text: Our IT management is responsible for notifying the Cybersecurity Governance Committee of cyber incidents they become aware of from software alerts, third-party vendors, employees or by other means. The Cybersecurity Governance Committee will review such incidents, including activities by IT management to evaluate the severity of the incidents, and will provide details of any cybersecurity events, including those not deemed to have a material impact, to our Internal Controls and Disclosure Committee for reporting to our Audit Committee. In addition, our Chief Financial Officer, Senior Director of IT and Director of Internal Audit maintain an ongoing dialogue with the Audit Committee during the year regarding emerging or potential cybersecurity risks.


text: The Cybersecurity Governance Committee has the responsibility for determining if a cybersecurity incident is considered to have a material impact on the Company requiring public reporting in accordance with the rules and regulations of the U.S. Securities and Exchange Commission.

companyName: FTC Solar, Inc.

ticker: FTCI

secItem: Item 1C


text: Under the guidance of the Cybersecurity Governance Company, we have adopted (i) a Security Incident Response Plan, (ii) a Cybersecurity Materiality Assessment Policy, and (iii) a Cybersecurity Register of Events.


text: Our IT management, in conjunction with our Director of Internal Audit, has responsibility for monitoring and testing the effectiveness of our cybersecurity controls and procedures on a recurring basis.


text: Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data related to our clinical trials and approved medications ("Information Systems and Data").

companyName: Mirum Pharmaceuticals, Inc.

ticker: MIRM


text: Our information security team, supported by our legal and compliance departments, help identify, assess and manage our cybersecurity threats and risks. Our information security team identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods, depending on the context, including, for example manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and threat actors, conducting scans of certain environments, evaluating our and our industry's risk profile, evaluating threats reported to us, coordinating with law enforcement about certain threats, conducting internal audits and threat assessments, and conducting vulnerability assessments.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example, incident detection and response procedures; disaster recovery/business continuity plans; risk assessments; implementation of security standards; encryption of certain data; network security, access, and physical controls for certain systems; management, tracking and disposal of certain assets; systems monitoring; employee training; penetration tests by third-party service providers; tabletop exercises; and cybersecurity insurance.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, the information security team works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business and our senior management evaluates material risks from cybersecurity threats against our overall business objectives and reports to the audit committee of the board of directors, which evaluates our overall enterprise risk.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example professional service firms such as legal counsel, threat intelligence providers, cybersecurity consultants and software providers, and other third-party service providers including for identity management solutions.


text: We use third-party service providers to perform a variety of functions throughout our business application providers, hosting companies, contract research organizations (CROs), contract manufacturing organizations (CMOs), supply chain resources, and other business-related SaaS platforms. We have a vendor management program to manage cybersecurity risks associated with our use of certain of these providers. The program includes conducting risk assessments of certain vendors, reviewing certain vendors' security assessments, and reviewing reports of certain of our vendors' security. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part I. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "Our business is subject to complex, stringent and evolving U.S. and foreign laws, regulations, and rules, contractual obligations, industry standards, policies and other obligations relating to privacy and data protection. Our actual or perceived failure to comply with such obligations could result in regulatory investigations or actions, litigations (including class claims) and mass arbitration demands, fines and penalties, disruptions of and changes to our business practices, monetary penalties, reputational harm, loss of revenue or profits, and other adverse business consequences."; and "If our information technology systems, or those used by our CMOs, CROs or other contractors, consultants or third parties upon which we rely, or your data are or were compromised, we could experience adverse consequences, including but not limited to regulatory investigation, actions, litigation, fines and penalties, disruptions of our business operations, reputation harm, loss or revenue or profits, and other adverse consequences."


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing our cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Senior Director of Information Technology/Information Security, internal legal counsel, Chief Compliance Officer ("CCO"), and Chief Financial Officer ("CFO"). Our Senior Director of Information Technology/Information Security has over ten years of experience in information technology and security, and previously held positions such as Associate Director of Informational Technology and Operations, Senior Manager of Informational Technology, and similar roles at other companies.


text: Our Senior Director of Information Technology/Information Security is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, helping prepare for cybersecurity incidents, approving cybersecurity processes, reviewing security assessments and other security-related reports, and communicating key priorities to relevant personnel. Our CFO is responsible for approving budgets as related to cybersecurity.


text: Our incident response and vulnerability management processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the Senior Director of Information Technology/Information Security, Data Protection Officer, and the Vice President, Legal. These individuals work with our incident response team to help us mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response processes include reporting to the audit committee of the board of directors for certain cybersecurity incidents.


text: The audit committee of the board of directors receives annual reports from our Senior Director of Information Technology/Information Security concerning our significant cybersecurity threats and risk and the processes we have implemented to address them. The audit committee of the board of directors also receives and has access to various presentations related to cybersecurity threats, risk and mitigation.


text: In the ordinary course of business, CSB relies on electronic communications and information systems to conduct its operations and to store sensitive data. CSB employs an in-depth, layered, defensive approach that leverages people, processes and technology to manage and maintain cybersecurity controls. CSB employs a variety of preventative and detective tools to monitor, block, and provide alerts regarding suspicious activity, as well as to report on any suspected advanced persistent threats. CSB Places a high priority and focus on securing the confidential information it receives and stores about its customers and associates and providing highly available systems.

companyName: CSB Bancorp, Inc.

ticker: CSBB


text: Our Information Security ("IS") Program consists of policies, procedures and guidelines to ensure the security, availability, and confidentiality of systems and customer information. The IS Program is led by our Information Security Officer ("ISO") under the direction of the Chief Information Officer ("CIO") and is subject to oversight by our IT Steering Committee. The IT Steering Committee is a cross-functional management committee with overall responsibilities for identifying and approving the IT Strategic plan, identifying and approving strategic technology based initiatives that improve/enhance the security posture and mitigation efforts of cybersecurity threats, monitoring of the technology infrastructure and systems, monitoring critical vendors, monitoring cybersecurity threats and issues, and conducting, reviewing, and monitoring IT based risk assessments. These efforts include the framework used to identify and prevent cyberattacks or breaches. The IT Steering Committee makes recommendations for approval of certain risk assessments, risk frameworks, and appropriate application of mitigation strategies and frameworks to the Board of Directors.


text: The Board of Directors oversees the IS Program in the following ways: (a) monitors and oversees the Company's business and information technology operations necessary for its business plan, including projected growth, technology capacity, planning, operational execution, product development and management capacity, (b) reviews the Company's framework(s) to prevent, detect, and respond to cyberattacks or breaches, as well as identifying areas of concern regarding possible vulnerabilities, and reviews policies pertaining to information security and cyber threats, taking into account the potential for external threats, internal threats, and threats arising from transaction and contractual relationships with trusted third party vendors, and (c) reviews the Company's incident response, business continuity and disaster recovery planning and preparedness including processes, policies and procedures that are related to preparing for recovery or continuation of technology infrastructure which are vital to the Company. As part of the Board's oversight, the Board receives frequent reports from the CIO and ISO including the summarization of new and emerging cybersecurity threats and trends and the effectiveness of our IS Program in mitigating cybersecurity threats among other items. In the event of an information security incident, our Incident Response Plan clarifies the steps for escalation according to the severity of the event.


