnerability management, cybersecurity incident response, cybersecurity third-party risk, cybersecurity awareness training, phishing simulations and identity and access management.


text: The ORIX USA CTO, leads the ORIX USA Information Technology and Cybersecurity Team responsible for managing information security at ORIX USA's asset management business, including its cybersecurity strategy and program, which encompasses annual employee training about cybersecurity risks and new employee onboarding about ORIX USA's security policies. The ORIX USA Information Technology and Cybersecurity Team's responsibilities cover three main areas: (i) operations and engineering, (ii) threat detection and response, and (iii) governance. The ORIX USA CTO leads the cybersecurity team with over four years of experience at ORIX USA and 18 prior years of experience at a large asset management firm. This cybersecurity program is aligned with the NIST Cybersecurity Framework ("NIST CSF"), emphasizing training and development.


text: ORIX USA employs a 'defense in depth' cybersecurity strategy and program based on the NIST CSF, which includes multiple layers of security policies, protections, and controls designed to safeguard the confidentiality, integrity, and availability of infrastructure, network and information assets from malware and threats. This includes the deployment of next generation firewalls, web application firewalls, email protection technologies, DLP technologies, internet proxy, and next generation antivirus and endpoint detection and response ("EDR") systems.


text: The ORIX USA Information Technology and Cybersecurity Team monitors security events via a SIEM (security information and event management) and SOAR (security orchestration, automation, and response) platform. Mobile device management software is employed with the objective of protecting corporate email and data on mobile devices and is designed to prevent unauthorized data transfer.


text: ORIX USA maintains a cybersecurity incident response capability that includes detailed policies, plans and modular run books and maps designed around different types of cybersecurity incidents. The plan and run books are tested annually through cybersecurity tabletop simulations where incident response technical, and executive team members go through real-world scenarios focused on current cybersecurity threats. ORIX USA's cybersecurity incident response plan provides for escalation of identified cybersecurity threats and incidents, including, as appropriate, to our management. These discussions provide a mechanism for the identification of cybersecurity threats and incidents, assessment of cybersecurity risk profile or certain newly identified risks relevant to our Company, and evaluation of the adequacy of our cybersecurity program, including risk mitigation, compliance and controls. ORIX USA has established a notification decision framework to determine when to send notifications regarding certain cybersecurity incidents, with different severity thresholds triggering notification to different recipient groups, including our Manager and officers of LFT.


text: Cybersecurity Risk Management and Strategy We regularly face cybersecurity threats from malicious third parties that could obtain unauthorized access to our internal systems, networks, and data. It is virtually impossible for us to entirely mitigate the risk of these and other security threats we face, and the security, performance, and reliability of our products may be disrupted by third parties, including nation-states, fraudsters, criminal syndicates, competitors, hackers, disgruntled employees, former employees, or contractors. While we have implemented security measures internally and have integrated security measures into our systems, network, and products, these measures may not always function as expected and may not always detect or prevent all unauthorized activity, prevent all security breaches or incidents, mitigate all security breaches or incidents, or protect against all attacks or incidents.

companyName: Bakkt, Inc.

ticker: BKKT


text: Particularly in light of the extensive cybersecurity risks facing our company and the fact that we provide crypto digital asset products to our clients, we recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to protect our internal systems and our clients' data. We have established a multi-layered approach to manage our cybersecurity risks with preventative and detective capabilities enabled in our network and internal systems that are designed to protect against identified cyber threats. This approach to cybersecurity includes, among other things, annual and periodic risk assessments; ongoing collaboration with our product and engineering teams for the purpose of securing our products, systems, and data; a vulnerability management program focused on proactively identifying, triaging and mitigating security vulnerabilities within our systems, penetration tests and other simulations; regularly required security training for all employees; and a comprehensive incident response process to identify, contain, and remediate cybersecurity incidents. We also engage with external cybersecurity assessors and consultants in evaluating and testing the design and operating effectiveness of controls.


