text: Our Board of Directors has assigned oversight of cybersecurity risk management to the Audit Committee. The Audit Committee regularly receives reports from management, including IT leadership, and third parties on cybersecurity matters. In addition, our full Board of Directors receives reports addressing cybersecurity as part of our overall enterprise risk management program and to the extent cybersecurity matters are addressed in regular business updates. We periodically engage third-party audit and legal firms with industry-recognized expertise on cybersecurity matters to review specific aspects of our cybersecurity enterprise risk management framework and controls.


text: IT leadership is responsible for developing appropriate cybersecurity programs, including as may be required by applicable law or regulation. This includes the coordination and creation of an Incident Response Policy, Incident Response Team, and Incident Response Plan in the event of a cybersecurity event. The AOB Incident Response policy covers our internal program and guidelines. The incident response team is composed of various stakeholders from all necessary aspects of the business, and the plan includes the steps to follow and communications necessary if/when a cybersecurity event occurs. The individual incident response team members represent expertise in IT, cybersecurity, finance, and operations that has been obtained generally from a combination of education and awareness, including relevant degrees and/or certifications, and work experience. The Director of IT has served in various roles in information technology and information security for 30 years, including serving in technical management and leadership positions in multiple verticals. The Director of IT holds undergraduate and graduate degrees in computer science and has attained several recognized network and security certifications throughout their career. The individual incident response team members are informed by their respective cybersecurity teams regarding the monitoring, prevention, detection, mitigation and remediation of cybersecurity incidents as part of the cybersecurity programs described above.

companyName: American Outdoor Brands, Inc.

ticker: AOUT

secItem: Item 1C


text: Information regarding cybersecurity risks may be elevated by IT leadership through a variety of channels, including discussions between or among key leaders and our management and reports to the Company's Board of Directors and/or certain Board committees. When a cybersecurity incident is detected, we conduct an immediate assessment, determine materiality, and take appropriate actions as described above. This process is also followed when we are notified that a supplier has a cybersecurity incident. As noted above, the Audit Committee regularly receives reports on cybersecurity matters from senior IT leadership.


text: Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition.


text: The Company's cybersecurity program is focused on continuous improvement and takes a layered approach to cybersecurity to include prevention, detection, and response-based controls. Our preventative measures include network-based controls, malware defenses, email security, encryption for data in motion and at rest, continuous vulnerability testing and mitigation, and multi-factor authentication. Our detection and response measures include comprehensive logging and continuous monitoring utilizing both in-house and Managed Security Services, forensics capability, and an enterprise crisis management function. Alight employees are assigned data privacy and security training upon on-boarding and annually thereafter. The training is designed in collaboration with a third-party service provider and is designed to raise awareness of security practices and to educate employees on how to protect information and infrastructure.

companyName: Alight, Inc. / Delaware

ticker: ALIT


text: Our Chief Technology Officer, Chief Information & Security Officer and Chief Legal Officer provide periodic reports on our cybersecurity and risk management efforts, including with respect to information security practices, to the Audit Committee of our Board of Directors (the "Audit Committee"), as well as to other members of our executive leadership team, as appropriate. These reports include updates on the Company's cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape. Where appropriate, the Audit Committee then periodically reports to the full Board of Directors regarding the Company's assessment of potential risk exposures and the steps management has taken to monitor and control such risks, which includes the Company's cybersecurity program designed to prevent, detect, and rapidly respond to any potential incident. In addition to our scheduled meetings, the Audit Committee and executive leadership team maintain an ongoing dialogue regarding emerging or potential cybersecurity risks. Together, they receive updates on significant developments in cybersecurity to facilitate proactive and responsive oversight. The Audit Committee is apprised of strategic decisions related to cybersecurity, offering guidance and approval for major initiatives. This involvement helps drive integration of cybersecurity considerations into our Company's broader strategic objectives.


text: Our Chief Information & Security Officer has over 30 years of experience in the cybersecurity industry, including, prior to joining Alight in 2021, as the SVP, Chief Information Security Officer at a multinational health insurance and health services company in the Fortune 100, and as head of cybersecurity for a U.S.-based financial services company in the Fortune 500, as well as for a federal banking institution and for a professional services company in the Fortune 500 specializing in information technology services. Our Chief Information & Security Officer reports directly to the Chief Technology Officer and meets regularly with other members of senior management and the Audit Committee.


text: Our program is regularly evaluated by internal stakeholders and external parties with the results of those reviews reported to the executive leadership team and the Audit Committee, as appropriate. We also actively engage with key vendors, industry participants, and intelligence and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures. Our results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future incidents. To further preemptively mitigate the potential financial impact of cybersecurity incidents, we maintain liability insurance that includes cyber coverage. However, our insurance may be inadequate or may not be available in the future on acceptable terms, or at all. In addition, our insurance may not cover any or all incidents that occur or claims made against us, and addressing an incident or defending a suit, regardless of its merit, could be costly and divert management's attention from our business and operations. For more information on our cybersecurity related risks, see the Risk Factors in Item 1A. of this Annual Report.


text: Cybersecurity Risk Management and Strategy We have established and implemented a cybersecurity risk management program and information privacy program (collectively, our "Cybersecurity and Privacy Programs") that are collectively intended to protect the confidentiality, integrity, and availability of our critical information systems and the information residing therein. These programs are integrated into, and form a part of, our overall enterprise risk management program, and share similar methodologies, reporting channels and governance processes to those that apply across the broader enterprise risk management framework.

companyName: GoodRx Holdings, Inc.

