text: To reinforce our commitment to cybersecurity, we engage in regular third-party assessments and testing to validate and strengthen our defenses. Independent experts review our incident response and disaster recovery plans, evaluating our capacity to respond to cyber incidents and restore business continuity under adverse conditions. We further enhance our security posture by commissioning robust internal and external penetration tests conducted by third-party providers. These assessments rigorously evaluate our systems for potential vulnerabilities, enabling us to mitigate threats proactively and strengthen resilience against both known and emerging threats.

companyName: Inotiv, Inc.

ticker: NOTV


text: Our organization employs a comprehensive process to oversee and identify cyber threats associated with third-party service providers. For critical systems that handle confidential data, we conduct annual third-party security reviews to evaluate and mitigate potential risks. These reviews include a multifaceted approach combining security questionnaires, in-depth manual assessments of vendor security practices, and automated rating systems to assess vendors' cybersecurity postures. We also maintain an incident response plan that coordinates internal teams and third-party providers to triage, investigate, escalate, contain, remediate and recover from incidents, and to meet applicable legal and contractual obligations.

secItem: Item 1C


text: The forensic investigation of the 2025 Cybersecurity Incident is complete and determined that between approximately August 5-8, 2025, a threat actor gained unauthorized access to the Company's systems and may have acquired certain data. While we have identified the likely scope of the incident, the full operational and financial impacts are still being evaluated. Accordingly, we have not yet determined whether the 2025 Cybersecurity Incident is reasonably likely to have a material impact on the Company. Further, we are subject to ongoing risks from cybersecurity threats that could materially affect us, including our business strategy, results of operations, or financial condition, as further described in Item 1A. Risk Factors – Risks Related to Technology and Cybersecurity.


text: Following the 2025 Cybersecurity Incident, management provided briefings to the Audit Committee and the full Board of Directors regarding incident status, operational impacts, response and recovery efforts and enhancements to our security program and business continuity plans.


text: Our cybersecurity program is led by our CIO, who has over 25 years of experience in information technology. Our CIO leads a credentialed and experienced Information Security team who has primary responsibility for our overall cybersecurity risk management program and who supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Enterprise Risk Leadership Team, including our Chief Operating Officer & General Counsel, and the Chief Financial Officer, is responsible for assessing and managing our material enterprise risks, including risks from cybersecurity threats.

companyName: COOPER COMPANIES, INC.

ticker: COO


text: Our information technology cybersecurity team, with oversight from our Board, is tasked with monitoring cybersecurity and operational risks related to information security and system disruption. The Mitek cybersecurity team uses principles of confidentiality, integrity and availability to design and implement information technology systems. The team employs measures designed to protect against, detect, and respond to cybersecurity threats, and has implemented processes and procedures aligned with our enterprise-wide risk management system. These include: • Enterprise-wide security framework and cybersecurity standards; • Cybersecurity awareness and training programs; • Security assessments and monitoring; • Restricted physical access to critical areas, servers and network equipment; and • Cyber incident response, crisis management, business continuity and disaster recovery plans.

companyName: MITEK SYSTEMS INC

ticker: MITK


text: Certain of our systems and those of our third-party service providers have experienced cybersecurity threats. Based on the information available as of the date of this Annual Report on Form 10-K, we have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, which have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. Despite our security measures, however, there can be no assurance that we, or the third parties with which we interact, will not experience a cybersecurity incident in the future that will materially affect us. Additional information about cybersecurity risks we face is discussed in "Item 1A. Risk Factors," which should be read in conjunction with the information above.


text: Our management team, in coordination with our information technology department, is responsible for assessing and managing our material risks from cybersecurity threats and hiring appropriate personnel and third-party consultants to oversee the cybersecurity program. Our VP of Technology Operations and Information Security has primary responsibility for our organization's overall cybersecurity risk management program and supervises our cybersecurity personnel. He has over 25 years of experience driving innovation and security excellence, including design, implementation, and management of cyber-security and information technology programs at various levels and organizations.


text: As part of our cybersecurity risk management program, we are working with our subsidiaries to develop a cyber training curriculum for their employees. While some have already implemented their programs, others are in the developmental phase. This training may encompass topics such as phishing, cybersecurity awareness, and email security best practices.

companyName: LIVE VENTURES Inc

ticker: LIVE


text: Most recently, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, which have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors—Risks Related to Our Business and Operations."

companyName: SIFCO INDUSTRIES INC

ticker: SIF


text: Our management team, including our Data Protection Officer and external counsel, are responsible along with the Company's Board of Directors for assessing and managing our material risks from cybersecurity threats. Our Data Protection Officer has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Data Protection Officer has extensive experience in overseeing information technology and cybersecurity programs. Collectively, has approximately twenty years of experience in information technology, including more than eight years with direct responsibility for cybersecurity oversight and implementation. This experience included developing and implementing a cybersecurity incident response playbook and leading initiatives to achieve compliance with the NIST CSF 2.0 cybersecurity regulatory framework. Other experience included expanding and maintaining cybersecurity program in response to evolving state regulatory requirements, implementing automated playbooks to prevent and mitigate cyber threats, and overseeing compliance efforts related to NYDFS and CCPA. This backgrounds equips management with practical cybersecurity knowledge, and includes direct experience in cybersecurity program development, incident response readiness, automation of threat prevention, and compliance with applicable cybersecurity and data privacy regulations.


text: Our IT Steering Committee, comprised of our Chief Executive Officer, our Chief Financial Officer, and our General Counsel, oversees efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which includes oversight over our third-party IT consultants, monitoring systems and employee engagement. Our senior management team is responsible for reporting any identified cybersecurity risks to the Audit Committee of our Board of Directors.

companyName: BARNWELL INDUSTRIES INC

ticker: BRN


text: Risk Management and Strategy The Company has established a cybersecurity program intended to protect our information assets and those information assets of our clients that come under our control. Our cybersecurity risk management processes include technical security controls, monitoring systems, operational processes and policies, and management oversight to assess, identify and manage risks from cybersecurity threats. We have implemented risk-based controls to protect our information, information systems and business operations. We have adopted security-control principles and standards based on the National Institute of Standards and Technology Cybersecurity Framework (NIST), other recognized global standards and client contractual requirements, as applicable. We strive to evaluate and invest in technology, personnel and infrastructure to maintain cybersecurity measures in line with our risk exposure and to address the ever-changing threat, technology and regulatory landscape.

companyName: Cushman & Wakefield Ltd.

ticker: CWK


text: We maintain a cybersecurity program that includes physical, administrative, and technical safeguards, and we maintain plans and procedures whose objective is to help us prevent, detect and timely and effectively respond to, and as necessary, recover from, cybersecurity incidents. Through our cybersecurity risk management program, we have established operational processes to address issues including monitoring and patching of vulnerabilities, regularly updating of our information systems, and evaluating new countermeasures made to defend against an evolving landscape of threats. This process is overseen by the Audit Committee of our Board.


text: In addition, we periodically engage third-party consultants and providers to assist us in assessing, testing, enhancing and monitoring our cybersecurity risk management programs and responding to any incidents. These third parties work in conjunction with the Company's information security team in an effort to continuously improve our cyber risk posture. Examples of third-party actions include the engagement of a security operations center for real-time monitoring and response to incidents, risk assessments and security certifications. The Company also receives independent audits on our global cybersecurity program from industry leading vendors at least annually.


text: We have established a vendor risk management program, which is a cross-functional program supported by our information security, compliance and procurement teams. As part of that program, we assess the security and privacy practices of our suppliers and third-party service providers who have access to, store or process our information through ongoing risk monitoring and security assessments, in line with the cybersecurity risks associated with the products or services they provide. We provide feedback and guidance to certain vendors as needed in an effort to enhance their security posture, including when new risks or threats are identified. Additionally, we perform periodic reassessments of applicable vendors to ensure our information security control requirements continue to be met.


text: At Cushman & Wakefield, we believe cybersecurity awareness is important in helping prevent cyber threats. To that end, we provide annual cybersecurity awareness training and regular phishing awareness exercises to our tech-enabled employees. We monitor and assess the success rate of employees reporting phishing scams, and the results inform the development of our security trainings, systems and programs. Additionally, role-based security training is provided to employees in certain higher-risk positions (including those who handle sensitive information, technology or funds), which is tailored to the heightened cybersecurity risks they face.