text: The IS team is staffed primarily with internal associates, and we utilize third party service providers for extended coverage. We hire IS team members that have relevant information security experience or technology certifications and knowledge to implement and oversee the procedures and processes of our IS Program and to adequately manage and enforce our policies and procedures. Further, management involved in the cybersecurity process, possess the necessary skills and expertise to adequately manage and enforce our policies and procedures.


text: While all vendors are subject to our vendor management process, those with access to our data and data centers are subject to more rigorous initial and ongoing due diligence. This includes the reviews of Service Organization Control 2 ("SOC 2") reports, financial information, and other policies and procedures related to such third party vendors and their various programs, including vendor management.


text: Risk Management and Strategy As part of the ongoing maintenance and development of our IS Program, we assess the various risks associated with the unauthorized access or loss of client information and the quality of security controls as prescribed by the Federal Financial Institutions Examinations Council and several other frameworks. The frameworks and our IS risk assessments are utilized to monitor and develop strategies to minimize risk to our information assets.


text: Our systems are monitored 24/7 for cybersecurity threats, and we utilize a variety of tools to reduce the risk of data breaches and cybersecurity events. We maintain an Incident Response Plan that outlines the steps to be taken in the event of an incident, which could include a potential or actual data breach. The plan identifies a designated team, including associates and third-party experts, responsible for incident response and summarizes the steps, including escalation protocol, for determining whether an event has occurred and the nature and scope of the event (if applicable). The plan also summarizes protocol for notifying impacted persons, which may include customers as well as other applicable agencies or persons, including law enforcement and regulatory authorities.


text: At least annually, we conduct a third-party information security audit focusing on internal and external network security protocols and penetration testing, as well as internally managed ad hoc testing as needed. Simulations and tabletop testing of our business continuity and Incident Response Plans are performed on a routine basis and assist with our associates' familiarity and preparedness for an event. Any gaps or improvement areas identified by routine testing are addressed in a timely manner to help improve future testing and response.


text: The processes and controls related to data security are regularly tested by the IS department and Internal Audit. Additional internal security assessments may be performed at the request of the CISO, CIO, the Internal Auditor, Management or our Board. Audit and assessment results are presented to the Audit Committee of the Board, and to the IT Steering Committee.


text: At least annually, the IS Program, including its effectiveness, is reviewed by the Board. Annually, all associates participate in mandatory training related to the IS Program, including information security and its importance with respect to customer and associate privacy. All associates are required to participate in monthly bank wide phishing tests. Results from these tests are delivered to our Audit Committee of the Board of Directors.


text: Notwithstanding the strength of CSB's defensive measures, the threat from cyber-attacks is severe, attacks are sophisticated and increasing in volume, and attackers respond rapidly to changes in defensive measures. While to date, CSB has not detected a significant compromise, significant data loss or any material financial losses related to cybersecurity attacks, CSB's systems and those of its customers and third-party service providers are under constant threat and it is possible that CSB could experience a significant event in the future. Risks and exposures related to cybersecurity attacks are expected to remain high for the foreseeable future due to the rapidly evolving nature and sophistication of these threats, as well as the expanding use of internet banking, mobile banking and other technology-based products and services by the Company and its customers.


text: Risk Management and Strategy The Company's Information Technology team has established an information security management system to safeguard the confidentiality, integrity, and availability of the Company's products, infrastructure, and data. This system is integrated with our Quality and Business Management Systems and, aims to identify, assess, and address cybersecurity risks affecting our business. It features an Incident Response Procedure ("IRP") that specifies roles and responsibilities during security incidents, detailing incident detection, investigation, mitigation, and prompt incident reporting procedures.

companyName: Aeva Technologies, Inc.

ticker: AEVA


text: The IT Director leads and coordinates cybersecurity efforts at Aeva, providing regular updates on cybersecurity progress to the senior leadership team. The Information Security team actively shares updates on the status of cybersecurity efforts and risks, evaluates our information security programs, and monitors the evolving threat landscape on a company-wide level.


text: Additionally, we conduct regular internal assessments and audits, complemented by insights from external experts. The outcomes of these evaluations are communicated to senior leadership. Based on these risk assessments, we redesign, implement, and maintain adequate safeguards to reduce identified risks, address gaps, and continuously assess the efficacy of these measures. Our engagement with our key partners, vendors, customers, industry stakeholders, and government bodies is relentless, aiming to improve our information security policies and procedures over time. We aim to diligently manage risks related to cybersecurity threats from third-party service providers, including, when possible, requesting our service providers to report incidents that may compromise the Company's data.


text: Risks from Threats and Incidents Our IT infrastructure, encompassing operational and security systems, integrated software, and data processed by us or our third-party vendors, is vulnerable to cybersecurity threats and incidents. As of December 31, 2023, these risks have not significantly impacted the Company, including our business strategy, or operational results, or financial results.


text: Our Chief Technology Officer is tasked with assessing and managing significant cybersecurity risks across the Company based on the assessments of our IT Director. Our IT Director brings a wealth of IT and Information Security expertise from various roles in the technology industry.


text: The Audit Committee has recently been assigned responsibility for overseeing our cybersecurity, including assessment, prevention, detection, and remediation of cyber risks, threats and incidents. When incidents occur, depending on the nature and severity, the Audit Committee is notified, and incidents are further reviewed with the Audit Committee. Material cybersecurity matters will be reviewed with the full Board of Directors.


text: Management policies and procedures We recognize the need to protect our data, systems and technology. We have described related risks in Item 1A under the heading "Risks Related to our Technology and Data." We have previously assessed and periodically measure our security maturity using the US National Institute of Standards and Technology Cybersecurity Framework. ("NIST CSF") supported by other internal and third party assessments. Gaps or perceived weaknesses in our NIST CSF score are highlighted to our Cybersecurity Risk Committee and subsequently to the Board of Directors. A reassessment of our maturity using NIST CSF is being carried out in the early part of 2024. These assessments allow us to prioritize investment into those areas which provide the greatest improvement in the CSF scoring and by implication, our ability to identify, protect, detect, respond and recover from information and cybersecurity incidents. Risks are recorded in OneTrust and are formally assessed monthly, considering likelihood and potential impact and mitigating actions are implemented where possible to reduce identified risks. Controls designed to reduce or eliminate risk are designed into our technology, processes and management of third parties. We conduct regular vulnerability scanning and use a third party for regular penetration testing designed to help us identify new weaknesses or vulnerabilities. In addition, we use the same third party to help us conduct cybersecurity incident simulation which is subsequently used to inform updates to our Cybersecurity Incident Response Plan. We also have procedures designed to assess risks related to the use of third-party suppliers.

companyName: Soho House & Co Inc.


text: In the previous 12 months, we have not identified any risks from cybersecurity threats, including those from any previous cybersecurity incidents, that have materially affected us, our business strategy, results of operation or financial condition. For additional information about the cybersecurity risks we face, see the risk factors entitled, "A cybersecurity attack, 'data breach' or other security incident experienced by us or our third-party service providers may result in negative publicity, claims, investigations and litigation and adversely affect our business, results of operations and financial condition," and "If we fail to properly maintain the confidentiality and integrity of our data, including member and customer credit or debit card and bank account information and other PII, or if we fail to comply with applicable laws, rules, regulations, industry standards and contractual obligations relating to data privacy, protection and security, it may adversely affect our reputation, business and operations," in Item 1A Risk Factors.