ticker: GDRX


text: Our Cybersecurity and Privacy Programs include: • Teams responsible for managing security and privacy controls, risk assessments, and responding to cybersecurity incidents; • Security and privacy awareness training of our employees; • Privacy and security risk assessments designed to identify material privacy and/or cybersecurity risks to our systems, processes, and assets; • The use of external service providers to assist with privacy and security controls, including vulnerability management; • An incident response plan with trained personnel and personnel that are trained to execute the plan; and, • A third-party risk management process for service providers and vendors.


text: We are subject to an evolving threat landscape that could pose various risks to our business, and such risks are regularly evaluated and managed via our Cybersecurity and Privacy Programs by internal and external experts. We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information regarding risks related to cybersecurity matters, please see Part I, Item 1A, "Risk Factors—We depend on our information technology systems, and those of our third-party vendors, contractors and consultants, and any failure or significant disruptions of these systems, security breaches or loss of data could materially adversely affect our business, financial condition and results of operations."


text: Cybersecurity Governance Our Board and its committees have an active role in overseeing risk management and they have delegated to the Compliance Committee oversight over our cybersecurity and data privacy risks. The Compliance Committee oversees management's implementation of our Cybersecurity and Privacy Programs, except to the extent direct oversight by the Board is required by the FTC Order.


text: The Compliance Committee receives periodic reports from management regarding cybersecurity and privacy risks, any material updates thereto and a summary of any cybersecurity and/or privacy events or incidents that have occurred, in each case, since the most recent update provided to the Compliance Committee. The Compliance Committee reports to the full Board regarding its activities, including those related to cybersecurity and privacy. In addition, at least once every twelve months and promptly after the occurrence of certain specified cybersecurity/data privacy incidents, the Board and our Interim Chief Executive Officer receive the written Cybersecurity and Privacy Program materials, which include the results of the most recent cybersecurity and privacy risk assessment and any evaluations thereof or updates thereto (collectively, the "Reporting Materials"). On an annual basis, management also leads the Board through a comprehensive review of the Reporting Materials, including, among other things, a review of the identified material cybersecurity and privacy risk exposures and the safeguards implemented to control such risk exposures.


text: Our Security Team is responsible for assessing and managing our material risks from cybersecurity threats and is primarily responsible for our overall Cybersecurity and Privacy Programs and collaborates with other employees and third parties to identify and mitigate applicable risks. The Security Team's experience includes various industry certifications (e.g., CISSP, CISM, CCSP, CISA, etc.), and industry experience (e.g., healthcare, technology, critical infrastructure, etc.).


text: Under the Cybersecurity and Privacy Programs, our Security Team monitors, prevents, detects, mitigates, and remediates cybersecurity risks and incidents via various means, including monitoring threat intelligence from various sources, internal and external vulnerability management, and alerts and reports produced by security tools. Reporting of such risks is regularly provided to the Board and the Compliance Committee, as applicable.


text: Cybersecurity Risk Management and Strategy We have established and implemented a cybersecurity risk management program and information privacy program (collectively, our "Cybersecurity and Privacy Programs") that are collectively intended to protect the confidentiality, integrity, and availability of our critical information systems and the information residing therein. These programs are integrated into, and form a part of, our overall risk management program, and share similar methodologies, reporting channels and governance processes to those that apply across the broader risk management framework.


text: Key elements of our Cybersecurity and Privacy Programs include, bu t are not limited to the following: • Teams responsible for managing security and privacy controls, risk assessments, and responding to cybersecurity incidents; • Security and privacy awareness training of our employees; • Privacy and security risk assessments designed to identify material privacy and/or cybersecurity risks to our systems, processes, and assets; • The use of external service providers to assist with privacy and security controls, including vulnerability management; • An incident response plan with trained personnel and personnel that are trained to execute the plan; and, • A third-party risk management process for service providers and vendors.


text: We are subject to an evolving threat landscape that could pose various risks to our business, and such risks are regularly evaluated and managed via our Cybersecurity and Privacy Programs by internal and external experts. We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. For more information regarding risks related to cybersecurity matters, please see Part I, Item 1A, "Risk Factors—We depend on our information technology systems, and those of our third-party vendors, contractors and consultants, and any failure or significant disruptions of these systems, security breaches or loss of data could materially adversely affect our business, financial condition and results of operations."


text: Cybersecurity Governance Our Board and its committees have an active role in overseeing risk management and they have delegated to the Audit and Risk Committee oversight over our cybersecurity and data privacy risks, including oversight of management's implementation of our Cybersecurity and Privacy Programs, except to the extent direct oversight by the Board is required by the FTC Order. The Audit and Risk Committee oversees management's implementation of our Cybersecurity and Privacy Programs, except to the extent direct oversight by the Board is required by the FTC Order.


text: The Audit and Risk Committee receives periodic reports from management regarding cybersecurity and privacy risks, any material updates thereto and a summary of any cybersecurity and/or privacy events or incidents that have occurred, in each case, since the most recent update provided to the Audit and Risk Committee. The Audit and Risk Committee reports to the full Board regarding its activities, including those related to cybersecurity and privacy. In addition, at least once every twelve months and promptly after the occurrence of certain specified cybersecurity/data privacy incidents, the Board and our Chief Executive Officer and President receive the written Cybersecurity and Privacy Program materials, which include the results of the most recent cybersecurity and privacy risk assessment and any evaluations thereof or updates thereto (collectively, the "Reporting Materials"). On an annual basis, management also leads the Board through a comprehensive review of the Reporting Materials, including, among other things, a review of the identified material cybersecurity and privacy risk exposures and the safeguards implemented to control such risk exposures.