text: To identify and assess material risks from cybersecurity threats, our Enterprise Risk Management program considers cybersecurity risks alongside other company risks as part of our overall risk assessment process. We perform specific cybersecurity risk assessments at least annually to identify and assess material cybersecurity threat risks, their severity, and potential mitigations. We employ a range of tools and services, including regular network and endpoint monitoring, vulnerability assessments, penetration testing, and tabletop exercises to further identify risks.


text: We are aware of risks associated with our use of third-party service providers, including those who have access to our systems, data, or facilities. We have implemented processes to help manage these risks. We conduct security assessments of third-party providers who may have access to sensitive information as part of our selection and onboarding process. We also conduct ongoing monitoring in the form of periodic reviews conducted by our security team based on the business criticality of the third-party service.


text: As of the date of this Form 10-K we do not believe that these risks or any previous cybersecurity events or incidents have materially affected or are reasonably likely to materially affect us. We face risks from cybersecurity threats, including those associated with cyberattacks and security breaches and incidents, in the future. For additional information regarding whether and how risks from identified cybersecurity threats are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition refer to "Item 1A. Risk Factors" and "Item 7. Management's Discussion and Analysis of Financial Condition and Results of Operations" of this Form 10-K, which disclosures are incorporated by reference herein.


text: Cybersecurity Governance Cybersecurity is an important part of our risk management processes and an area of focus for the Board and management. The Board is responsible for monitoring and assessing strategic risk exposure, and our cybersecurity program and strategy are overseen by our Chief Information Security Officer (CISO). Our CISO, who joined us in 2022, has over 25 years of prior work experience in various roles managing enterprise risk and information security, developing cybersecurity strategy, and implementing effective information and cybersecurity programs, as well as several relevant degrees and certifications, including Certified Information Security Manager, Certified Information Systems Auditor, and Certified Information Systems Security Professional. The CISO provides regular updates to the executive management team and provides the quarterly Board updates, as discussed below. The executive management team allocates resources to support the cybersecurity program through allocation of budget.


text: The Board administers its cybersecurity risk oversight function directly as a whole, as well as through its Audit and Risk Committee, which is responsible for oversight of risks from cybersecurity threats. At least quarterly, the entire Board receives an update from the CISO of our cybersecurity program covering topics such as results from third-party assessments, progress toward strategic goals, compliance with regulatory requirements, and certain cybersecurity threat risks or developments, as well as the steps management has taken to respond to such risks. Members of the Board are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.


text: The Company's Information Security Working Group ("ISWG") is actively engaged in managing cybersecurity risks and overseeing the design, implementation, and evaluation of the Program. The purpose of the ISWG is to define cybersecurity risk tolerance, guide implementation of the Program, monitor Program development and effectiveness, and validate investments in cybersecurity measures and infrastructure. Members of the ISWG include: the Chief Financial Officer, the Chief Legal Officer, the head of the Company's Human Resource department, the Senior Vice President of Program Management and Corporate Infrastructure, the Senior Vice President of Regulatory and Quality Assurance, and the Company's head of Information Technology. The group meets semi-annually to review the effectiveness of the Program, discuss any new developments and potential improvements to the Program, and evaluate internal and external security-related events to determine how Avalo can take appropriate steps to mitigate such risks.

companyName: Avalo Therapeutics, Inc.

ticker: AVTX


text: The Audit Committee (the "Committee") is primarily responsible for oversight of the Program. The Committee is composed of directors with expertise in technology, audit, finance, and compliance, equipping them to effectively oversee the program. Yingping Zhang serves as our Vice President of Information Technology, and she also helps oversee the implementation and effectiveness of the Program as a member of the ISWG. Ms. Zhang graduated from the University of Pittsburgh with a Master of Science in Electrical Engineering and has over thirty years of experience as an information technology professional. Prior to Avalo, Ms. Zhang worked as an Executive Consultant for Insightful Group, the Vice President of Information Technology at Horizon, and the Vice President of Informational Technology and Information Services at Viela Bio, among other positions within biopharma companies. Ms. Zhang reports to Lisa Hegg, Senior Vice President of Program Management and Corporate Infrastructure. Ms. Hegg provides information technology and cybersecurity reports as necessary at meetings of management's Disclosure Committee, which is communicated quarterly to the Audit Committee, with greater frequency as necessary. Ms. Zhang regularly informs Ms. Hegg, our Chief Executive Officer (CEO) and other members of the leadership team, about the Program, best practices, current cybersecurity threats, the risk landscape, and mitigation strategies. These reports include the following on an as-needed basis: updates on the Program; assessment of the Program; emerging risks or concerns; policies, procedures, and training; and risk mitigation strategies.