text: We have implemented a governance program which facilitates senior management oversight of cybersecurity risk management. An operational risk group comprising senior SHCO Cyber Risk and third party Cyber Risk professionals together with the IT Infrastructure lead meet monthly to review emerging risks, progress with mitigation of identified risk and prioritization of risk reduction activities. The output from this group is shared quarterly with the Cyber Security Risk Committee ("CSRC") a Board Sub-Committee which comprises the Chief Executive Officer (CEO), Chief Financial Officer (CFO), Chief Technology Officer (CTO), Chief Legal Officer (CLO) and Director of Information Security. The CSRC is responsible for reviewing the top strategic cyber risks, progress against cyber maturity improvement and recommending funding and resource requirements. The CSRC reports twice per year to the Audit Committee and the Board. The CSRC is also the body that collectively assess materiality in the event of a cybersecurity incident and meets as required to assess materiality.


text: Management's role and relevant experience in assessing and managing cybersecurity The NIST CSF is used to assess cybersecurity maturity. An initial baseline assessment has been used to inform our Cybersecurity Strategy and periodic assessments are used to update the NIST CSF scoring. These assessments are carried out by an independent third party to provide appropriate objectivity and challenge. In addition, we are progressing towards certification to the international information security management standard - ISO 27001 and the related standard ISO 27701 for privacy information management. Execution of our cybersecurity strategy is overseen by our Director of Information Security who is a qualified CSIM, CISA and a Fellow of the UK Chartered Institute of Information Security and has over 30 years of experience in cyber security. The Director of Information Security provides the CTO with periodic updates and also chairs the Cyber Security Risk Committee which provides a forum for senior management to discuss cyber risk management in greater detail.


text: Cyber Risk Management and Strategy We have a process in place for assessing, identifying, and managing material risks from cybersecurity threats. This process is integrated into the Company's overall risk management framework, as overseen by the Company's Board of Directors.

companyName: CareMax, Inc.


text: We design and assess our program based on various cybersecurity frameworks, such as the National Institute of Standards & Technology. Our process includes overseeing and identifying risks from cybersecurity threats associated with the use of third-party service providers. The Company conducts security assessments of third-party providers before engagement and has established monitoring procedures in its effort to mitigate risks related to data breaches or other security incidents originating from third parties. The Company from time to time engages third-party consultants and legal advisors in evaluating and testing the Company's risk management framework and assessing and remediating certain potential cybersecurity incidents as appropriate.


text: For information regarding cybersecurity risks that may materially affect our Company, see "Risk Factors — Risks Related to Our Business and Industry — We are dependent on information technology and our systems and infrastructure face certain risks, including from cybersecurity breaches and data leakage — and — Security breaches, loss of data and other disruptions could compromise sensitive information related to our business or our patients or prevent us from accessing critical information and expose us to liability, which could adversely affect our business and our reputation." To date we have not identified any breaches from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition.


text: Given the increasing cybersecurity threats in the healthcare industry, there can be no assurance we will not experience business interruptions; data loss, ransom, misappropriation or corruption, theft, or misuse of proprietary data, patient or other personally identifiable information; or litigation, investigation, or regulatory action related to any of those, any of which could have a material adverse effect on our patient care, ability to admit patients and to bill and collect for services provided on a timely basis, financial position, and results of operations and could harm our business reputation. Accordingly, no matter how well our program is designed or implemented, we will not be able to anticipate all security breaches, and we may not be able to implement effective preventive measures against such security breaches in a timely manner.


text: Governance Related to Cybersecurity Risks Management is responsible for the day-to-day management of cybersecurity risks we face, while our Board of Directors has responsibility for the oversight of risk management. The Audit Committee of our Board of Directors oversees the management of our risks from cybersecurity threats. In addition, the Board of Directors discusses with management our major risk exposures, their potential impact on us, and the steps we take to manage them.


text: Our Vice President of Information Technology is responsible for developing, implementing, and maintaining our cybersecurity risk management policies and procedures. The Vice President of Information Technology has over twenty years of information technology management experience. The Vice President of Information Technology and his team hold regular meetings focused on prevention and detection of cybersecurity threats, business continuity and identity protection.


text: The Vice President of Information Technology reports to our Chief Digital Officer and provides semi-annual cybersecurity updates to the Audit Committee of our Board of Directors. In the event of the detection of an actual or suspected cybersecurity incident, a designated management committee is engaged to investigate the incident, manage response, and report the incident to securities counsel to assist with assessment of materiality. A member of the executive team would inform our Board of Directors as warranted.


text: Cybersecurity Risk Management and Strategy In an effort to protect our business from cybersecurity threats, we maintain and utilize various tools and processes that are designed to identify, assess, and manage cybersecurity risks. Our cybersecurity risk management program, which is in process of being integrated into our enterprise risk management program, is based on the National Institute of Standards and Technology (NIST) Cybersecurity Framework. Our cybersecurity risk management program focuses on monitoring the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents.

companyName: Tango Therapeutics, Inc.

ticker: TNGX


text: There are a number of components of our risk management program. We leverage external third parties for security testing on an annual basis, including penetration testing. We consistently monitor critical risks from cybersecurity threats using automated tools and have a process to implement mitigation plans. Our Security Committee, headed by the Head of IT and Chief Legal Counsel, assess and monitor any identified security incidents that impact us or our external partners. Furthermore, we assess and review the cybersecurity practices of third parties who have access to our systems and/or process our sensitive information. This assessment may involve requesting Systems and Organization Controls Type 2 reports (SOC2 reports), conversations with our Head of IT, and the inclusion of contractual requirements to maintain data protection safeguards and timely notification if the third party experiences a security incident which may have a critical impact on our business or our data. Additionally, we conduct cybersecurity awareness training for employees during onboarding and throughout the year, and we conduct regular phishing simulations in an effort to raise awareness of spoofed or manipulated electronic communications and other cybersecurity threats.


text: We face a number of cybersecurity risks in connection with our business. Although such risks have not materially affected us, and we do not believe they are reasonably likely to materially affect us, our business strategy, results of operations or financial condition, we could from time to time, experience threats to and security incidents related to our third-party vendors' information systems. For more information about the cybersecurity risks we face, see the risk factor entitled "We may be unable to adequately protect our information technology systems from cyberattacks, cyber intrusions or otherwise which could result in damage to our information technology systems and unauthorized disclosure or use of confidential or proprietary information, including personal data" in Item 1A- Risk Factors.


text: Cybersecurity Governance Our Board of Directors has delegated responsibility for overseeing our policies, practices and assessments with respect to cybersecurity and other information technology risks to the Audit Committee. Our Head of IT, under the supervision of our Chief Financial Officer, is responsible for the establishment and maintenance of our cybersecurity risk management program, including the day-to-day oversight of the assessment and management of cybersecurity risks. The Head of IT will regularly consult with outside security experts and management to evaluate certain aspects of the cybersecurity risk management program. The Head of IT has approximately 15 years of experience in information security and cybersecurity risk management. The IT team also institutes and maintains controls for our systems, applications, and databases.