text: Our Security Team is responsible for assessing and managing our material risks from cybersecurity threats and is primarily responsible for our overall Cybersecurity and Privacy Programs and collaborates with other employees and third parties to identify and mitigate applicable risks. Our Security Team is composed of certified cybersecurity professionals responsible for assessing and managing cybersecurity risks, led by the Senior Director of Information Security & Compliance. The qualifications of our Security Team include the following industry-recognized certifications: ISC2 Certified Information Systems Security Professional (CISSP), Certified Ethical Hacker (C|EH), Certified Incident Handler (GCIH), Certified Intrusion Analyst (GCIA), GSEC, CompTIA Security+, A+ Network+, CISM, CCSK, MCSA, MCSE, MCP, MCT, and Cisco Certified Network Associate (CCNA). The Senior Director of Information Security & Compliance reports to our Chief Technology Officer, who has over 19 years of experience in information technology. The Senior Director of Information Security & Compliance brings over 13 years of experience in risk management, cybersecurity and compliance. The Security Team's experience in information security and cybersecurity spans across various industries, including healthcare, technology, and critical infrastructure.


text: Under the Cybersecurity and Privacy Programs, our Security Team monitors, prevents, detects, mitigates, and remediates cybersecurity risks and incidents via various means, including monitoring threat intelligence from various sources, internal and external vulnerability management, and alerts and reports produced by security tools. Reporting of such risks is regularly provided to the Board and the Audit and Risk Committee, as applicable.


text: We are materially dependent upon our networks, information technology infrastructure and related technology systems to provide services to our customers, manage our internal operations and support our strategic objectives. Cyber-attacks have become prevalent in our industry, and the techniques used to sabotage or obtain unauthorized access to systems are constantly expanding and evolving. Malicious actors are increasingly sophisticated in their methods, tactics, techniques and procedures, seeking to steal money, gain unauthorized access to, destroy or manipulate data, and disrupt operations.

companyName: Rackspace Technology, Inc.

ticker: RXT


text: As of the date of this report, we have not identified any cybersecurity threats or cybersecurity incidents that have materially affected or are reasonably anticipated to have a material adverse effect on our business. However, we have experienced and expect to continue to experience cybersecurity threats and cybersecurity incidents. As an example, in December 2022, we previously disclosed a ransomware incident that caused service disruptions for our Hosted Exchange customers. We are committed to maintaining robust governance and oversight of cybersecurity risks and implementing recognized industry best practices to help prevent, detect, mitigate and respond to these risks; however, we cannot provide assurance that cybersecurity risks will not materially affect our business in the future, including our business strategy, results of operations, or financial condition or that our controls, processes and procedures will be fully complied with or that our program will be fully effective in protecting the confidentiality, integrity and availability of our information systems.


text: Cybersecurity threats, whether or not successful, could result in our incurring significant costs related to rebuilding our internal systems, writing down inventory value, implementing additional threat protection measures, providing modifications or replacements to our products and services, defending against litigation, responding to regulatory inquiries or actions, paying damages, providing customers with incentives to maintain a business relationship with us, or taking other remedial steps with respect to third parties, as well as incurring significant reputational harm. In addition, these threats are constantly evolving, thereby increasing the difficulty of successfully defending against them or implementing adequate preventative measures. We have seen an increase in cyberattack volume, frequency and sophistication.


text: See "Risk Factors - Security breaches, cyber-attacks and other interruptions to our or our third-party service providers' infrastructure have disrupted and may continue to disrupt our internal operations and we may be exposed to claims and liability, lose customers, suffer harm to our reputation, lose business-critical compliance certifications and incur additional costs." for more information on our cybersecurity risks.


text: Risk Management and Strategy Cybersecurity risk management is a component of the company's broader enterprise risk management program and we have established cybersecurity policies and procedures to protect against and mitigate harm from cybersecurity incidents. We respond to cybersecurity incidents in accordance with our cybersecurity policies and procedures and applicable law. Rackspace maintains a cross-functional approach to cybersecurity risk, which is designed to help prevent, identify, assess, manage, mitigate, and respond to cybersecurity threats.


text: Our cybersecurity strategy focuses on implementing effective and efficient controls, technologies, and other processes to assess, identify, manage and address material cybersecurity risks. These include, among other things: annual and ongoing security awareness training for employees; mechanisms to detect and monitor unusual network activity; and containment and incident response tools. We monitor issues that are internally discovered or externally reported that may affect our operations, systems, network, data, products and/or services, and have processes to assess those issues for potential cybersecurity impact or risk.


text: We regularly assess and deploy technical safeguards designed to protect our information systems from cybersecurity threats. Such safeguards are regularly evaluated and improved based on vulnerability assessments, cybersecurity threat intelligence and incident response experience. Our cybersecurity policies and procedures include incident response plans which guide our employees, senior management, the Audit Committee and the Board on our response to cybersecurity incidents, including escalation processes, as appropriate.


text: Our team engages with external cybersecurity advisors and experts, including outside counsel and outside cybersecurity firms, assessors, auditors and consultants as necessary or appropriate. We also maintain numerous industry-related compliance certifications for various aspects of our business, such as International Organization for Standardization ("ISO") 27001, Service Organization Controls ("SOC 1, 2, 3") and Payment Card Industry ("PCI"), Federal Information Security Management Act ("FISMA"), Federal Risk and Authorization Management Program ("FedRAMP") and Health Information Trust Alliance ("HITRUST") in the U.S., Information Security Registered Assessors Program ("IRAP") in Australia and Public Services Network ("PSN") in the U.K.