text: We have experienced, and may in the future experience, whether directly or through our service providers or other channels, cybersecurity incidents. While prior incidents have not had a material impact on us, future incidents could have a material impact on our business, operations and reputation. Although our processes are designed to help prevent, detect, respond to and mitigate the impact of such incidents, there is no guarantee that they will be sufficient to prevent or mitigate the risk of a cyberattack or the potentially serious reputational, operational, legal or financial impacts that may result. See "Risks Related to Our Business and Operations—A material breach in security relating to our information systems could adversely affect us." within Item 1A, "Risk Factors" in this Annual Report.


text: At Cushman & Wakefield, our Chief Information Security Officer ("CISO") oversees a global information security team which is responsible for protecting the information and operations of us and our clients. Our current CISO has over 23 years of experience and leadership in the cybersecurity industry, holds a master's degree in Information Security and Assurance, and has received numerous industry certifications, including ISO-27000 Specialist, EC-Council Disaster Recovery Professional and an ISACA certification in Risk and Information Systems Control, among others. The information security team has established a security operations center and other partnerships with service providers to monitor for technology and security incidents which are actioned based on the Company's incident response procedures.


text: Our Board has overall responsibility for risk oversight, with its committees assisting our Board in performing this function based on their respective areas of expertise. Our Board has delegated oversight of risks related to cybersecurity to the Audit Committee. The Audit Committee is charged with reviewing our overall guidelines, policies, processes and procedures with respect to risk assessment and risk management, including risks related to cybersecurity. Our CISO and our information security team provide more in-depth reporting on cybersecurity risks to the Audit Committee at least annually based on our established enterprise risk categories. These briefings include assessments of the threat landscape, updates on incidents, results of client security audits, and reports on our investments in cybersecurity risk mitigation. In addition, given its overall importance to the organization, our CISO also provides cybersecurity risk reporting to our Board on at least an annual basis as well as from time to time as needed.


text: Our CISO meets regularly with members of our senior management, including our executive officers. Executives also frequently attend meetings of our Audit Committee and our Board and are therefore able to hear the cybersecurity updates presented at those meetings.


text: Our information security team also participates in periodic global and regional Risk Assurance Committees to further strengthen our cybersecurity risk management activities across the Company. At these meetings, the information security team presents to members of Company leadership, including members of our internal audit team and regional and service line chief financial officers, on the current cybersecurity risk environment, including any newly identified areas of risk and updates on responses to existing risks.


text: We maintain a cybersecurity program that includes physical, administrative, and technical safeguards, and we maintain plans and procedures whose objective is to help us prevent, detect and timely and effectively respond to, and as necessary, recover from, cybersecurity incidents. Through our cybersecurity risk management program, we have established operational processes to address issues including monitoring and patching of vulnerabilities, regularly updating our information systems, and evaluating new countermeasures made to defend against an evolving landscape of threats. This process is overseen by the Audit Committee of our Board.


text: We have experienced, and may in the future experience, whether directly or through our service providers or other channels, cybersecurity incidents. While prior incidents have not had a material impact on us, future incidents could have a material impact on our business, operations and reputation. Although our processes are designed to help prevent, detect, respond to and mitigate the impact of such incidents, there is no guarantee that they will be sufficient to prevent or mitigate the risk of a cyberattack or the potentially serious reputational, operational, legal or financial impacts that may result. See "Risks Related to Our Business and Industry—A security breach or other threat relating to our information systems could adversely affect us." within Item 1A, "Risk Factors" in this Annual Report.


text: Our Chief Information Security Officer ("CISO") oversees a global information security team which is responsible for protecting the information and operations of us and our clients. Our current CISO has over 24 years of experience and leadership in the cybersecurity industry, holds a master's degree in Information Security and Assurance, and has received numerous industry certifications, including ISO-27000 Specialist, EC-Council Disaster Recovery Professional and an ISACA certification in Risk and Information Systems Control, among others. The information security team has established a security operations center and other partnerships with service providers to monitor for technology and security incidents which are actioned based on the Company's incident response procedures.


text: Our Board has overall responsibility for risk oversight, with its committees assisting our Board in performing this function based on their respective areas of expertise. Our Board has delegated oversight of risks related to cybersecurity to the Audit Committee. The Audit Committee is charged with evaluating the Company's overall guidelines, policies, processes and procedures with respect to information security and cybersecurity risks. Our CISO and our information security team provide in-depth reporting on cybersecurity risks to the Audit Committee at least annually based on our established enterprise risk categories. These briefings include assessments of the threat landscape, updates on incidents, results of client security audits, and reports on our investments in cybersecurity risk mitigation. In addition, given its overall importance to the organization, our CISO also provides cybersecurity risk reporting to our Board on at least an annual basis as well as from time to time as needed.


text: Risk Management and strategy We have developed processes for assessing, identifying and managing material risks from cybersecurity threats. We maintain an enterprise risk management program, which includes management of material risks from cybersecurity threats alongside other Company risks as part of our overall risk assessment process. Our cybersecurity strategy includes defense in depth and zero trust based controls intended to protect our information technology systems. We maintain an enterprise information and cybersecurity program. As part of this program, we employ a range of tools and services to inform our assessment, identification and management of material risks from cybersecurity threats, which include, from time to time, monitoring emerging data protection laws and implementing responsive changes to our processes; undertaking periodic reviews of our partner facing policies and statements related to cybersecurity; conducting cybersecurity management and incident training for employees involved in our systems and processes that handle sensitive data; conducting phishing email simulations for employees and contractors with access to corporate email systems; requiring employees, as well as third-parties who provide services on our behalf, to treat information and data with care; and employing a cyber risk management and quantification system customized to our environment.

companyName: Evolent Health, Inc.

ticker: EVH


text: We maintain an incident response plan that includes processes to triage, assess severity for, escalate, contain, investigate and remediate material cybersecurity incidents, as well as to comply with potentially applicable legal obligations. As part of the above processes, we periodically engage with assessors, consultants, auditors, and other third-parties, including by periodically annually having a third-party/an independent Qualified Security Assessor review our cybersecurity program to help identify areas for improvement and/or compliance. Our risk management processes also address cybersecurity threat risks associated with our use of third party service providers.


text: For a discussion of whether and how any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company, including our business strategy and results of operations, see "Risk Factors – "Risks Related to Data Protection Privacy, Cybersecurity, Intellectual Property and Technology" which is incorporated by reference into this Item 1C.


text: The Compliance and Regulatory Affairs Committee of the Board (the "Compliance and Regulatory Affairs Committee") provides oversight of risks from cybersecurity threats. The Compliance and Regulatory Affairs Committee receives updates from our Chief Information Security Officer ("CISO") and other members of management to, among other items, review material cybersecurity incidents, review key metrics on our cybersecurity program and related risk management programs, and discuss our cybersecurity programs and goals. The Compliance and Regulatory Affairs Committee updates the full Board on matters relating to cybersecurity. The Audit Committee of the Board provides an additional layer of cybersecurity oversight on specific financial matters.


text: Our management disclosure and compliance committees, which include representatives from our legal, financial and accounting and information technology ("IT") teams, meet at least quarterly to monitor potential risks and review procedures and controls relating to cybersecurity. Management periodically assesses such risks and assists in the implementation of policies and procedures related to cybersecurity risk oversight in conjunction with the Compliance and Regulatory Affairs Committee.


text: Our CISO is responsible for assessing and managing the Company's material risks from cybersecurity threats. Our CISO has served in this role for the past four years, and has more than 25 years of experience in the aggregate in various roles involving managing information security, technology infrastructure, IT operations and developing cybersecurity strategy, and is a Certified Information Systems Security Professional (CISSP).


text: Our CISO is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents through the management of and participation in the cybersecurity risk management and strategy process described above, including the operation of our incident response plan. As discussed above, our CISO reports to the Compliance and Regulatory Affairs Committee, about the risks from cybersecurity threats among other cybersecurity related matters, and meets regularly with our Chief Technology Officer.