text: The Head of IT reports on the status of our cybersecurity risk management program to management and our Audit Committee on a periodic basis, which may include a discussion of the results of our annual third party cybersecurity risk assessments and critical updates to our mitigation and remediation efforts.


text: As an externally-managed company, our day-to-day operations are managed by our Adviser and our executive officers under the oversight of our board of directors. Our executive officers are senior professionals of our Adviser and our Adviser is a subsidiary of J.P. Morgan. As such, we are reliant on J.P. Morgan for assessing, identifying and managing material risks to our business from cybersecurity threats.

companyName: J.P. Morgan Real Estate Income Trust, Inc.


text: Cybersecurity risk is an important and continuously evolving focus for us, the Adviser, J.P. Morgan, and its affiliates. Significant resources are devoted to protecting and enhancing the security of computer systems, software, networks, storage devices, and other technology. The Adviser's security efforts are designed to protect against, among other things, cybersecurity attacks by unauthorized parties attempting to obtain access to confidential information, destroy data, disrupt or degrade service, sabotage systems or cause other damage.


text: The Adviser, J.P. Morgan, and its affiliates have experienced, and expect to continue to experience, a higher volume and complexity of cyber-attacks against the backdrop of heightened geopolitical tensions. The Adviser leverages J.P. Morgan's Global Technology's Cybersecurity and Technology Control ("CTC") Function, which is responsible for the governance and oversight of J.P. Morgan's cybersecurity program. In partnership with J.P. Morgan's lines of business, the CTC organization identifies information security risk issues and champions programs for the technological protection of J.P. Morgan's information resources, including applications, infrastructure and confidential information related to the firm's clients. J.P. Morgan has implemented measures and controls reasonably designed to address this increased risk, such as enhanced threat monitoring. There can be no assurance that the measures taken by us, the Adviser, J.P. Morgan and its affiliates will be successful in defending against cyber-attacks.


text: The Adviser closely collaborates with J.P. Morgan to understand the full spectrum of cybersecurity risks in the operating environment, enhance defenses and improve resiliency. J.P. Morgan actively participates in discussions and simulations of cybersecurity risks internally and administers ongoing initiatives to educate its employees on cybersecurity risks.


text: Third parties with which we, the Adviser, J.P. Morgan and its affiliates do business or that facilitate our, the Adviser's, J.P. Morgan's, and its affiliates' business activities (e.g., vendors, supply chain, exchanges, clearing houses, central depositories, and financial intermediaries) are also sources of cybersecurity risk to us. Third-party incidents such as system breakdowns or failures, misconduct by the employees of such parties, or cyber-attacks, including ransomware and supply-chain compromises, could affect a third party's ability to deliver a product or service to us or the Adviser, or result in losing or compromising our or our stockholders', clients' and customers' information. Stockholders, clients and customers are also sources of cybersecurity risk to us and our information assets, particularly when their activities and systems are beyond our, the Adviser's, J.P. Morgan's, and its affiliates' security and control systems. However, where cybersecurity incidents occur because of stockholder, client or customer failures to maintain the security of their own systems and processes, they are responsible for losses incurred. J.P. Morgan engages in periodic discussions with external parties concerning cybersecurity risks including opportunities to improve cybersecurity.


text: We believe that risks from cybersecurity incidents have not materially affected or are not reasonably likely to materially affect us or our business strategy, results of operations or financial condition.


text: Organization and Management To help safeguard the confidentiality, integrity and availability of our infrastructure, resources and information, J.P. Morgan maintains an Information Security Program designed to prevent, detect and respond to cyberattacks. In addition, the Adviser leverages J.P. Morgan's cybersecurity incident response plan ("IRP"), which is designed to enable us, the Adviser and its affiliates to respond to attempted cybersecurity incidents, coordinate such responses with law enforcement and other government agencies, and notify stockholders, clients, and customers, as applicable.


text: The Global Chief Information Security Officer ("CISO") is responsible for J.P. Morgan's Information Security Program, which includes managing its global cybersecurity operations centers, providing training, conducting cybersecurity event simulation exercises, overseeing its policies and standards relating to information technology risk and security management, and enhancing, as needed, its information security capabilities. The CISO reports to the Global Chief Information Officer and is a member of key cybersecurity governance forums. The CISO leads the Global Cybersecurity and Technology Controls organization, which is responsible for identifying technology and cybersecurity risks and for implementing and maintaining controls to manage cybersecurity threats. The CISO is responsible for J.P. Morgan's Information Security Program, which is designed to prevent, detect and respond to cyber-attacks to help safeguard the confidentiality, integrity and availability of J.P. Morgan's infrastructure, resources and information. The program includes managing J.P. Morgan's global cybersecurity operations centers, providing training, conducting cybersecurity event simulation exercises, implementing J.P. Morgan's policies and standards relating to technology risk and cybersecurity management, and enhancing, as needed, J.P. Morgan's cybersecurity capabilities.


text: J.P. Morgan's board of directors oversees the Information Security Program (the "Program") and a robust governance structure is designed to monitor, report, and escalate the status of information and cybersecurity risks. This structure uses key governance forums to disseminate management information and monitor Program efforts including through the use of key metrics. Established at multiple levels throughout J.P. Morgan, these forums include representatives from each line of business and relevant corporate functions including independent risk management and internal audit. The audit committee of J.P. Morgan's board of directors reviews and approves the Program.


text: Oversight of Global Technology. including J.P. Morgan's technology risk framework, comes from the Chief Information Officer and the Global Technology Operating Committee.


text: J.P. Morgan's Information Security Program includes the following functions: • Cyber Operations, which is responsible for implementing and maintaining controls designed to detect and defend us, the Adviser, J.P. Morgan, and its affiliates against cyberattacks, and includes a dedicated function that monitors for cybersecurity threats and vulnerabilities among our, the Adviser, J.P. Morgan and its affiliates third-party suppliers. • Technology Governance, Risk & Controls, which is responsible for delivering and operationalizing key risk and control frameworks, regulatory discovery, control catalogs and assessments of controls, as well as overseeing governance and reporting of technology and cybersecurity risk. • Enterprise Product and Line of Business Security, which oversees the cybersecurity and technology controls for business products and applications. • Assurance & Enterprise Architecture, which oversees the effectiveness of technology used in connection with cybersecurity controls, data and programs.


text: J.P. Morgan's Security Awareness Program includes training that reinforces compliance with its policies, standards and practices relating to information technology risk and security management. The Security Awareness Program engages personnel through training on how to identify potential cybersecurity risks and protects our, the Adviser's, J.P. Morgan's and its affiliates' resources and information. This training is mandatory for all employees globally on a periodic basis, and it is supplemented by testing initiatives, including periodic phishing tests. Finally, J.P. Morgan's Global Privacy Program requires all employees to take periodic awareness training on data privacy. This privacy-focused training includes information about confidentiality and security, as well as responding to unauthorized access to or use of information.