text: Cyber Risk Management and Strategy We rely on information technology in our operations, and any material failures, inadequacies, interruptions, security failures, social engineering attacks or cyber-attacks could harm our business. To help manage these risks, we engage and rely on external experts and an information technology managed services provider. Our managed services provider's information security analysts and IT security specialists offer us advice on technology, infrastructure, management, and productivity in relation to our information technology capabilities.

companyName: SWK Holdings Corp

ticker: SWKH


text: We have also developed a cybersecurity risk management process for our third-party vendors. This process aims to assess the cybersecurity maturity of vendors who have access to our data or systems through an evaluation of the vendor's cybersecurity risk profile. We, like other companies in our industry, face a number of cybersecurity risks in connection with our business. We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition; however, like other companies in our industry, we and our third-party vendors do, from time to time, experience threats and security incidents relating to our, and our third party vendors', information systems. For more information, see Item 1A "Risk Factors."


text: Governance Related to Cybersecurity Risks We engage a managed services provider as discussed above, which includes services to assist us with the identification, monitoring, and management of cybersecurity risks. Our managed services provider reports periodically to our management team, including our Chief Executive Officer ("CEO"). The CEO briefs the Board on information regarding cybersecurity matters at least quarterly.


text: Our risk manager, along with the CEO, oversee our policies with respect to risk assessment and risk management, including with respect to cybersecurity risks. The Audit Committee of our Board is tasked with oversight of the management of risks related to cybersecurity. The Audit Committee administers its risk oversight function by receiving periodic reports from members of senior management, including the risk manager and CEO, on areas of identified significant risk to the Company.


text: The Company's cybersecurity team is headed by its Executive Director Global Lead of Information Technology & Information Security, who works with the Company's cybersecurity team to identify cybersecurity risks and who has been in the information technology and cybersecurity industry for over 25 years and holds numerous technical certifications and cybersecurity-related certificates. The team members report via its established cybersecurity triage and outage workflow to the Cibus Cyber Security Council, which consists of the Company's Interim CEO, President, and COO, EVP and CSO, and members of the Company's legal and human resources teams. The Company's Cyber Security Council meets regularly to discuss the status of the cybersecurity program, emerging cybersecurity threats, long-term cybersecurity investments and strategies, and oversight of the Company's cybersecurity program. The Company's Cyber Security Council is also responsible for identifying, assessing, and managing the Company's exposure to material risks from cybersecurity threats, including monitoring the prevention, detection, mitigation, and remediation of cybersecurity threats.

companyName: Cibus, Inc.

ticker: CBUS


text: Our management and Board of Directors (the "Board") recognize the importance of maintaining the security and resiliency of our cybersecurity environment to deliver on the expectations of our customers, business partners, employees, and investors. The Board is involved in our risk management practices. Overall, the purpose of our information security program is to protect the confidentiality, integrity and availability of our systems and data, along with the safe operation of our systems.

companyName: SANUWAVE Health, Inc.

ticker: SNWV


text: Technical safeguards We deploy technical safeguards that are designed to protect our systems from cybersecurity threats, including firewalls, anti-malware software, and authentication and authorization controls.


text: Security awareness and training We provide ongoing security awareness and training to educate internal users on how to identify and report potential issues. Phishing emails are discussed on a regular basis with employees to ensure proper protocols are followed. We also provide periodic updates to employees on emerging cybersecurity trends and ways to protect themselves and the Company.


text: Governance of Cybersecurity Risks The Audit Committee of the Board has the primary responsibility for oversight, review and discussion with management of the Company's information technology, data security, business continuity, artificial intelligence and cybersecurity-related risk exposures and threats; the potential impact of those risk exposures and threats on the Company's business, operations and reputation; and the processes management has established to assess, manage, monitor and mitigate such risk exposures and threats. The Company's Chief Executive Officer, President, and Chief Financial Officer are responsible for assessing and managing cybersecurity risks. The Company's management periodically reports on cybersecurity issues and presents information to our Audit Committee as well as our full Board, as appropriate, on cybersecurity matters.