text: We maintain an incident response plan that includes processes to triage, assess severity for, escalate, contain, investigate and remediate material cybersecurity incidents, as well as to comply with potentially applicable legal obligations. As part of the above processes, we periodically engage with assessors, consultants, auditors, and other third-parties, including by periodically annually having a third-party/an independent Qualified Security Assessor review our cybersecurity program to help identify areas for improvement and/or compliance. Our risk management processes also address cybersecurity threat risks associated with our use of third-party service providers.


text: For a discussion of whether and how any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company, including our business strategy and results of operations, see "Risk Factors – Risks Related to Data Protection Privacy, Cybersecurity, Intellectual Property and Technology" which is incorporated by reference into this Item 1C.


text: The Compliance and Regulatory Affairs Committee of the Board (the "Compliance and Regulatory Affairs Committee") provides oversight of risks from cybersecurity threats. The Compliance and Regulatory Affairs Committee receives updates from our Chief Information Security Officer (" CISO ") and other members of management to, among other items, review material cybersecurity incidents, review key metrics on our cybersecurity program and related risk management programs, and discuss our cybersecurity programs and goals. The Compliance and Regulatory Affairs Committee updates the full Board on matters relating to cybersecurity. The Audit Committee of the Board provides an additional layer of cybersecurity oversight on specific financial matters.


text: Our CISO is responsible for assessing and managing the Company's material risks from cybersecurity threats. Our CISO has served in this role for the past five years, has more than 25 years of experience in the aggregate in various roles involving managing information security, technology infrastructure, IT operations and developing cybersecurity strategy, and is a Certified Information Systems Security Professional ("CISSP").


text: Our CISO is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents through the management of and participation in the cybersecurity risk management and strategy process described above, including the operation of our incident response plan. As discussed above, our CISO reports to the Compliance and Regulatory Affairs Committee, about the risks from cybersecurity threats among other cybersecurity related matters and meets regularly with our Chief Technology Officer.


text: Following these risk assessments, we evaluate whether, and if so, how, to re-design, implement, and maintain reasonable safeguards to minimize identified risks; work to reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our Chief Technology Officer (CTO), who reports to our Chief Executive Officer, to manage the risk assessment and mitigation process.

companyName: Cue Health Inc.


text: We engage independent third party auditors to validate our risk management program. Third party experts assist us to design and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards. We require each third-party service provider to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company.


text: Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, see Item 1A Risk Factors of this Annual Report on Form 10-K, including the risk factor entitled "Risks Related to Our Business and Strategy —Security breaches and incidents, loss of data, and other disruptions could compromise sensitive information related to our business, or information of our customers, users of our products, healthcare stakeholders or others, or prevent us or our customers, users of our products, healthcare providers, healthcare payors or others from accessing critical information, all of which could result in a material adverse effect, including without limitation, a material operational or service interruption, harm to our reputation, significant fines, penalties and liability, breach or triggering of Data Protection Laws, Privacy Policies and Data Protection Obligations, loss of customers or sales, or customers curtailing or ceasing their use of our services."


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight function directly as a whole, as well as through its audit committee.


text: Our CTO oversees a dedicated Vice President, Information Security and Privacy, and the CTO's team is primarily responsible to assess and manage our material risks from cybersecurity threats. The CTO oversees our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above.


text: The CTO provides periodic reports to our board of directors through its audit committee, as well as our Chief Executive Officer and other members of our senior management as appropriate. These reports include updates on our cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape. Our program is regularly evaluated by internal and external experts with the results of those reviews reported to senior management, including the CTO, and the board of directors through its audit committee.


text: As an externally managed company, our business is highly dependent on the communications and information systems of our Manager, its affiliates and third-party service providers. Our Manager is an affiliate of TPG, a leading global alternative asset management firm, founded in San Francisco in 1992, with $222 billion of assets under management (as of December 31, 2023) and investment and operational teams around the world. TPG invests across a broadly diversified set of strategies, including private equity, impact, credit, real estate and market solutions. We, in conjunction with our Manager and TPG, have adopted processes designed to identify, assess and manage material risks from cybersecurity threats. These processes include responses to and assessments of internal and external threats to the security, confidentiality, integrity and availability of our and TPG's data and systems along with other material risks to firm operations. As part of its collective risk management process, TPG engages outside providers to conduct periodic internal and external penetration testing. TPG also uses the NIST Cybersecurity Framework to assess our cybersecurity controls. TPG stores data, including ours, in cloud environments with security that we believe is appropriate for the data involved, and has adopted controls around, among other things, vendor risk assessment, access and acceptable use and backup and recovery.

companyName: TPG RE Finance Trust, Inc.

ticker: TRTX


text: Our board of directors has responsibility for the direction and oversight of our risk management. Our board of directors administers this oversight function directly, with support from its committees. In particular, the audit committee of our board of directors (the "audit committee") has the responsibility to consider and discuss our major financial risk exposures and the steps our Manager takes, or is required to take, to monitor and control these exposures, including guidelines and policies to govern the process by which risk assessment and management is undertaken. Our audit committee also monitors compliance with legal and regulatory requirements, in addition to overseeing the performance of our internal audit function.


text: With respect to cybersecurity, the audit committee engages in regular discussions with management regarding the Company's significant financial risk exposures and the measures implemented to monitor and control these risks, including those that may result from material cybersecurity threats. In addition, TPG's chief information security officer briefs the audit committee on TPG's information security program and cybersecurity risks at least annually, and will brief the audit committee as needed in connection with any potentially material cybersecurity incidents affecting the Company. Annual briefings of the audit committee by TPG's chief information security officer typically include topics such as risk assessment, risk management and control decisions, service provider arrangements, test results, security incidents and responses, and recommendations for changes and updates to policies and procedures.


text: As an externally managed company, we rely on TPG's information systems in connection with our day-to-day operations. Consequently, we also rely on the processes for assessing, identifying, and managing material risks from cybersecurity threats undertaken by TPG. TPG has established an enterprise risk committee ("ERC") to manage overall risk, including cybersecurity risks identified by the cybersecurity team. The ERC includes representatives from relevant functions and is led by TPG's chief executive officer. TPG has also established an operational risk committee ("ORC") which is responsible for applying the policy decisions of the ERC. Operational responsibility for ensuring the adequacy and effectiveness of TPG's risk management, control and governance processes is assigned to TPG's chief information security officer, who reports, among other things, potentially material cybersecurity incidents to the ORC and, in coordination with TPG's chief information officer, reports to the ERC at least annually. TPG's chief information security officer leads TPG's cybersecurity team, which includes individuals dedicated to incident detection and response. This team is responsible for identifying threats that can impact TPG and the Company, and designing controls to mitigate vulnerabilities before they are exploited and to detect and neutralize any threats that do materialize. TPG's chief information security officer and TPG's chief information officer each have more than 20 years of experience in their fields. TPG's chief information security officer and other senior members of TPG's cybersecurity team hold industry standard certifications.


text: TPG employs processes to oversee and identify material risks associated with the use of third-party service providers, taking into account the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider.


text: As an externally managed company, our business is highly dependent on the communications and information systems of our Manager, its affiliates and third-party service providers. Our Manager is an affiliate of TPG, a leading global alternative asset manager with $246 billion in assets under management as of December 31, 2024. TPG offers a broad range of investment strategies across the alternative asset management landscape, primarily in private equity, credit, and real estate. We, in conjunction with our Manager and TPG, have adopted processes designed to identify, assess and manage material risks from cybersecurity threats. These processes include risk assessments of internal and external threats to the confidentiality, integrity and availability of our and TPG's data and systems along with other material risks to firm operations.


text: These risk assessments inform TPG's cybersecurity program and the continued development of a layered set of controls aimed at preventing, detecting and responding to threats. TPG's administrative, organizational, technical and physical security controls include, but are not limited to, policies and procedures, system hardening vulnerability scanning and patching, employee training and awareness, third-party risk management processes, backup and recovery processes, access controls, data encryption in transit and at rest, network perimeter controls, and identity verification. TPG also has policies and controls in place designed to detect and respond to cybersecurity events, including an incident response plan, an incident response team with dedicated roles and responsibilities for assessing and responding to a cybersecurity event, system logging and ongoing monitoring, and periodic training exercises simulating cybersecurity events that are designed to raise awareness and test the TPG team's response readiness capabilities.