text: Governance and Oversight The governance structure for the Global Cybersecurity and Technology Controls organization is designed to appropriately identify, escalate and mitigate information security risks, including through the use of key governance forums that inform management concerning the prevention, detection, mitigation and remediation of cybersecurity incidents.


text: The Cybersecurity and Technology Controls Operating Committee ("CTOC") is the principal management committee that oversees J.P. Morgan's assessment and management of cybersecurity risk, including oversight of the implementation and maintenance of appropriate controls in support of J.P. Morgan's Information Security Program. The membership of the CTOC includes representatives from the Global Cybersecurity and Technology Controls organization and relevant corporate functions, including Independent Risk Management ("IRM") and Internal Audit. The CTOC includes members of J.P. Morgan management that have extensive experience in various technology and information security disciplines, including relevant employment in financial services and other highly regulated industries.


text: The CTOC is responsible for the governance of the firmwide Global Technology organization, including oversight of firmwide technology strategies, the delivery of technology and technology operations, the effective use of information technology resources, and monitoring and resolving key operational risk and control matters arising in the Global Technology organization. The CTOC escalates key operational risk and control issues, as appropriate, to the GTOC or its business controls committee.


text: Cybersecurity risk management and its governance are integrated into J.P. Morgan's operational risk management framework, including through the escalation of key risk and control issues to our Company's management team and our board of directors. In addition, the Adviser works with J.P. Morgan to assess and challenge activities and risk management practices relating to the identification, assessment, measurement and mitigation of cybersecurity risk.


text: As needed, the Adviser collaborates with J.P. Morgan to engage third-party assessors or auditing firms with industry-recognized expertise on cybersecurity matters to review specific aspects of its cybersecurity risk management framework, processes and controls.


text: As part of its oversight of its risk management framework J.P. Morgan's Cybersecurity Team provides our board of directors with periodic updates concerning cybersecurity risk matters. These updates generally include information regarding cybersecurity and technology developments, J.P. Morgan's Information Security Program and recommended changes to that program, cybersecurity policies and practices, and ongoing initiatives to improve information security, as well as any significant cybersecurity incidents and the Adviser's and J.P. Morgan's efforts to address those incidents. Our audit committee assists our board of directors in this oversight.


text: We take a comprehensive approach to cybersecurity and prioritize the security and integrity of our data, including those of our customers and other stakeholders, as a top priority. Our board of directors (in particular our audit committee) and our management are actively involved in the oversight of our risk management program, of which cybersecurity represents an important component. As described in more detail below, we have established policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats. We have devoted significant resources to implement and maintain security measures to meet regulatory requirements and stakeholder expectations, and we intend to continue to make appropriate investments to maintain the security and integrity of our data. There can be no guarantee that our established policies, standards, processes and practices will be properly followed in every instance or that they will be effective at mitigating all cybersecurity threats. Although our risk factors include further detail about the material cybersecurity risks we face, we believe that risks from cybersecurity threats, have not materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business, results of operations, or financial condition.

companyName: SmartStop Self Storage REIT, Inc.

ticker: SMA


text: Risk Management and Strategy Our policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats are integrated into our overall risk management process and are based on frameworks established by the National Institute of Standards and Technology ("NIST"), the International Organization for Standardization and other applicable industry standards and best practices. Our cybersecurity program in particular focuses on the following key areas: Collaboration


text: Our cybersecurity risks are identified and addressed through a comprehensive, cross-functional approach. Key security, risk, and compliance stakeholders meet regularly to develop strategies for preserving the confidentiality, integrity and availability of Company and customer information, identifying, preventing and mitigating cybersecurity threats. We maintain controls and procedures that are designed to ensure prompt escalation of certain cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can be made by management and our board of directors in a timely manner.


text: At least annually, we conduct a cybersecurity risk assessment that takes into account information from internal stakeholders, known security vulnerabilities, and other external sources (e.g., reported security incidents that have impacted other companies, industry trends, and evaluations by third parties and consultants). The results of the assessment are used to drive alignment on, and prioritization of, initiatives to enhance our security controls, make recommendations to improve processes, and updates are presented to our board of directors and members of management, as appropriate.


text: Technical Safeguards We regularly assess and deploy technical safeguards designed to protect our information systems from cybersecurity threats. Such safeguards are regularly evaluated and improved based on vulnerability assessments, cybersecurity threat intelligence and other developing cybersecurity practices.


text: Incident Response and Recovery Planning We have established comprehensive incident response and recovery plans and continue to evaluate the effectiveness of those plans. Our incident response and recovery plans address and guide our response to a cybersecurity incident.


text: Third-Party Risk Management We have implemented processes designed to identify and mitigate cybersecurity threats associated with our use of third-party service providers. Such providers are subject to security risk assessments at the time of onboarding, contract renewal, and upon detection of an increase in risk profile. We use a variety of inputs in our risk assessments, including information supplied by providers and third parties. In addition, we require our providers to meet appropriate security requirements, controls and responsibilities and investigate security incidents that have impacted our third-party providers, as appropriate.


text: Education and Awareness We regularly remind employees of the importance of handling and protecting customer and employee data, including through annual certifications of our policies as well as periodic security training to enhance employee awareness of how to detect and respond to cybersecurity threats.


text: Risk Management and Strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and personal health information (including clinical trial data) ("Information Systems and Data").

companyName: SPRUCE BIOSCIENCES, INC.

ticker: SPRB


text: Our information technology function, which is led by Samir Gharib, our President, Chief Financial Officer, and Chief Compliance Officer, helps identify, assess and manage the Company's cybersecurity threats and risks. Our information technology function works to identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile using various methods including, employing both automated and manual tools and controls; conducting threat and vulnerability assessments; utilizing third-party services to monitor our information technology infrastructure; and performing internal audits.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: risk assessments, incident detection and response policies, network security controls for certain systems (including as applicable data segregation, data encryption, access controls, physical security, and systems threat monitoring), disaster recovery and business continuity plans, vendor risk management program, and dedicated cybersecurity staff and employee training.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, cybersecurity risk is addressed as a component of the Company's enterprise risk management program and the information technology function works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business. Additionally, Mr. Gharib and the audit committee of the board of directors evaluate material risks from cybersecurity threats against our overall business objectives and reports to the board of directors, which evaluates our overall enterprise risk.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example cybersecurity software providers and managed cybersecurity service providers.


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, contract research organizations, contract manufacturing organizations, and supply chain providers. We have a vendor management program to manage cybersecurity risks associated with our use of service providers. The program includes, as applicable, risk assessment for certain vendors, security questionnaires, review of certain vendors' security programs and security assessments, and imposition of cybersecurity-related contractual obligations for some vendors. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and we may impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the sections titled "Risk Factors— If our information technology systems or data, or those of third parties upon which we rely, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; and other adverse consequences" and "Risk Factors— We are subject to stringent and evolving obligations related to data privacy and security. These obligations include U.S. and foreign laws, regulations, and rules; contractual obligations; industry standards; and policies. Our actual or perceived failure to comply with such obligations could lead to regulatory investigations and actions (which could include civil or criminal penalties); private litigation, (including class-action claims) and mass arbitration demands; disruptions to our business operations; adverse publicity; and other adverse consequences that could negatively affect our operating results and business."