text: Our cybersecurity policies and procedures are designed to vet key third-party providers and provide for oversight and cooperation regarding cybersecurity incidents. In addition, our cybersecurity policies and procedures require our third-party providers to meet appropriate security requirements and we investigate security incidents that have impacted our third-party providers, as appropriate; however, our ability to monitor our third-party service providers' data security is limited.


text: The Audit Committee of our Board of Directors (the "Board") oversees our cybersecurity risk. The Audit Committee receives regular cybersecurity specific updates from management (including our Chief Security Officer ("CSO") and/or other key personnel), typically on a quarterly basis, about the prevention, detection, mitigation, and remediation of cybersecurity threats and cybersecurity incidents, as well as the evolving cybersecurity landscape, recent program enhancements and other relevant topics. The Audit Committee reports to our Board and a number of our Audit Committee and Board members have experience in assessing and managing cybersecurity risks. In addition to this regular reporting, significant cybersecurity risks or threats may also be escalated to the Audit Committee and/or the Board on an as-needed basis.


text: Management's Role Our CSO leads our overall cybersecurity function and supervises our cybersecurity team's efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents. She provides regular updates directly to the Audit Committee, typically on a quarterly basis. She has over 20 years of experience in information security leadership positions, including with large technology and healthcare companies as well as several large financial institutions. She holds a BS from Arizona State University and has been with us since 2019.


text: Our CSO reports to our President – Artificial Intelligence, Technology and Sustainability, who has been a CIO or CTO of two other large publicly traded companies. He provides overall leadership and guidance for the company's technology department, including the cybersecurity team. He holds an MBA in international business from The Ohio State University, an MCA in computer science from the University of Mumbai, a BS in physics from the University of Madras and has been with us since 2021.


text: Key security, risk, and compliance personnel across a cross-functional group of internal stakeholders, including senior management, meet regularly to develop and continually evaluate our cybersecurity policies and procedures, including discussions of the following: • cybersecurity strategies for preservation of the confidentiality, integrity and availability of company and customer information; • identification, prevention and mitigation of cybersecurity threats and incidents; and • effective response to cybersecurity incidents (including escalation procedures of certain cybersecurity incidents so that decisions regarding public disclosure and other required reporting can be made by the appropriate personnel in a timely manner).


text: The Audit Committee of our Board oversees our cybersecurity risk. The Audit Committee receives regular cybersecurity specific updates from management (including our CSO and/or other key personnel), typically on a quarterly basis, about the prevention, detection, mitigation, and remediation of cybersecurity threats and cybersecurity incidents, as well as the evolving cybersecurity landscape, recent program enhancements and other relevant topics. The Audit Committee reports to our Board and a number of our Audit Committee and Board members have experience in assessing and managing cybersecurity risks. In addition to this regular reporting, significant cybersecurity risks or threats may also be escalated to the Audit Committee and/or the Board on an as-needed basis.


text: Management's Role Our CSO leads our overall cybersecurity function and supervises our cybersecurity team's efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents. She provides regular updates directly to the Audit Committee, typically on a quarterly basis. She has over 20 years of experience in information security leadership positions, including with large technology and healthcare companies as well as several large financial institutions. She holds a Bachelor of Science from Arizona State University and has been with us since 2019.


text: Our CSO reports to our President – Artificial Intelligence, Technology and Sustainability, who has been a Chief Information Officer or Chief Technology Officer of two other large publicly traded companies. He provides overall leadership and guidance for the company's technology department, including the cybersecurity team. He holds a Master of Business Administration in international business from The Ohio State University, a Master of Computer Applications in computer science from the University of Mumbai, a Bachelor of Science in physics from the University of Madras and has been with us since 2021.


text: We are committed to our privacy and security programs, and our security team strives to protect our customer and employee data from cybersecurity risks. From time to time, and at least annually, we review and update if necessary our privacy standards and policies in response to evolving regulatory requirements and internal Unity requirements. Unity personnel are provided annual privacy training, with additional targeted training for key participants in our privacy program. We have procedures in place to address suspected personal-data breaches and notify users determined to be affected and applicable regulator of a breach where we are legally required to do so.

companyName: Unity Software Inc.

ticker: U


text: We have a security policy which outlines mandatory security requirements for all of our employees, contractors or other agents. This policy is supported by internal standards, directives and procedures. The security program includes implementation of software security throughout the development life cycle, vulnerability and configuration management software across certain data infrastructure, products and services. Our risk management process includes employee education and annual analysis of risks from across the company, which are then prioritized for remediation. Our approach to cybersecurity is integrated into our overall company-wide approach to risk management, including that our management team, including our Chief Security Officer and Data Privacy Officer, evaluates material risks from cybersecurity threats against our overall business objectives and regularly reports to both the Audit Committee of our board of directors and to our internal audit function which evaluates our overall enterprise risk.


text: We engage third party services in connection with our processes for vendor security reviews and incidents. We are continuing to develop our processes to oversee and identify the risks from cybersecurity threats associated with our use of any third-party service provider.


text: Because our business involves the collection, use, storage, and transmission of personal information, we are subject to numerous federal, state, local, and foreign laws, regulations, and other obligations relating to privacy and data security. Countries around the world have adopted or are proposing similar laws and regulations relating to privacy and data security, and we may become subject to them as we expand our operations into new geographic markets.