text: The nature, scope and effectiveness of these controls are regularly reviewed through a series of internal and external processes. TPG's cybersecurity team performs both automated monitoring on a continuous basis and manual reviews of key controls. TPG also conducts annual assessments of TPG's cybersecurity program using industry standard cybersecurity frameworks, such as the NIST Cybersecurity Framework as benchmarks to perform TPG's evaluation. This does not imply that TPG fully meets any particular industry standards, specifications or requirements. In addition, independent reviews of TPG's cybersecurity control effectiveness are conducted by TPG's internal audit team on a periodic basis. TPG also engages external providers to conduct periodic external assessments, including penetration testing.


text: With respect to cybersecurity, the audit committee engages in regular discussions with management regarding the Company's significant financial risk exposures and the measures implemented to monitor and control these risks, including those that may result from material cybersecurity threats. Pursuant to our Cybersecurity Policy, our audit committee has appointed a dedicated member of the board of directors who is primarily responsible for our cybersecurity oversight (the "Board Cyber Lead"). TPG's chief information security officer periodically briefs the audit committee and/or the Board Cyber Lead on TPG's information security program and cybersecurity risks, and will brief the Board Cyber Lead or audit committee as needed in connection with any potentially material cybersecurity incidents affecting the Company. Periodic briefings of the Board Cyber Lead and/or audit committee by TPG's chief information security officer typically include topics such as risk assessment, risk management and control decisions, service provider arrangements, test results, security incidents and responses, and recommendations for changes and updates to policies and procedures.


text: As an externally managed company, we rely on TPG's information systems in connection with our day-to-day operations. Consequently, we also rely on the processes for assessing, identifying, and managing material risks from cybersecurity threats undertaken by TPG. TPG has established an enterprise risk committee ("ERC") to manage overall risk, including cybersecurity risks identified by TPG's cybersecurity team. The ERC includes representatives from relevant functions and is led by TPG's chief executive officer. TPG has also established an operational risk committee ("ORC") which is responsible for applying the policy decisions of the ERC. Operational responsibility for ensuring the adequacy and effectiveness of TPG's risk management, control and governance processes is assigned to TPG's chief information security officer, who periodically reports, among other things, potentially material cybersecurity incidents to the ORC and reports to the ERC at least annually. TPG's cybersecurity team also regularly coordinates with other key stakeholders within TPG, including compliance, human resources, internal audit and legal.


text: TPG's chief information security officer leads TPG's cybersecurity team, which is responsible for implementing, maintaining and enforcing TPG's cybersecurity program. TPG's chief information security officer previously held various leadership roles within the technology risk department of one of the world's largest banking institutions over a 17-year period. He holds a Bachelor of Science in Electrical Engineering and Mathematics from the University of Texas at Arlington and is a Certified Information Systems Security Professional (CISSP). TPG's cybersecurity team possesses a variety of cybersecurity skill sets and extensive expertise obtained through decades of experience, numerous industry certifications, and advanced degrees. TPG's cybersecurity team continues to take steps to maintain up-to-date knowledge of evolving cybersecurity threats and countermeasures.


text: Cyber criminals do, however, target us, TPG and TPG's employees and other third parties. Ongoing or future attacks such as these could have impacts on our or TPG's operations. For additional information on these ongoing risks, please refer to "Part 1. Item 1A. Risk Factors— Operational risks, including the risks of cyberattacks, may disrupt our businesses, result in losses or limit our growth".


text: Cybersecurity risk management and strategy Our cybersecurity risk management program is integrated into our enterprise risk management processes, and is informed by recognized cybersecurity industry frameworks and standards, including the National Institute of Standards and Technology. We use these frameworks, together with information collected from internal assessments, to develop policies for use of our information systems and assets (for example, B&W business information and information resources such as computers and workstations), access to specific intellectual property or technologies, and protection of personal information. We protect these information assets through industry-standard techniques, such as multi-factor authentication and malware defenses. We also work with internal stakeholders to integrate foundational cybersecurity principles throughout our operations, including employment of multiple layers of cybersecurity defenses, restricted access based on business need, and integrity of our business information.

companyName: Babcock & Wilcox Enterprises, Inc.

ticker: BW


text: We have implemented a risk-based approach to our cybersecurity processes, inclusive of risks associated with our use of third-party IT service providers, which considers the sensitivity and volume of the relevant data, the potential effects on third parties and individuals and the needs of our business in determining what risk mitigation, remediation or prevention actions are appropriate.


text: In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform due diligence on third parties that have access to our most critical systems, data or facilities that house such systems or data, and establish contractual terms and oversight to manage and reduce the risks associated with such third-party vendors. Such contractual terms include requirements to provide notification of cyber incidents involving our systems or data and requirements to provide industry-accepted disclosures, such as SOC 2 Type II reports, on a regular basis.


text: We utilize several cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage material risks from cybersecurity threats, and to protect against, detect and respond to cybersecurity incidents (as defined in Item 106(a) of Regulation S-K), including, among others, the following: • maintain a global Security Operations Center to support visibility to cybersecurity incidents in real time; • require all salaried employees to complete an annual cybersecurity training program where specific threats and scenarios are highlighted based on our analysis of current risks to the organization; • provide regular cybersecurity awareness and confidential information protection training and conduct phishing email simulations for employees and contractors with access to corporate email systems to enhance awareness and responsiveness to such possible threats; • maintain a Cybersecurity Incident Response Plan, which provides a framework for handling cybersecurity incidents based on, among other factors, the potential severity of the incident and facilitates cross-functional coordination of our response to such incidents, should they occur; • maintain cybersecurity insurance and regularly review our policy and levels of coverage based on current risks; • monitor emerging data protection and cybersecurity laws, and implement changes to our processes and systems designed to comply, and through policy, practice and contract (as applicable) require employees, as well as third parties who provide services on our behalf, to treat customer information and data with care; • conduct several cyber-specific penetration tests per year; and • engage consultants and other third parties, as appropriate, in connection with our cybersecurity practices.


text: Governance of cybersecurity risk management The Board of Directors, as a whole, has oversight responsibility for our strategic and operational risks. Management is responsible for day-to-day assessment and management of cybersecurity risks. The IT Steering Committee, comprised of a cross-functional group of our executive management, leads management's oversight of the IT function, including IT risk management. Our Director of IT has primary oversight of material risks from cybersecurity threats. Our Director of IT has 20 years of experience across various software engineering, IT security and compliance, business and management roles, including serving as the Director of Engineering Applications and Data Management, leading the development and implementation of information technology strategies and roadmaps for Digital and Engineering applications group. The Director of IT is supported by our Director of IT Security and Compliance, who has more than 10 years of experience in information technology and IT security.


text: Our Director of IT and Director of IT Security and Compliance assess our cybersecurity readiness through internal assessment tools as well as third-party control tests, vulnerability assessments, audits and evaluation against industry standards. We have governance and compliance structures that are designed to elevate potential threats or vulnerabilities relating to cybersecurity to our Director of IT and IT Steering Committee. We also employ various defensive and continuous monitoring techniques using recognized industry frameworks and cybersecurity standards.


text: Our Director of IT meets with the IT Steering Committee monthly to review our information technology systems and discuss key cybersecurity risks. In addition, quarterly the Director of IT reviews our entire risk management program, which includes cybersecurity risks, with Executive management and the Board of Directors.


text: Material cybersecurity risks, threats & incidents To date, we do not believe that risks from cybersecurity threats, including as a result of any previous cybersecurity incidents have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial position. However, there can be no guarantee that we will not be the subject of future threats or incidents and we can give no assurance that we have detected all cybersecurity incidents or cybersecurity threats. Additional information on cybersecurity risks we face can be found in Item 1A, Risk Factors, which should be read in conjunction with the foregoing information.


text: Cybersecurity risk management and strategy Our cybersecurity risk management program is integrated into our enterprise risk management processes and is informed by recognized cybersecurity industry frameworks and standards, including the National Institute of Standards and Technology. We use these frameworks, together with information collected from internal assessments, to develop policies for use of our information systems and assets (for example, B&W business information and information resources such as computers and workstations), access to specific intellectual property or technologies, and protection of personal information. We protect these information assets through industry-standard techniques, such as multi-factor authentication and malware defenses. We also work with internal stakeholders to integrate foundational cybersecurity principles throughout our operations, including employment of multiple layers of cybersecurity defenses, restricted access based on business need, and integrity of our business information.