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The audit committee of the board of directors is responsible for overseeing Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including Mr. Gharib, who oversees enterprise risk management and information security for the Company.


text: Mr. Gharib is responsible for hiring information security personnel, integrating cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Mr. Gharib is also responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our incident response and vulnerability management processes and policies are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including Mr. Gharib and the Chief Executive Officer. Mr. Gharib works with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response and vulnerability management processes and policies include reporting to the audit committee of the board of directors for certain cybersecurity incidents.


text: The audit committee receives periodic reports from Mr. Gharib concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The audit committee also receives various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: Risk Management and Strategy We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. In collaboration with our external vendors specializing in cybersecurity management, we routinely assess material risks from cybersecurity threats, including any potential unauthorized access to our information systems that could result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: Tenaya Therapeutics, Inc.

ticker: TNYA


text: We conduct periodic risk assessments to identify cybersecurity threats, as well as assessments of planned material changes in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. In consideration of the size and complexity of our business, we devote appropriate internal and external resources to manage material risks from cybersecurity threats. We also designate senior-level personnel, including our Vice President, Information Technology who reports to our Chief Financial and Business Officer, to manage the risk assessment and mitigation process and to closely coordinate with our General Counsel on applicable regulatory obligations.


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards. Personnel at all levels and departments are made aware of our cybersecurity policies through required policy review and trainings at the time of hire and periodically during their employment with us.


text: We engage consultants, auditors, or other third parties in connection with our risk assessment processes. These professionals assist us in the design and implementation of our cybersecurity policies and procedures, as well as to monitor and test our safeguards. In addition, in order to mitigate cybersecurity risks associated with our use of third-party service providers, we require certain third-party service providers to certify that they have the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company.


text: For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K, including the risk factors entitled "Our computer systems, or those of any of our CROs, manufacturers, contractors, consultants or other third parties or potential future collaborators, may fail or suffer security incidents or data privacy breaches or other unauthorized or improper access to, use of, or destruction of our proprietary or confidential data, employee data, or personal data, which could result in additional costs, loss of revenue, significant liabilities, harm to our brand and material disruption of our operations."


text: One of the key functions of our board of directors (our "Board") is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board administers its cybersecurity risk oversight function directly as a whole, as well as through the Audit Committee.


text: Our Vice President, Information Technology, along with the members of our Incident Response Team, which includes our Chief Financial and Business Officer and our General Counsel, are primarily responsible to assess and manage our material risks from cybersecurity threats. Our Incident Response Team is supported by an experienced managed service provider and an incident response provider with extensive global cybersecurity expertise, who both monitor, assess and report threats to us. Additionally, our Vice President, Information Technology has over twenty years of experience operating in the information technology, security and cybersecurity space. In particular, he has experience with cybersecurity assessment and prevention, incident responses, breach notifications and remediation.


text: Our Vice President, Information Technology oversees our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above and, along with and informed by the Information Technology organization and our Incident Response Team, monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents. Depending on the severity of the security incident, the Incident Response Team will report the security incident to our Audit Committee, including the financial impact of the security incident and any regulatory violations. As our Information Technology organization monitors the security and effectiveness of our policies and procedures, they also work to keep the Vice President, Information Technology and other members of leadership informed of critical incidents, process updates, or other material details, in accordance with our internal reporting structure.


text: Our Vice President, Information Technology provides an annual briefing to the Audit Committee regarding our company's cybersecurity risks and activities, including the status of cybersecurity system development, company-wide cybersecurity training programs, material changes to the cybersecurity system, policies or practices, any recent cybersecurity incidents and related responses, cybersecurity systems testing and engagement of third-party service providers in support of our cybersecurity system. Special meetings may also be called with the Audit Committee to brief the members on any material cybersecurity incidents and related responses thereto. Subsequent to such briefings, our Audit Committee will provide an update to the Board on such reports. In addition, the Board will receive periodic updates in meeting materials or directly from our Chief Financial and Business Officer on cybersecurity risks and activities.


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of our risk management program, including cybersecurity and other information technology risks. The Audit Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential. The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity.

companyName: Singular Genomics Systems, Inc.


text: Our management team, including each of our Chief Financial Officer, Head of IT and General Counsel, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises our internal cybersecurity personnel. Our management team's cumulative experience includes many years of experience managing cybersecurity risks including serving in similar roles leading and overseeing cybersecurity programs at other companies.


text: Our management team supervises efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants; and alerts and reports produced by security tools deployed in the information technology environment.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan. We design and assess our program based on the Center for Internet Security ("CIS") Controls. While this does not imply that we meet any particular technical standards, specifications or requirements, we use the CIS Controls framework as a guide to help us identify, assess and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, operational and financial risk areas. Our cybersecurity risk management program includes: (i) risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services and our broader enterprise information technology environment; (ii) full-time internal subject matter experts and a service desk with extensive security knowledge and skill responsible for managing our cybersecurity risk assessment processes, our security controls and our response to cybersecurity incidents; (iii) the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; (iv) cybersecurity awareness training of our employees; and (v) a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.


text: We have implemented and maintain processes designed to identify, assess and manage material risks from cybersecurity threats to our computer networks, third party hosted services, communications systems, hardware and software, and our data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and personal information of employees and others ("Information Systems and Data").

companyName: Forte Biosciences, Inc.

ticker: FBRX


text: Our information technology consultants help identify, assess and manage the Company's cybersecurity threats and risks. Our information technology consultants identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example: manual and automated cybersecurity tools such as malware scans and; vulnerability testing.


text: Depending on the environment, we implement and maintain technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate risks from cybersecurity threats to our Information Systems and Data, including, for example: employee training; access controls; data encryption; systems monitoring; regular patching of operating systems and software; and a password policy.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, our information technology consultants work with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.


text: We use third-party service providers to perform a variety of functions throughout our business, such as electronic communications service providers, cloud-based file storage service providers, and contract manufacturing and research organizations.


text: We evaluate the cybersecurity posture of such third-party service providers, including whether such providers maintain appropriate security measures and, where appropriate, require them to implement and maintain reasonable security measures in connection with their work with us. Our Board, as a whole and at the committee level, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate those risks. The Audit Committee, which is comprised solely of independent directors, has been designated by our Board to oversee cybersecurity risks. The Audit Committee receives updates, as needed, on cybersecurity and information technology matters and related risk exposures from our Chief Financial Officer as well as other members of the senior leadership team. The Board also receives updates from management and the Audit Committee on cybersecurity risks. For additional information regarding whether any risks from cybersecurity threats are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors" in this Annual Report on Form 10-K.


text: We recognize the critical importance of maintaining the trust and confidence of patients, business partners and employees toward our business and are committed to protecting the confidentiality, integrity and availability of our business operations and systems. Our board of directors is actively involved in oversight of our risk management activities, and cybersecurity represents an important element of our overall approach to risk management. In general, we seek to address cybersecurity risks through a cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: SYNLOGIC, INC.