text: Our Chief Security Officer and Data Privacy Officer oversee our assessment, prevention, detection and management of cybersecurity risks, and report to our executive team, including our Chief Information Officer, Chief Financial Officer and Chief Legal Officer. Collectively, they have expertise in cybersecurity, privacy law and regulation, and governance, and their teams comprise personnel with a broad range of experience across the private and public sectors, the technology industry, and in different geographic regions. Our Chief Security Officer Security has over 25 years of experience in multiple business verticals and has led security organizations and managed global practices for Fortune 500 technology companies. He became our Chief Security Officer earlier this year after previously serving in that role at ironSource, prior to its merger with us.


text: Our security team follows an incident response process which we are continuing to evaluate and enhance. Pursuant to this process, incidents which may result in economic loss to the company, reputational harm or require notifications to individuals and government authorities are reported to our executive team as they are occurring. Our Chief Security Officer also provides a quarterly summary of investigations given to an executive data council, and our Data Privacy Officer reports on our compliance posture with respect to new and pending laws and regulations.


text: The Audit Committee of our board of directors is responsible for overseeing our cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats. Additionally, the Audit Committee of our board of directors meets on a quarterly basis with our Chief Security Officer about our cybersecurity risk management and strategy, including any significant investigations, and biannually with our Data Privacy Officer about our privacy program.


text: In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. Despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents. Refer to "Item 1A. Risk Factors" for a description of the risks from cybersecurity threats that may materially affect the Company, including the risk factor titled, "If we or our third-party service providers experience a security breach or unauthorized parties otherwise obtain access to our customers' data, our data, or our platform, our platform may be perceived as not secure, our reputation may be harmed, our business operations may be disrupted, demand for our solutions may be reduced, and we may incur significant liabilities". Unity Software Inc.


text: We are committed to our privacy and security programs, and our security team strives to protect our customer and employee data from cybersecurity risks. From time to time, and at least annually, we review and update if necessary our privacy standards and policies in response to evolving regulatory requirements and internal Unity requirements. Unity personnel are provided annual privacy training, with additional targeted training for key participants in our privacy program. We have procedures in place to address suspected security breaches and notify users determined to be affected and applicable regulators of a breach where we are legally required to do so.


text: We have a security policy which outlines mandatory security requirements for all of our employees, contractors or other agents. This policy is supported by internal standards, directives and procedures. The security program includes implementation of software security throughout the development life cycle, vulnerability and configuration management software across certain data infrastructure, products and services. Our risk management process includes employee education and annual analysis of risks from across the company, which are then prioritized for remediation. Our approach to cybersecurity is integrated into our overall company-wide approach to risk management. Our management team, including our Deputy Chief Security Officer and our Data Privacy Officer, evaluates risks from cybersecurity threats against our overall business objectives and regularly reports to both the Audit Committee of our board of directors and to our internal audit function which evaluates our overall enterprise risk.


text: We engage third party services in connection with our processes for vendor security reviews and incidents. We are continuing to refine our processes to oversee and identify the risks from cybersecurity threats associated with our use of any third-party service provider.


text: Because our business involves the collection, use, storage, and transmission of personal information, we are subject to numerous federal, state, local, and foreign laws, regulations, and other obligations relating to privacy and data security. Countries around the world have adopted or are proposing similar laws and regulations relating to privacy and data security, and we may become subject to them as we expand our operations into new geographic markets. Unity Software Inc.


text: Our Deputy Chief Security Officer and Data Privacy Officer oversee our assessment, prevention, detection and management of cybersecurity risks, and report to our executive team, including our Chief Information Officer, Chief Financial Officer and Chief Legal Officer. Collectively, they have expertise in cybersecurity, privacy law and regulation, and governance, and their teams comprise personnel with a broad range of experience across the private and public sectors, the technology industry, and in different geographic regions. Our Deputy Chief Security Officer Security has over 25 years of experience in multiple business verticals and has led security organizations and managed global practices for Fortune 500 technology companies. He became our Deputy Chief Security Officer after previously serving in that role at ironSource, prior to its merger with us.


text: Our security team follows an incident response process which we are continuing to evaluate and enhance. Pursuant to this process, incidents which may result in economic loss to the company, reputational harm or require notifications to individuals and government authorities are reported to our executive team. Our Chief Security Officer also provides a quarterly summary of investigations given to an executive data council, and our Data Privacy Officer reports on our compliance posture with respect to new and pending laws and regulations.


text: In 2024, we did not identify any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. Despite our efforts, we cannot eliminate all risks from cybersecurity threats or provide assurances that we have not experienced undetected cybersecurity incidents. Refer to "Item 1A. Risk Factors" for a description of the risks from cybersecurity threats that may materially affect the Company, including the risk factor titled, "If we or the third parties with whom we work experience a security breach or unauthorized parties otherwise obtain access to our customers' data, our data, or our platform, our platform may be perceived as not secure, our reputation may be harmed, our business operations may be disrupted, demand for our solutions may be reduced, and we may incur significant liabilities".


text: We have established policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats. We have devoted substantial financial and personnel resources to implement and maintain security measures to meet regulatory requirements, and we intend to continue to make significant investments to maintain the security of our data and cybersecurity infrastructure. There can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective. Our risk factors, which can found be found in Item 1A. "Risk Factors," include further detail about the material cybersecurity risks we face. We have had no cybersecurity incidents to date, and can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations, or financial condition.