text: We utilize several cybersecurity tactics, techniques, processes and controls to aid in our efforts to assess, identify, and manage material risks from cybersecurity threats, and to protect against, detect and respond to cybersecurity incidents (as defined in Item 106(a) of Regulation S-K), including, among others, the following: • maintain a Security Operations Center to support visibility to cybersecurity incidents in real time; • require all salaried employees to complete an annual cybersecurity training program where specific threats and scenarios are highlighted based on our analysis of current risks to the organization; • provide regular cybersecurity awareness and confidential information protection training and conduct phishing email simulations for employees and contractors with access to corporate email systems to enhance awareness and responsiveness to such possible threats; • maintain a Cybersecurity Incident Response Plan, which provides a framework for handling cybersecurity incidents based on, among other factors, the potential severity of the incident and facilitates cross-functional coordination of our response to such incidents, should they occur; • maintain cybersecurity insurance and regularly review our policy and levels of coverage based on current risks; • monitor emerging data protection and cybersecurity laws, and implement changes to our processes and systems designed to comply, and through policy, practice and contract (as applicable) require employees, as well as third parties who provide services on our behalf, to treat customer information and data with care; • conduct several cyber-specific penetration tests per year; and • engage consultants and other third parties, as appropriate, in connection with our cybersecurity practices.


text: Governance of cybersecurity risk management Our Board of Directors, as a whole, has oversight responsibility for our strategic and operational risks. Management is responsible for day-to-day assessment and management of cybersecurity risks. The IT Executive Steering Committee, comprised of a cross-functional group of our executive management, leads management's oversight of the IT function, including IT risk management. The IT Steering Committee, comprised of operational management, provides tactical oversight of the IT function, including IT risk management Our Director of IT has primary oversight of material risks from cybersecurity threats. Our Director of IT has 20 years of experience across various software engineering, IT security and compliance, business and management roles, including serving as the Director of Engineering Applications and Data Management, leading the development and implementation of information technology strategies and roadmaps for Digital and Engineering applications group. The Director of IT is supported by our Director of IT Security and Compliance, who has more than 10 years of experience in information technology and IT security.


text: Our Director of IT and Manager of IT Cybersecurity, Compliance and Data Privacy assess our cybersecurity readiness through internal assessment tools as well as third-party control tests, vulnerability assessments, audits and evaluation against industry standards. We have governance and compliance structures that are designed to elevate potential threats or vulnerabilities relating to cybersecurity to our Director of IT, IT Steering Committee and IT Executive Steering Committee. We also employ various defensive and continuous monitoring techniques using recognized industry frameworks and cybersecurity standards.


text: Our Director of IT meets with the IT Steering Committee monthly to review our information technology systems and discuss key cybersecurity risks. In addition, quarterly the Director of IT reviews our entire risk management program, which includes cybersecurity risks, with the IT Executive Steering Committee and the Board of Directors.


text: Material cybersecurity risks, threats & incidents To date, we do not believe that risks from cybersecurity threats, including as a result of any previous cybersecurity incidents have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial position. However, there can be no guarantee that we will not be the subject of future threats or incidents, and we can give no assurance that we have detected all cybersecurity incidents or cybersecurity threats. Additional information on cybersecurity risks we face can be found in Item 1A, Risk Factors, which should be read in conjunction with the foregoing information.


text: As of the date of this Annual Report, we are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, our business strategy, results of operations, or financial condition is highly dependent on our ability to collect, use, store and manage organizational and property data. If any of our significant information and data management systems do not operate properly or are disabled, we could suffer a material disruption of our business or managing real estate, liability to tenant, loss of tenant or other sensitive data, regulatory intervention, inability to properly monitor our compliance with the rules and regulations regarding our qualification as a REIT, misstated financial reports, violations of loan covenants and/or missed reporting deadlines, breach of confidentiality or other contract provisions, or reputational damage. These systems may fail to operate properly or become disabled as a result of events wholly or partially beyond our control, including disruptions of electrical or communications services, natural disasters, political instability, terrorist attacks, sabotage, computer viruses, deliberate attempts to disrupt our computer systems through "hacking,"" "phishing," or other forms of both deliberate or unintentional cyber-attack, or our inability to occupy our office location.

companyName: KBS Growth & Income REIT, Inc.


text: Our advisor has formed a Cyber Governance Committee ("CGC"), among its members include our advisor's Chief Compliance Officer, Senior Vice President of Human Resources and Information Technology Director, to oversee cyber governance and to assess and manage, along with our advisor's Chief Executive Officer and our advisor's Chief Financial Officer (also our Chief Financial Officer) material risks, if any, from cybersecurity threats. The CGC meets quarterly to review incident summary reports, new threats, risks, industry and regulatory changes. Our advisor's Chief Executive Officer and Chief Financial Officer and the CGC are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents pursuant to criteria set forth in our incident response plan and related processes. In addition, our incident response plan and related processes provide for incident escalation procedures for any cybersecurity incidents that meets pre-established reporting thresholds.


text: Risk management and strategy The Company recognizes the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. Our policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats are integrated into our overall risk management program and are based on the Center for Internet Security (CIS) benchmarks. CIS controls map to many established standards and regulatory frameworks, including the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) and NIST SP 800-53, the ISO 27000 series of standards, PCI DSS, HIPAA, and others.

companyName: Community Healthcare Trust Inc

ticker: CHCT


text: Managing Material Risks & Integrated Overall Risk Management The Company has strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. Our risk management team works closely with our IT department to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.


text: Engage Third-parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity threats, the Company engages with a range of external experts, including cybersecurity assessors, consultants, and auditors in evaluating and testing our risk management systems. These partnerships enable us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes remain at the forefront of industry best practices. Our collaboration with these third-parties includes real-time Company endpoint scanning, detection, prevention, and remediation; regular audits; threat assessments; and consultation on security enhancements.


text: Oversee Third-party Risk Because we are aware of the risks associated with third-party service providers, the Company implements stringent processes to oversee and manage these risks. We conduct thorough security assessments of all third-party providers before engagement and maintain ongoing review to ensure compliance with our cybersecurity standards. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third-parties. Risks from Cybersecurity Threats We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing.


text: Board of Directors Oversight As mentioned above, management has formed an IT Committee consisting of the Chief Executive Officer, Chief Financial Officer, and the Vice President of Information Technology to review and discuss information security matters and cyber security risks. The committee meets at least twice a year and reports to the Board of Directors as needed.


text: Management's Role Managing Risk The Chief Executive Officer and Chief Financial Officer play a pivotal role in serving on the IT Committee, which meets at least twice a year and discusses a broad range of topics, including: • Current cybersecurity landscape and emerging threats; • Status of ongoing cybersecurity initiatives and strategies; • Incident reports and learnings from any cybersecurity events; and • Compliance with regulatory requirements and industry standards.


text: In addition, the IT Committee and the Board maintain an ongoing dialogue regarding emerging or potential cybersecurity risks, ensuring the Board's oversight is proactive and responsive. The IT Committee actively participates in strategic decisions related to cybersecurity, offering guidance and approval for major initiatives. This involvement ensures that cybersecurity considerations are integrated into the broader strategic objectives of the Company.


text: Risk Management Personnel Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the Vice President of Information Technology. Our Vice President of Information Technology has over 25 years of experience in the information technology field and has been a member of and led numerous teams responsible for cybersecurity operations. In addition, all Company employees are required to complete mandatory cybersecurity training each year.


text: Monitor Cybersecurity Incidents The Vice President of Information Technology is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. The Vice President of Information Technology implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the Vice President of Information Technology is equipped with a well-defined incident response plan. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.


text: Reporting to Board of Directors The Vice President of Information Technology, in his capacity, regularly informs the Chief Executive Officer and Chief Financial Officer of all aspects related to cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing the Company. Furthermore, significant cybersecurity matters, and strategic risk management decisions are escalated to the Board of Directors, ensuring that they have comprehensive oversight and can provide guidance on critical cybersecurity issues.