ticker: SYBX


text: Cybersecurity Risk Management and Strategy; Effect of Risk We face risks related to cybersecurity such as unauthorized access, cybersecurity attacks and other security incidents, including as perpetrated by hackers and unintentional damage or disruption to hardware and software systems, loss of data, and misappropriation of confidential information. To identify and assess material risks from cybersecurity threats, we maintain a comprehensive cybersecurity program and work with a third party managed service provider to ensure our systems are effective and prepared for information security risks, including regular oversight of our programs for security monitoring for internal and external threats to ensure the confidentiality and integrity of our information assets. We consider risks from cybersecurity threats alongside other company risks as part of our overall risk assessment process. We and our third-party partners employ a range of tools and services, including regular network and endpoint monitoring and protection, audits, vulnerability assessments, and penetration testing, to inform our risk identification and assessment. As discussed in more detail under "Cybersecurity Governance" below, our audit committee provides oversight of our cybersecurity risk management and strategy processes, which are led by our Chief Operating Officer.


text: We also identify our cybersecurity threat risks by using the services of a managed services provider. To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and protect against and respond to cybersecurity incidents, we undertake the following activities: • monitor as appropriate emerging data protection laws and industry literature and implement changes to our processes that are designed to comply with such laws if needed; • through our policies, practices and contracts (as applicable), require employees, as well as third parties that provide services on our behalf, to treat confidential information and data with care; • employ technical safeguards that are designed to protect our information systems from cybersecurity threats, including redundant firewalls, intrusion prevention and detection systems, multi-factor authentication, encryption, anti-malware functionality and access controls; • provide annual and routine mandatory training utilizing Knowbe4 (leading security awareness training module) for our employees and contractors regarding cybersecurity threats as a means to equip them with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices; • conduct phishing email simulations for employees and contractors with access to our email systems to enhance awareness and responsiveness to possible threats; • utilize a managed services provider to help us identify, protect, detect, respond and recover when there is an actual or potential cybersecurity incident; and • carry information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident Our incident response plan coordinates the activities we, in concert with our third party managed services provider, take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate damage to our business and reputation.


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including our suppliers and manufacturers or who have access to patient and employee data or our systems. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, including through vendor security questionnaires as appropriate.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Our internal computer systems, or those of our collaborators or other contractors or consultants, may fail or suffer cybersecurity incidents, which could result in a material disruption of our product development programs," which disclosures are incorporated by reference herein. In the last three fiscal years, we have not experienced any material cybersecurity incidents.


text: Cybersecurity Governance; Management Cybersecurity is an important part of our risk management processes and an area of focus for our board of directors and management. Our board of directors executes its oversight responsibility for risk management both directly and through delegating oversight of certain of these risks to its committees, and our board of directors has authorized our audit committee to oversee risks from cybersecurity threats.


text: At least annually and on a periodic basis, our audit committee receives an update from management on our cybersecurity threat risk management and strategy processes and generally receives materials on our ability to mitigate current and emerging risks, and discusses such matters with our Chief Operating Officer. Our processes require that our audit committee is designated to receive prompt and timely information regarding any cybersecurity incident that meets establishing reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Chief Operating Officer. This individual has over twenty years of prior work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs. The Chief Operating Officer, along with the Company's managed services provider, are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. As discussed above, the Chief Operating Officer reports to the audit committee of our board of directors about cybersecurity threat risks, among other cybersecurity related matters, at least annually.


text: Cybersecurity Risk Management and Strategy We have certain processes for assessing, identifying and managing cybersecurity risks, which are built into our overall information technology function and are designed to help protect our information assets and operations from internal and external cyber threats, and protect employee, collaborator and patient information from unauthorized access or attack, as well as secure our networks and systems. Such processes include physical, procedural and technical safeguards and routine review of our policies and procedures to identify risks and refine our practices. We consider the internal risk oversight programs of third-party service providers before engaging them in order to help protect us from any related vulnerabilities.

companyName: Coya Therapeutics, Inc.

ticker: COYA


text: We do not believe that there are currently any known risks from cybersecurity threats that have affected, or are reasonably likely to materially affect, us or our business strategy, results of operations or financial condition.


text: Governance; Board Oversight The Audit Committee of our Board provides direct oversight over cybersecurity risk, and provides updates to the Board of Directors regarding such oversight, when and if appropriate. Management provides periodic updates to the Audit Committee regarding cybersecurity matters including significant new cybersecurity threats or incidents, when and if appropriate. We use technology-based tools that are designed to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs.


text: The Company's cybersecurity program is integrated within its overall risk management function. The Company engages third parties, including an outsourced cybersecurity team and additional vendors that conduct cybersecurity testing. All critical vendors of the Company, including its cybersecurity vendors, are subject to the requirements of its vendor management policy and processes. The Company is a regulated entity and undergoes regulatory reviews to ensure the Bank remains in compliance with all appropriate standards, including related to its management of third-party vendors.

companyName: Ponce Financial Group, Inc.

ticker: PDLB


text: Internally, the cybersecurity program is managed by the Company's Senior Vice President, Chief Information Security Officer and Chief Information Officer. She has held senior management positions in information technology, management information systems and information security for over 30 years. She reports regularly to the risk and audit committees of the Board of Directors about the prevention, detection, mitigation, and remediation of cybersecurity incidents. Additionally, the full board annually assesses all critical risks of the Company, including cybersecurity risks, and also receives periodic updates relating to key cybersecurity issues as part of their oversight.


text: The Company's Senior Vice President and Chief Information Systems Officer also regularly reports to the Company's executive risk management ("ERM") committee, which oversees Company-wide risk at the management level, regarding cybersecurity risks. Members of the ERM committee include our President and Chief Executive Officer.


text: While to date, we have not had a major cyber incident, nor experienced significant data loss or any material financial losses related to cybersecurity attacks, it is possible that we could experience a significant event in the future. Risks and exposures related to cybersecurity attacks are expected to remain high for the foreseeable future due to the rapidly evolving nature and sophistication of these threats. See Item 1A. "Risk Factors." – "We face significant operational risks because the financial services business involves a high volume of transactions and increased reliance on technology, including risk of loss related to cyber security breaches. " for further discussion of potential risks related to cybersecurity incidents.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. We implement reasonable administrative, technical and procedural safeguards to manage cybersecurity risks, including enforcing single sign-on or multi-factor authentication where supported or appropriate. We engage third-party cybersecurity experts to assess the security of our network. In addition, we engage a third-party to perform internal audits of our IT General Controls (ITGCs).

companyName: Tyra Biosciences, Inc.

ticker: TYRA


text: Our cybersecurity risk management program is designed to be integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Cybersecurity Governance Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to the audit committee (the Committee) oversight of cybersecurity risks. The Committee oversees management's implementation of our cybersecurity risk management program.


text: The Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the Committee, as necessary or appropriate, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Committee reports to the full board of directors regarding its activities, including those related to cybersecurity. The full board of directors may also receive briefings from management on our cyber risk management program. Board members may receive presentations on cybersecurity topics from our Chief Financial Officer (CFO), internal security staff or external experts as part of the board of director's continuing education on topics that impact public companies. Members of our management team, including our CFO, General Counsel, Vice President of Finance, Vice President of Quality, and IT Senior Director, are responsible for assessing and managing our material risks from cybersecurity threats. This cybersecurity management team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. This team includes individuals with significant experience running or overseeing cybersecurity programs at similarly sized biotechnology organizations and navigating the associated risk landscape.