companyName: Texas Pacific Land Corp

ticker: TPL


text: We employ a risk-based approach to cybersecurity which aligns with corporate strategy, risk management and governance, and adaptable information technology ("IT") infrastructure. Our cybersecurity program consists of policies, procedures, systems, controls and technology designed to help prevent, identify, detect and mitigate cybersecurity risk and is based on the National Institute of Standards and Technology ("NIST") Cybersecurity framework.


text: We have integrated cybersecurity risk management into our overall risk management framework by (i) maintaining disaster recovery, business continuity and security incident recovery plans, (ii) conducting annual enterprise and IT risk assessments, (iii) implementing periodic key risk indicator tracking, and (iv) holding regular cross-departmental meetings to address cybersecurity risks.


text: Our risk management activities and cybersecurity strategy include IT policies, standards, procedures and systems to address and mitigate risks for critical system availability, network integrity, information protection, and operational continuity.


text: We perform vulnerability and threat monitoring mitigation activities on a regular basis and perform a cybersecurity risk assessment at least annually. Our cybersecurity risk assessment program includes the following assessments and activities: • ensure program alignment with the NIST Cybersecurity framework; and, • prioritize, remediate and ensure effectiveness of critical applications, infrastructure, and information.


text: We regularly collaborate with the Company's internal audit department and third parties with security and infrastructure expertise for review and evaluation of the Company's cybersecurity risk program and the associated IT control environment. We engage third-party service providers to perform annual external penetration testing, disaster recovery testing, and security incident simulations.


text: Infrastructure; Network and Physical Security Our IT infrastructure is secured and continually monitored using a number of tools to effect physical and logical security. We strictly regulate and limit access to servers and networks. Network access is controlled by the network firewall and restricted by stringent access control lists. We also employ (i) network and endpoint intrusion prevention and detection throughout our infrastructure, (ii) systems that monitor our infrastructure and alert our management of potential cybersecurity issues and vulnerabilities, and (iii) a seasoned process for managing and installing patches for third-party applications.


text: We have also implemented the following protective and preventative measures: • identity management and access control safeguards; • encryption of data in transit and at rest; • system and network security and monitoring; • information protection and governance; and, • ongoing systems and equipment maintenance.


text: Incident Response and Recovery Planning We have instituted cybersecurity event detection systems, methods, and supporting processes to perform continuous monitoring, identify and classify events and anomalies, take appropriate actions when necessary and report incidents to the appropriate parties. Our response and recovery capabilities are designed to, among other things, contain any impacts, analyze and mitigate events, track events to resolution, provide effective stakeholder communication, recover and resume operations, and evaluate and improve systems and methods.


text: Third-Party Risk Management We have implemented and continue to maintain the Company's IT policies, standards, procedures, and controls to oversee, identify and manage cybersecurity risks associated with all third-party service providers. These include, but are not limited to, an IT acceptable use policy, a records and information management policy, change control procedures, risk and control registry, attestation report reviews, and configuration standards.


text: Education and Awareness Our policies require each of our employees to complete annual information security training, in addition to other training requirements. The result is an educated, informed, and prepared workforce, with an awareness of potential cybersecurity threats, how they may occur, and how to report and escalate such matters. These training efforts are supplemented with regular corporate-led communications and outreach initiatives to facilitate cybersecurity awareness and ensure employees remain vigilant and informed about cybersecurity threats and trends.


text: Both management and the Board are actively involved in the oversight of risks from cybersecurity threats. TPL's information security program is designed to ensure that management and the Board are adequately informed about, and provided with the tools necessary to monitor, (i) material risks from cybersecurity threats and (ii) the Company's efforts related to the prevention, detection, mitigation, and remediation of cybersecurity incidents.


text: Role of the Board The Board has delegated to the Audit Committee of the Board (the "Audit Committee") primary responsibility for overseeing enterprise risk management, including oversight of risks from cybersecurity threats. The Audit Committee periodically reviews TPL's policies and practices, including incident response plans, for managing cybersecurity risks to ensure that such policies and practices are appropriately tailored to TPL's risk framework. Throughout the year, the Audit Committee receives quarterly IT and cybersecurity updates unless there is a notable event that requires immediate communication. These quarterly updates include cybersecurity risk assessment updates from TPL's Director of Information Technology, including key risk indicators, the steps management has taken to monitor and control such cybersecurity risk exposure, and continuous improvement efforts. In addition to the risk management experience of the Audit Committee members, Ms. Duganier holds the CERT Cybersecurity Oversight Certification from Carnegie Mellon University.


text: Role of Management TPL's cybersecurity risk is managed utilizing a multi-tiered approach by the Company's Director of Information Technology. In addition to the Director of Information Technology, the Company also engages the services of a third party chief information security officer ("CISO"). The qualifications of the Director of Information Technology include over 30 years of IT management, cybersecurity, and information governance experience. The CISO, who reports to the Director of Information Technology, has 21 years of cybersecurity, IT management, and infrastructure consulting experience and is a certified CISO. The Director of Information Technology is regularly informed about the latest developments in cybersecurity, including potential threats, vulnerabilities, and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents.


text: The Director of Information Technology oversees risk management and strategy through (i) an IT operating committee ("the IT Operating Committee") made up of the Director of Information Technology, the CISO, and the Company's department heads, which is responsible for the establishment and review of the Company's IT governance, risk management and compliance, and (ii) an IT steering committee (the "IT Steering Committee") made up of the Company's executives, which provides guidance and oversight to support and achieve TPL's IT objectives, including cybersecurity. Both the IT Operating Committee and the IT Steering Committee meet on a quarterly basis. The IT Operating Committee reviews monthly reports on cybersecurity incident prevention, mitigation, detection, and remediation and reviews the Company's plans and policies related to IT processes on an annual basis. The Director of Information Technology also coordinates with the Company's internal audit department and the Audit Committee to ensure cybersecurity is represented and addressed within the Company's enterprise risk management strategy.