text: Board of Directors Oversight Management has formed an IT Committee consisting of the Chief Executive Officer, Chief Financial Officer, and the Vice President of Information Technology to review and discuss information security matters and cyber security risks. The committee meets at least twice a year and reports to the Board of Directors as needed.


text: Monitor Cybersecurity Incidents The Vice President of Information Technology is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. The Vice President of Information Technology implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the Vice President of Information Technology is equipped with a well-defined incident response plan. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents. As part of the managed monitoring and remediation platform, the Company benefits from a $100,000 breach prevention warranty. Since its inception, the Company has not had a security breach, and has not incurred any resulting expenses, penalties or settlements.


text: Reporting to the Board of Directors The Vice President of Information Technology, in his capacity, regularly informs the Chief Executive Officer and Chief Financial Officer of all aspects related to cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing the Company. Furthermore, significant cybersecurity matters, and strategic risk management decisions are escalated to the Board of Directors, ensuring that they have comprehensive oversight and can provide guidance on critical cybersecurity issues.


text: Cybersecurity Risk Management and Strategy We employ a layered security approach leveraging people, process and technology — structuring our cybersecurity program to align with the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF"). We also intend that our cybersecurity program aligns with applicable laws and regulatory requirements. Our program and the related controls we employ are designed to identify and assess risk with the aim of preventing, detecting or mitigating cybersecurity risks to avoid material harm to our business, customers, associates and other stakeholders.

companyName: Cable One, Inc.

ticker: CABO


text: Our program addresses physical threats caused by infrastructure failures, logical threats caused by threat-actors and viruses, as well as other threats we identify by auditing our operations. We conduct annual assessments of our internal control over financial reporting as required for compliance with the Sarbanes-Oxley Act of 2002. Additionally, we conduct annual self-assessments and annual third-party penetration testing of our cybersecurity controls such as for compliance with Payment Card Industry ("PCI") standards, and otherwise where applicable. Our cybersecurity team also monitors supply chain and third-party cybersecurity risks to minimize the likelihood of business disruption, as well as conducts annual incident response plan rehearsals and risk assessments based on NIST standards, including the CSF.


text: We have a dedicated internal cybersecurity team that maintains our readiness and security posture by overseeing our cybersecurity program's information security policies and standards. In doing so, our cybersecurity team works with independent external cybersecurity advisors to develop appropriate standards to identify, assess, mitigate and remediate material cyber risks and issues. For example, PCI standards include quarterly external vulnerability scans that are conducted by a vendor approved by the PCI security standards council. Further, as part of our annual risk assessment controls, we obtain and review the SSAE (SOC-1 Type 2) reports of our key third-party service providers. The annual assessment includes consideration of materiality, identification and prioritization of financial reporting elements ("FREs") using quantitative and qualitative risk factors (including fraud risk), and identification of business processes and information technology systems linked to FREs. The reports are reviewed to identify and evaluate subservice providers, key reports, exceptions and complementary user entity controls and determines the appropriate response on any identified concerns.


text: We also incorporate intelligence sharing about emerging threats through collaboration with other companies in our industry, consultants and public-private partnerships with government intelligence agencies, such as the Arizona Cyber Threat Response Alliance ("ACTRA") and The Internet and Television Association ("NCTA").


text: As part of our cybersecurity program, we provide regular training on our information security policies and standards to help further prevent, detect and mitigate cybersecurity risks. We require mandatory cybersecurity, privacy and information handling training for all new associates upon onboarding and annually thereafter for all associates. We also conduct regular training throughout the year for our associates, as well as third-party contractors, on cybersecurity topics. We conduct training on phishing, social engineering and general cybersecurity awareness. To validate the effectiveness of our training, simulated phishing campaigns are conducted periodically for all associates. Additionally, third party software vendors and service providers who have access to our data or systems are obligated to adhere to our information security policies and standards as part of their service agreements.


text: Cybersecurity Governance Our Board of Directors (the "Board") employs a principles-based approach to identify and monitor the myriad of risks impacting the Company, including cybersecurity risks. The executive leadership team monitors our risk environment, including attempting to identify potential unknown risks, and regularly reports on such matters to our Board or committees thereof. We have an enterprise risk management ("ERM") program designed to identify, assess, prioritize, manage and mitigate major risk exposures that could affect our ability to execute on our corporate strategy and fulfill our business objectives. Our ERM program is administered by a risk council made up of members of senior management supported by subject matter experts within our organization. The Board fulfills certain risk oversight functions through its standing committees. Representatives of the risk council report to the Audit Committee on risk exposure, management and tolerance, and related matters. The Audit Committee oversees the risks related to the integrity of the Company's financial statements and receives an ERM report at least annually. Further, the Company's Disclosure Controls Committee reports directly to the Audit Committee on certain matters relating to our public disclosures. Our Nominating and Governance Committee has the responsibility of periodically monitoring, reviewing and discussing with management the Company's cybersecurity preparedness, vulnerabilities, defenses and planned responses, including related risk management programs and practices.


text: As discussed above, our cybersecurity team oversees information security, cyber and technology risk and IT compliance. As of December 31, 2023, our cybersecurity team consisted of 13 associates with an average of approximately 14 years of cybersecurity experience, all of whom hold college degrees, including three that hold a master's degree (two of which are in the field of information security), along with 52 professional certifications in aggregate. Our cybersecurity team is led by a Senior Director of Cybersecurity, who reports through one of our Vice Presidents to our Chief Technology and Innovation Officer, who is a member of the executive team.


text: At least quarterly, our cybersecurity team provides a report to our Nominating and Governance Committee and, at least annually, to the full Board regarding our technology and cybersecurity risk profile, programs and key initiatives, including the maturity of our cybersecurity framework and how we compare to selected industry benchmarks.


text: Our risk oversight activities, including those related to cybersecurity, are supported by internal reporting structures. These structures include protocols in the event of an incident, including the escalation by the cybersecurity team through its reporting structure to the executive team, our Disclosure Controls Committee, our risk council made up of members of our senior management supported by subject matter experts within our organization that administers our ERM program, our Nominating and Governance Committee and the Board, depending on the level of the threat or incident.


text: For additional information regarding how cybersecurity threats are reasonably likely to materially affect our business strategy, results of operations or financial condition, see "Risk Factors — Risks Relating to Our Business — We rely on network and information systems and other technology, and a disruption or failure of such networks, systems or technology as a result of cybersecurity incidents, as well as outages, natural disasters (including extreme weather), pandemics, terrorist attacks, accidental releases of information or similar events, may disrupt our business" and "Risk Factors — Risks Related to Our Business — Security breaches and other disruptions, including cyber-attacks, and our actual or perceived failure to adequately protect business and consumer data could give rise to liability or reputational harm."


text: Cybersecurity Risk Management and Strategy We employ a layered security approach leveraging people, process and technology — structuring our cybersecurity program to align with the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF"). We also intend that our cybersecurity program aligns with applicable laws and regulatory requirements. For example, CALEA requires broadband providers to affirmatively secure their networks from unlawful access to or interceptions of communications. Our program and the related controls we employ are designed to identify and assess risk with the aim of preventing, detecting or mitigating cybersecurity risks to avoid material harm to our business, customers, associates and other stakeholders.


text: We also incorporate intelligence sharing about emerging threats through collaboration with other companies in our industry, consultants and public-private partnerships with government intelligence agencies, such as the Arizona Cyber Threat Response Alliance ("ACTRA") and NCTA-The Internet and Television Association ("NCTA").


text: Cybersecurity Governance Our Board employs a principles-based approach to identify and provide oversight with respect to the myriad of risks impacting the Company, including cybersecurity risks. The executive leadership team monitors our risk environment, including attempting to identify potential unknown risks, and regularly reports on such matters to our Board or committees thereof. We have an enterprise risk management ("ERM") program designed to identify, assess, prioritize, manage and mitigate major risk exposures that could affect our ability to execute on our corporate strategy and fulfill our business objectives. Our ERM program is administered by a risk council made up of members of senior management supported by subject matter experts within our organization. The Board fulfills certain risk oversight functions through its standing committees. Representatives of the risk council report to the Audit Committee on risk exposure, management and tolerance, and related matters. The Audit Committee oversees the risks related to the integrity of the Company's financial statements and receives an ERM report at least annually. Further, the Company's Disclosure Controls Committee reports directly to the Audit Committee on certain matters relating to our public disclosures. Our Nominating and Governance Committee has the responsibility of periodically monitoring, reviewing and discussing with management the Company's cybersecurity preparedness, vulnerabilities, defenses and planned responses, including related risk management programs and practices.