text: Upon verifying that a cybersecurity incident has occurred or is occurring, the Chief Executive Officer, President and Chief Financial Officer will promptly conduct a preliminary assessment of the severity level of the cybersecurity incident. Following this assessment, the Chief Executive Officer will determine whether to report the cybersecurity incident to the Audit Committee, who will then report such cybersecurity incident to the Board as the chair deems appropriate.


text: Material Impact of Cybersecurity Risks We have not experienced a material information security breach incident, and we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business. However, future incidents could have a material impact on our business strategy, results of operations or financial condition. For additional discussion of the risks posed by cybersecurity threats, see "Item 1A. Risk Factors— Risks to our Business— We are dependent on information technology and our systems and infrastructure face certain risks, including from cybersecurity breaches and data leakage."


text: As an externally managed company, our day-to-day operations are managed by our Advisor and our executive officers under the oversight of our board of directors. Our executive officers are senior Nuveen Real Estate professionals and our Advisor is a subsidiary of TIAA. As such, we are reliant on TIAA for assessing, identifying and managing material risks to our business from cybersecurity threats. Below are details TIAA has provided to us regarding its cybersecurity program that are relevant to us.

companyName: Nuveen Global Cities REIT, Inc.


text: Cybersecurity Program Overview TIAA, on our behalf, has a program and formal processes in place to assess, identify, and manage material risks from cybersecurity threats. Our business is dependent on the communications and information technology ("IT") systems of TIAA and other third-party IT service providers to TIAA. TIAA and the Advisor manage our day-to-day operations and have implemented a cybersecurity program that applies to us and our operations.


text: We depend on and engage various third parties and service providers, including suppliers, custodians, transfer agents, property management companies, and joint venture partners, to operate its commercial real estate and investment business. We rely on the expertise of risk management, legal, information technology, and compliance personnel of TIAA when identifying and overseeing risks from cybersecurity threats associated with our use of such entities.


text: TIAA has instituted an enterprise cybersecurity program designed to identify, assess, and mitigate cyber risks applicable to TIAA, the Company, and other products, subsidiaries and affiliates of TIAA and their respective third-party service providers.


text: This cyber risk management program is integrated into TIAA's overall risk management program. It involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which we rely. TIAA relies on its internal subject matter experts and external experts, as needed, including but not limited to cybersecurity assessors, consultants, and auditors, to evaluate cybersecurity measures and risk management processes, applicable to the Company and other products, subsidiaries, and affiliates of TIAA.


text: TIAA actively monitors the current cyber threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Company in connection with its day-to-day commercial real estate, investment, and other operations.


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on us are assessed on an ongoing basis, and how such risks could materially affect our business strategy, operational results, and financial condition are regularly evaluated. TIAA maintained appropriate cyber security policies and procedures during the 12-month period covered by this report and there were no material cybersecurity issues that affected us. Cybersecurity risk remains heightened to the financial industry, including us, and a failure in or breach of our systems or infrastructure, or those of a material third party or service provider, could cause disruption and adversely impact our operations. TIAA continues to invest in the cybersecurity program to protect against emerging threats, including threats against third parties and service providers.


text: Cybersecurity Governance Our board of directors oversees risks from cybersecurity threats and has delegated responsibility for such oversight of cybersecurity matters to the audit committee. The audit committee receives periodic updates from TIAA's cybersecurity leadership regarding the overall state of TIAA's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting us.


text: TIAA's management, including its Chief Information Security Officer, is responsible for assessing and managing material risks from cybersecurity threats to the TIAA organization, including us. TIAA's Chief Information Security Officer and cybersecurity leaders have significant expertise in in this area, including in IT and cybersecurity engineering as well as cybersecurity leadership experience in other major financial institutions. Management of the Advisor is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting us, including through the receipt of notifications from third party service providers and reliance on communications with cybersecurity, risk management, legal, IT, and/or compliance personnel of TIAA.