text: We have established policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats. We have devoted substantial financial and personnel resources to implement and maintain security measures to meet regulatory requirements, and we intend to continue to make significant investments to maintain the security of our data and cybersecurity infrastructure. Despite these efforts, our policies and procedures may not be properly followed in every instance and may not always be effective. Our risk factors, which can found be found in Part I, Item 1A. "Risk Factors," include further detail about the material cybersecurity risks we face. We have had no cybersecurity incidents or other risks from cybersecurity threats to date that have materially affected, or are reasonably likely to materially affect, us, including our business strategy, results of operations, or financial condition.


text: We employ a risk-based approach to cybersecurity which aligns with our corporate strategy, risk management and governance, and adaptable information technology ("IT") infrastructure. Our cybersecurity program consists of policies, procedures, systems, controls and technology designed to help prevent, identify, detect and mitigate cybersecurity risk and is based on the National Institute of Standards and Technology ("NIST") Cybersecurity framework.


text: We regularly collaborate with the Company's internal audit department and third parties with security and infrastructure expertise for review and evaluation of the Company's cybersecurity risk program and the associated IT control environment. We engage third-party service providers to perform annual external and internal penetration testing, disaster recovery testing, and security incident simulations.


text: Infrastructure: Network and Physical Security Our IT infrastructure is secured and continually monitored using a number of tools to effect physical and logical security. We strictly regulate and limit access to servers and networks. Network access is controlled by the network firewall and restricted by stringent access control lists. We also employ (i) network and endpoint intrusion prevention and detection throughout our infrastructure, (ii) systems that monitor our infrastructure and alert our management of potential cybersecurity issues and vulnerabilities, and (iii) a seasoned process for managing and installing patches for third-party applications.


text: We have also implemented the following protective and preventative measures: • identity management and access control safeguards; • encryption of data in transit and at rest; • system and network security and monitoring; • information protection and governance; and • ongoing systems and equipment maintenance.


text: Incident Response and Recovery Planning We have instituted cybersecurity event detection systems, methods, and supporting processes to perform continuous monitoring, identify and classify events and anomalies, take appropriate actions when necessary, and report incidents to the appropriate parties. Our response and recovery capabilities are designed to, among other things, contain any impacts, analyze and mitigate events, track events to resolution, provide effective stakeholder communication, recover and resume operations, and evaluate and improve systems and methods.


text: Third-Party Risk Management We have implemented and continue to maintain our IT policies, standards, procedures, and controls to oversee, identify and manage cybersecurity risks associated with all third-party service providers. These include, but are not limited to, an IT acceptable use policy, a records and information management policy, change control procedures, risk and control registry, attestation report reviews, and configuration standards.


text: Role of the Board The Board has delegated to the Audit Committee primary responsibility for overseeing enterprise risk management, including oversight of risks from cybersecurity threats. The Audit Committee periodically reviews TPL's policies and practices, including incident response plans, for managing cybersecurity risks to ensure that such policies and practices are appropriately tailored to our risk framework. Throughout the year, the Audit Committee receives quarterly IT and cybersecurity updates unless there is a notable event that requires immediate communication. These quarterly updates include cybersecurity risk assessment updates from our Director of Information Technology, including key risk indicators, the steps management has taken to monitor and control such cybersecurity risk exposure, and continuous improvement efforts. In addition to the risk management experience of the Audit Committee members, Barbara J. Duganier, a member of the Audit Committee, holds the CERT Cybersecurity Oversight Certification from Carnegie Mellon University.


text: Role of Management Our cybersecurity risk is managed utilizing a multi-tiered approach by our Director of Information Technology. In addition to the Director of Information Technology, we also engage the services of a third-party chief information security officer ("CISO"). The qualifications of the Director of Information Technology include over 30 years of IT management, cybersecurity, and information governance experience. The CISO, who reports to the Director of Information Technology, has 21 years of cybersecurity, IT management, and infrastructure consulting experience and is a certified CISO. The Director of Information Technology is regularly informed about the latest developments in cybersecurity, including potential threats, vulnerabilities, and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents.


text: The Director of Information Technology oversees risk management and strategy through (i) an IT operating committee (the "IT Operating Committee") made up of the Director of Information Technology, the CISO, and our department heads, which is responsible for the establishment and review of our IT governance, risk management and compliance, and (ii) an IT steering committee (the "IT Steering Committee") made up of our executives, which provides guidance and oversight to support and achieve our IT objectives, including cybersecurity objectives. Both the IT Operating Committee and the IT Steering Committee meet on a quarterly basis. The IT Operating Committee reviews monthly reports on cybersecurity incident prevention, mitigation, detection, and remediation and reviews our plans and policies related to IT processes on an annual basis. The Director of Information Technology also coordinates with our internal audit department and the Audit Committee to ensure cybersecurity is represented and addressed within our enterprise risk management strategy.


text: There have been no events in at least the last thirty years that have been considered material enough to warrant changes to systems, processes or controls.