text: As discussed above, our cybersecurity team oversees information security, cyber and technology risk and IT compliance. As of December 31, 2024, our cybersecurity team consisted of 14 associates with an average of over ten years of cybersecurity experience, most of whom hold advanced degrees in the fields of information security and/or cybersecurity, along with over 50 professional certifications in the aggregate. Our cybersecurity team is led by a Senior Director of Cybersecurity, who has over 30 years of global experience across various industries in the areas of information risk, privacy, security and the leadership of cybersecurity teams dedicated to the identification of risks and protection against potential threats as well as the swift detection, response and recovery from adverse incidents. Our Senior Director of Cybersecurity has earned several professional certifications including Certified Information Systems Security Professional (CISSP), Certified Information Systems Auditor (CISA), Certified in Risk & Information Systems Control (CRISC) and Certified Information Security Manager (CISM) and reports through one of our Senior Vice Presidents to our Chief Operating Officer, who is a member of the executive team.


text: As of the date of this Annual Report on Form 10-K, we are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. For additional information regarding cybersecurity-related risks we face, see "Risk Factors — Risks Relating to Our Business — We rely on network and information systems and other technology, and a disruption or failure of such networks, systems or technology as a result of cybersecurity incidents, as well as outages, natural disasters (including extreme weather), pandemics, terrorist attacks, accidental releases of information or similar events, may disrupt our business" and "Risk Factors — Risks Related to Our Business — Security breaches and other disruptions, including cyber-attacks, and our actual or perceived failure to adequately protect business and consumer data could give rise to liability or reputational harm."


text: Cybersecurity Risk Management and Strategy We recognize the importance of information security and we are committed to protecting and preserving the confidentiality, integrity and continued availability of the information we own or that is in our care. We have developed and implemented a cybersecurity program that strives to comply with applicable industry standards, and we assess our program against the National Institute of Standards and Technology (NIST) Cybersecurity Framework.

companyName: ENERGIZER HOLDINGS, INC.

ticker: ENR


text: Our enterprise risk management framework considers cybersecurity risk alongside other applicable risks as part of our overall risk assessment process. Within our comprehensive enterprise risk management framework, our cybersecurity program is led by the Company's Vice President and Chief Information Officer ("CIO") and is overseen by the Company's Executive Vice President and Chief Financial Officer ("CFO"). The program includes the following processes, activities and resources to identify, assess, manage, and mitigate our cybersecurity threats: • An IT security team responsible for managing our cybersecurity risk, assessment processes, security controls, and responses for security breaches and cyberattacks • A cyber incident response plan that provides controls and procedures for responding to cybersecurity incidents and for timely and accurate reporting of any material cybersecurity incident; • The use of external service providers, where appropriate, to assess, perform tabletop exercises, or otherwise assist with aspects of our security controls designed to anticipate cyberattacks and respond to breaches. Procedures include annual internal vulnerability scans and external penetration tests; • Annual cybersecurity training for all employees to provide a better understanding of the issues and risks related to cybersecurity. We realize that cybersecurity is not just the job of the IT security team; the Company and all employees play a critical role in managing the risk; • Periodic phishing testing and other exercises performed by our IT department to test our systems and reinforce the training provided to all colleagues to ensure our employees remain vigilant and compliant with expectations • Easy-to-use tools to report potential phishing emails; and • A third-party cybersecurity risk management process for service providers, suppliers, and vendors performed throughout the year.


text: We have not identified any risks from known cybersecurity threats, including any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. For a discussion on the Company's cybersecurity related risks, see "Risk Factors - We rely significantly on information technology and any inadequacy, interruption, theft or loss of data, malicious attack, integration failure, failure to maintain the security, confidentiality or privacy of sensitive data residing on our systems or other security failure of that technology could harm our ability to effectively operate our business and damage the reputation of our brands" and "Risk Factors - Our business is subject to increasing government regulations in both the U.S. and abroad that could impose material costs" and other risk factors contained in Part 1, Item 1A of this Annual Report on Form 10-K. Cybersecurity Governance The Audit Committee of our Board of Directors is tasked with providing oversight of cybersecurity risk.


text: The Audit Committee receives regular briefings from the CIO regarding the Company's cybersecurity program, cyber threats, and the results of exercises and response readiness assessments performed by outside advisors that assess our cybersecurity program and internal response preparedness, and to receive periodic briefings on cyber threats and our cybersecurity program. The full Board meets with the CIO at least annually to review the Company's cybersecurity program.


text: Our CIO is responsible for assessing and managing our material risks from cybersecurity threats. The IT security team is led by our CIO, who has significant experience across information security, infrastructure, operations and compliance. The team has primary responsibility for our overall cybersecurity risk management program and oversees both our internal cybersecurity personnel and our retained external cybersecurity consultants.


text: Members of our executive leadership team, including our CFO and General Counsel, as well as the other members as needed, supervise efforts to identify, assess, manage and mitigate cybersecurity risks and incidents through various means, including briefings from internal personnel and other information obtained from governmental, public, or private sources, including external consultants engaged by us.


text: Cybersecurity Risk Management and Strategy We recognize the importance of information security and we are committed to protecting and preserving the confidentiality, integrity and continued availability of the information we own or that is in our care. We have developed and implemented a cybersecurity program that strives to comply with applicable industry standards, and we assess our program against the National Institute of Standards and Technology ("NIST") Cybersecurity Framework.


text: Our information technology networks, those of our operators and managers and those of third parties on whom we rely are important enablers to our ability to perform day-to-day operations of our business. Our business operations depend on the secure collection, storage, transmission and other processing of proprietary, confidential or sensitive data.

companyName: American Healthcare REIT, Inc.

ticker: AHR


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats. Our cybersecurity program includes several safeguards such as access controls, multi-factor authentication, continuous monitoring and alerting systems for internal and external threats and external vulnerability testing. Additionally, we conduct regular evaluation of our cybersecurity program, encompassing internal reviews and third-party assessments to ensure its effectiveness and resilience.


text: Our board retains ultimate oversight of cybersecurity risk, which it manages through our enterprise risk management program. Our board has delegated primary responsibility of overseeing cybersecurity risks to the Audit Committee. The Audit Committee's responsibilities include reviewing cybersecurity strategies with management, assessing processes and controls pertaining to the management of our information technology operations and their effectiveness and seeking to confirm that management's response to potential cybersecurity incidents is timely and effective. At least annually, the Audit Committee reviews with the management team our cybersecurity risk exposures and the steps that management has taken to monitor and control such exposures. This review may cover a variety of relevant topics, potentially including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations related to our operators, managers and third parties. The scope and focus of each review are determined based on current priorities and emerging issues in cybersecurity.


text: Management and Cybersecurity Working Group Reporting to the Chief Operating Officer, our Vice President of Information Technology, with extensive cybersecurity knowledge and skills from over 15 years of relevant work experience at our company and elsewhere, leads the team responsible for developing and implementing our information security program across our business. This team comprises individuals with relevant educational and technical experience, including a dedicated IT Systems & Security Administrator, with responsibility for various aspects of cybersecurity within our organizations. This team works closely with the Legal department to oversee compliance and regulatory and contractual security requirements. Our Chief Operating Officer also leads our Cybersecurity Incident Management Team, which is comprised of a cross-functional team including Internal Audit, Legal, Information Technology, Risk Management and Accounting leaders. These individuals meet regularly and are informed about and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents. Our Chief Operating Officer is responsible for reporting on cybersecurity and information technology to the Audit Committee.


text: Information Security Program Our Vice President of Information Technology and his information security team provide regular reports to the Chief Operating Officer and other relevant teams on various cybersecurity threats, assessments and findings. In addition to our internal cybersecurity capabilities, we also periodically engage assessors, consultants, auditors or other third parties to provide consultation and advice to assist with assessing, identifying and managing cybersecurity risks. Our management team identifies and assesses information security risks using industry practices, including those informed by the National Institute of Standards and Technology.