text: Our cybersecurity management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology environment.


text: Cyber Risk Management and Strategy The Company relies on electronic systems and information technologies to conduct its operations. We have adopted and maintain a cybersecurity risk management program, in accordance with our risk profile and business, that is informed by industry standards.

companyName: Adicet Bio, Inc.

ticker: ACET


text: We leverage the support of third-party information technology and security providers, including to perform penetration testing and threat intelligence analysis. We have previously conducted a cybersecurity risk assessment that was intended to take into account the evolving cyber threat landscape and industry best practices, and we have endeavored to adapt our cyber risk strategy to mitigate emerging cybersecurity risks. We implement a multi-layered approach to cybersecurity that includes, for example, employee security awareness training, various security tools and technologies, and incident response planning.


text: Although risks from cybersecurity threats have to date not materially affected, and we do not believe they are reasonably likely to materially affect, us, our business strategy, results of operations or financial condition, we could, from time to time, experience threats and security incidents relating to our, and our third party vendors', information systems. For more information, please see the section entitled "Risk Factors" in this Annual Report on Form 10-K.


text: Governance Related to Cybersecurity Risks Our Senior Director of Information Technology ("IT") reports directly to our Chief Financial Officer and is responsible for the strategic leadership and direction of our cybersecurity program, with support from our Associate Director of Information Security and Senior Manager of IT. With over 20 years of experience in IT and cybersecurity risk management, our Senior Director of IT works alongside individuals across other Company management functions to establish and implement our cybersecurity risk management strategy.


text: Our audit committee, which reports directly to the board of directors, is responsible for overseeing our cybersecurity risk management program pursuant to the audit committee's charter. The audit committee receives periodic updates on cybersecurity risks, mitigation strategies, and, if necessary, incident response activities from our Senior Director of IT. The audit committee may update the full board of directors on matters relating to cybersecurity risk management as needed.


text: Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and clinical trial data, or Information Systems and Data.

companyName: Taysha Gene Therapies, Inc.

ticker: TSHA


text: Our information technology team, led by our Vice President of Engineering and Operations, helps identify, assess, and manage our cybersecurity threats and risks. Our information technology team assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example analyzing threat reports, conducting audits, and using intelligence feeds.


text: Depending on the environment and systems, we implement and maintain various technical, physical, and organizational measures, processes, standards, and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident detection and response, employee training, access controls, cyber insurance, and systems monitoring.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, our senior management along with our information technology team evaluates material risks from cybersecurity threats against our overall business objectives and reports to the Audit Committee of the board of directors, which evaluates our overall enterprise risk.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example cybersecurity software providers, managed cybersecurity service providers, and dark web monitoring services.


text: We use third-party service providers to perform a variety of functions throughout our business, such as contract research organizations, contract manufacturing organizations, and hosting companies. We have a vendor management process to manage cybersecurity risks associated with our use of these providers which includes risk assessments and audits. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider.


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "If our, or our vendors', information technology systems or data is or were compromised, we could experience adverse consequences resulting from such compromise, including, but not limited to regulatory investigations or action; litigation; fines and penalties; interruptions to our operations such as our clinical trials; claims that we breached our data privacy and security laws; harm to our reputation; a loss of customers or sales; and other adverse consequences."


text: Our cybersecurity risk assessment and management processes are implemented by certain Company management, including our Compliance Officer and Vice President of Engineering and Operations, both of whom have previously served in management roles at other public biotechnology companies.


text: Company management is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. Company management is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response plan is designed to escalate certain cybersecurity incidents to members of our legal team depending on the circumstances. Our information technology team works with our incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response plan includes reporting to the Audit Committee of the board of directors for certain cybersecurity incidents.


text: Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property and confidential information that is proprietary, strategic or competitive in nature (Information Systems and Data). Our Chief Operating Officer and our General Counsel help identify, assess and manage our material risks from cybersecurity threats. Along with our Chief Operating Officer and our General Counsel, a third-party information technology strategy and risk reduction vendor helps identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods including, for example, manual tools, automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting scans of the threat environment, evaluating our and our industry's risk profile, evaluating threats reported to us, internal audits, conducting threat assessments for internal and external threats, conducting vulnerability assessments to identify vulnerabilities, use of external intelligence feeds and coordinating with law enforcement as appropriate about certain threats.

companyName: Design Therapeutics, Inc.

ticker: DSGN


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident detection and response procedures; an incident response policy; a vulnerability management policy; conducting risk assessments; encrypting certain of our data; maintaining network security controls; segmenting certain of our data; maintaining access and physical security controls; asset management, tracking, and disposal protocols; systems monitoring; vendor risk management processes; employee training; maintaining cybersecurity insurance; and retaining a third party information technology strategy and risk reduction vendor.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, cybersecurity risk is addressed as a component of our enterprise risk management program; our Chief Operating Officer and General Counsel work with management to prioritize our risk management processes and mitigate cybersecurity threats that are expected to be more likely to lead to a material impact to our business; our Chief Operating Officer and General Counsel evaluate material risks from cybersecurity threats against our overall business objectives and our Chief Operating Officer reports to the audit committee of the board of directors, which evaluates our overall enterprise risk.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example, professional services firms (including outside legal counsel), threat intelligence service providers, cybersecurity consultants, cybersecurity software providers, managed cybersecurity service providers, and dark web monitoring services.


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting services, contract research organizations and contract manufacturing organizations. We have vendor management processes to identify and oversee cybersecurity risks associated with the use of our providers. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, these processes may include a risk assessment of the vendor, security questionnaire, security assessments, security assessment calls with the vendor's security personnel and imposition of contractual obligations on the vendor.


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part I. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "Our information technology systems or sensitive data, or those of our third-party CROs or other contractors or consultants, may fail or suffer security incidents, loss or leakage of data, and other disruptions, which could result in a material disruption of our product candidates' development programs, compromise sensitive data related to our business or prevent us from accessing critical information, potentially exposing us to liability or otherwise adversely affecting our business."


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing our cybersecurity risk management processes.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain of our management, including our Chief Operating Officer and our General Counsel. Our Chief Operating Officer has been responsible for the oversight of our cybersecurity since he joined our company in May 2019. He has a B.A. in Computer Science. Our General Counsel has oversight of our legal department, has prior experience serving as inside and outside corporate counsel to technology and cybersecurity companies and a highly regulated cancer diagnostics company.


text: Our cybersecurity incident response and vulnerability management processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our Chief Operating Officer and our General Counsel. Our Chief Operating Officer and our General Counsel will work with our incident response team to help us mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response processes include reporting to the audit committee of the board of directors for certain cybersecurity incidents.


text: The audit committee receives periodic reports from our Chief Operating Officer concerning our significant cybersecurity threats and risk and the processes we have implemented to address them. The audit committee also receives and has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.