text: Incident Response The Cybersecurity Incident Management Team maintains and oversees an incident response plan that applies in the event of a cybersecurity threat or incident to provide a standardized framework for responding to cybersecurity incidents. The incident response plan sets out a coordinated approach to investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate. The objectives of the incident response plan are to reduce the number of systems and users affected by security incidents, reduce the time a threat actor spends within our network, reduce the damage caused by the breach and reduce the time required to restore normal operations. The incident response plan also specifies the use of third-party experts for legal advice, consulting and cyber incident response.


text: Material Cybersecurity Risks, Threats and Incidents While we employ several measures to prevent, detect and mitigate cybersecurity threats, there is no guarantee such efforts will be successful. We also rely on information technology and other third-party vendors to support our business, including securely processing personal, confidential, financial, sensitive or proprietary and other types of information. Despite our efforts to improve our ability, and the ability of relevant third parties', to protect against cyber threats, we may not be able to protect all information, systems, products and services. While we are not aware of any cybersecurity incidents that have materially affected us to date, there can be no guarantee that we will not be the subject of future attacks, threats or incidents that may have a material impact on our business strategy, results of operations or financial condition. Additional information on cybersecurity risks we face can be found in Part I, Item 1A "Risk Factors" of this Annual Report on Form 10-K under the heading "A breach of information technology systems on which we rely could materially and adversely impact us," which should be read in conjunction with the foregoing information.


text: Risk Management and Strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats. Our risk management strategy begins with identifying areas of risk through risk assessment and an annual review of our practices and policies against the National Institute of Standards and Technology, or NIST, Cybersecurity Framework. This framework encompasses six major focus areas and 106 subcategories. The results of each assessment are thoroughly analyzed to strengthen our security posture and maintain a comprehensive cybersecurity program.


text: In connection with these focus areas, we have implemented a variety of technical, physical and administrative controls to proactively prevent, detect and mitigate cybersecurity threats. These measures are designed to limit the impact of potential breaches by employing advanced logging and monitoring, robust access controls, multifactor authentication, firewalls, anti-malware and antivirus solutions, endpoint detection and response systems, network inspection tools, intrusion prevention mechanisms, content filtering and comprehensive patch and vulnerability management. Endpoints are routinely reviewed and scanned, with our Information Technology team addressing any identified issues to ensure ongoing protection.


text: We also engage external vendors to conduct external vulnerability scanning and assess our policies and practices. To safeguard critical systems, we maintain encrypted, immutable backups and conduct regular testing to confirm their confidentiality, integrity and availability. These efforts are reinforced by routine disaster recovery tabletop exercises and restore testing, ensuring that our organization is prepared for any potential disruptions. In addition to our internal cybersecurity capabilities, we also periodically engage assessors, consultants, auditors and other third parties to provide consultation and advice to assist with assessing, identifying and managing cybersecurity risks. For instance, we engage third-party consultants to perform annual walkthroughs and design testing of information technology, or IT, general controls on behalf of our Internal Audit team, as well as to test IT control effectiveness throughout the year.


text: We have developed processes to identify and manage cybersecurity risks from our service providers. We assess our operators and managers through due diligence surveys, interviews and risk evaluations. We take cybersecurity and data privacy considerations into account when we source, select and engage with our third-party service providers. Moreover, we document our third-party vendors and suppliers in a centralized registry and review their cybersecurity practices through diligence meetings and SOC2 report evaluations for security, availability of data, processing integrity, confidentiality and privacy controls. These measures help ensure that our partners adhere to best practices and maintain safeguards for our data. We also employ systems and processes designed to oversee, identify and reduce the potential impact of a security incident at a third-party vendor, service provider or otherwise implicating the third-party technology and systems we use. Lastly, we maintain cybersecurity insurance providing coverage for certain costs related to cybersecurity-related incidents that impact our cybersecurity and information technology infrastructure.


text: As of December 31, 2024, we are not aware of any cybersecurity threats or incidents that have materially affected us; however, there can be no guarantee that we will not be the subject of future attacks, threats or incidents that may have a material impact on our business strategy, results of operations or financial condition. Additional information on cybersecurity risks we face can be found in Part I, Item 1A, Risk Factors, of this Annual Report on Form 10-K under the heading "A breach of, or failure in, information technology systems on which we rely could materially and adversely impact us," which should be read in conjunction with the foregoing information.


text: Reporting to the Chief Operating Officer, our Vice President of Information Technology, who has extensive cybersecurity knowledge and skills from over 16 years of relevant work experience at our company and elsewhere, leads our Information Technology team, which is responsible for developing and implementing our information security program across our business. The Information Technology team comprises individuals with relevant educational and technical experience, including a dedicated IT Systems & Security Administrator. It works closely with the Legal department to oversee compliance and regulatory and contractual security requirements. Our Chief Operating Officer leads the Cybersecurity Incident Management Team, a cross-functional team that comprises Internal Audit, Legal, Information Technology, Risk Management and Accounting leaders. These individuals meet regularly and receive reports of, and monitor, the prevention, mitigation, detection and remediation of cybersecurity incidents. Our Chief Operating Officer is also responsible for reporting on cybersecurity and information technology to the Audit Committee.


text: We maintain and periodically review and update an incident response plan that applies in the event of a cybersecurity threat or incident to provide a standardized framework for responding to cybersecurity incidents. The incident response plan sets out a coordinated approach to investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate. The objectives of the incident response plan are to reduce the number of systems and users affected by security incidents, reduce the time a threat actor spends within our network, reduce the damage caused by the breach and reduce the time required to restore normal operations. The incident response plan also specifies the use of third-party experts for legal advice, consulting and cyber incident response.


text: Our board has the ultimate oversight of cybersecurity risk, which it manages through our enterprise risk management program. Our board has delegated primary responsibility of overseeing cybersecurity risks to the Audit Committee. The Audit Committee's responsibilities include reviewing cybersecurity strategies with management, assessing processes and controls pertaining to the management of our information technology operations and their effectiveness and making sure that management's response to potential cybersecurity incidents is timely and effective. At least annually, the Audit Committee reviews with the management team our cybersecurity risk exposures and the steps that management has taken to monitor and control such exposures. This review may cover a variety of relevant topics, potentially including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations related to our operators, managers and other third-party partners. The scope and focus of each review are determined based on current priorities and emerging issues in cybersecurity. In addition, we engage third-party consultants to test our IT control effectiveness throughout the year, and any known exceptions and test results are communicated to management and the Audit Committee on a quarterly basis.


text: CYBERSECURITY RISK MANAGEMENT AND STRATEGY Our Information Security Program is designed to support the Company in identifying, protecting, detecting, responding to, and recovering from cybersecurity threats and incidents (collectively, "cybersecurity risks") with the intention to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: PayPal Holdings, Inc.

ticker: PYPL


text: We design and regularly assess our Information Security Program guided by National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) and ISO standards (including ISO 27001), proprietary controls and industry best practices.


text: Our Information Security Program is built on a three lines of defense model integrated into our overall Enterprise Risk and Compliance Management Program ("ERCM Program"). It shares common methodologies, reporting channels, and governance processes that apply across the ERCM Program to other legal, compliance, strategic, operational, and financial risk areas. The Program is governed by the Technology, Information Security, and Privacy Risk Management Committee and overseen by our Board of Directors ("Board") and its Audit, Risk and Compliance Committee ("ARC Committee").


text: The three lines of defense model is designed to provide a structure for risk accountability in the first line of defense ("FLOD"), effective challenge by the second line of defense ("SLOD"), and independent risk assurance by the third line of defense ("TLOD"). Our Office of the Chief Information Security Officer serves as FLOD and provides operational and technical controls and capabilities to protect against cybersecurity risks. The Technology and Information Security team serves as SLOD and provides independent oversight of our technology and cybersecurity risk mitigation practices and capabilities. As TLOD, Internal Audit independently assesses the effectiveness of our first and second line of defense organizations in managing cybersecurity risk and independently reports the results of audits to our ARC Committee to assist it in its oversight duties.