companyName: UTAH MEDICAL PRODUCTS INC

ticker: UTMD


text: Blue Owl has implemented an information security governance policy (the "ISG Policy") governing cybersecurity risk, which is designed to facilitate the protection of sensitive or confidential business, client, investor and any employee information that it stores or processes and the maintenance of critical services and systems. Blue Owl's cybersecurity program is managed by Blue Owl's Chief Technology Officer and Head of Technology Infrastructure (together, "Blue Owl IT Management"), who report to Blue Owl's Chief Operating Officer. Blue Owl IT Management and its team are responsible for implementing proactive and reactive measures, including Blue Owl's monitoring and alert response processes, vulnerability management, changes made to its critical systems, including software and network changes, and various other technological and administrative safeguards. Blue Owl's cybersecurity processes and systems are designed to protect against unauthorized access of information, including by cyber-attacks. Blue Owl's policy and processes include, as appropriate, encryption, data loss prevention technology, authentication technology, entitlement management, access control, anti-virus and anti-malware software, and transmission of data over private networks. Blue Owl's processes and systems aim to prevent or mitigate two main types of cybersecurity risk: first, cybersecurity risks associated with its physical and digital devices and infrastructure, and second, cybersecurity risks associated with third parties, such as people and organizations who have access to its devices, infrastructure or confidential or sensitive information. The cybersecurity-control principles that form the basis of Blue Owl's cybersecurity program are informed by the National Institute of Standards and Technology Cybersecurity Framework ("NIST").

companyName: Blue Owl Credit Income Corp.


text: Management is responsible for mitigating the Company's risks, including cybersecurity. The Board of Directors has the oversight responsibility for the Company's risk management and has delegated its responsibility over cybersecurity to the Audit Committee.

companyName: Abacus Global Management, Inc.

ticker: ABX


text: The Audit Committee periodically reviews the Company's cybersecurity policy and programs established by management to mitigate cybersecurity and data risks. The periodic reviews take place on a quarterly basis and include reports from the Company's cybersecurity team led by the Company's Chief Information Security Officer ("CISO") who has over 10 years of data security experience. The quarterly report provides an overview of cybersecurity threats, key measures in place to mitigate cybersecurity threats and vulnerabilities, provides a status of ongoing security projects to strengthen the Company's cybersecurity posture, as well as plans and resource needs for addressing possible future cybersecurity threats and vulnerabilities. The Company's cybersecurity policy is centered on mitigating risks related to cybersecurity, privacy, physical security, and information security risk management.


text: The Company's cybersecurity risk management approach is reviewed for alignment with the Company's overall risk tolerance. The Company has a dedicated cybersecurity team led by the CISO who is responsible for executing the risk strategy and policies developed in coordination with the Company's Chief Executive Officer, Chief Financial Officer, General Counsel, Presidents, and the Vice Presidents of Finance and Capital Markets.


text: The Company's cybersecurity policy outlines every level of protection put in place to safeguard sensitive data as well as company technology assets, including threats and vulnerabilities posed from our interactions with suppliers and third-party service providers. These layers of protection include physical, local, and network layers as prescribed by standard information technology guidelines. The cybersecurity policy also contains procedures for responding to incidents that may threaten the security of Company systems and/or network, which include multiple layers of protections using current security measures and applications. The effectiveness of our security policy and procedures are tested frequently with periodic effectiveness reports shared with senior management and the Audit Committee to facilitate their risk oversight responsibilities.


text: Following these risk assessments, as necessary, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our Chief Financial Officer, to manage the risk assessment and mitigation processes.

companyName: LENZ Therapeutics, Inc.

ticker: LENZ


text: We engage an IT consultant in connection with our risk assessment processes. This consultant assists us to design and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards. Our oversight over our IT consultant allows us to ensure it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with its work with us, and to promptly report any suspected breach of its security measures that may affect the Company.


text: For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K, including the risk factors entitled "Our internal computer systems, or those of any of our CROs, manufacturers, other contractors or consultants or potential future collaborators, may fail or suffer actual or suspected security or privacy breaches or incidents or other unauthorized or improper access to, use of, or destruction of our proprietary or confidential data, employee data, or personal data, which could result in additional costs, loss of revenue, significant liabilities, harm to our brand and material disruption of our operations, and potentially significant delays in our delivery to market," and "Restrictive laws and regulations govern the collection, use, transfer, and other processing of personal information."


text: Our Chief Financial Officer is primarily responsible for the assessment and management of our material risks from cybersecurity threats, and the oversight of our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. Our Chief Financial Officer and our IT consultant collectively have significant prior work experience in various roles involving managing information security and implementing effective information and cybersecurity programs. They are informed about and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents. Our information technology general controls are firmly established based on recognized industry standards and cover areas such as risk management, data backup, and disaster recovery. We have implemented processes to monitor security threats and vulnerabilities and respond to all cybersecurity incidents that could have an impact on our business operations, including prompt escalation and communication of major security incidents to senior leadership and our board of directors.


text: Our Chief Financial Officer provides annual briefings to the audit committee regarding the Company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. The audit committee provides regular updates to the board of directors on such reports.


text: Risk Management and Strategy We recognize the critical role of developing, implementing, and maintaining cybersecurity measures to protect our information technology networks and systems and the sensitive data of our partners, clients, and members. To manage cybersecurity risks, we use a multi-layered security approach, involving data privacy, application security, physical and environmental security, network access controls, monitoring and incident reporting, administrative and service availability controls, and regulatory compliance. As part of this multi-layered approach, Sharecare utilizes a managed service for its Security Operations Center that monitors all security related events collected in our Security Information and Event Management (SIEM) system 24x7. The SIEM application correlates events from the various systems and applications looking for indicators of compromise, and if found, initiates our incident response protocols. Through data protection, high availability, and built-in redundancy, Sharecare mitigates risks to application availability and minimizes accidental data loss or destruction during a cybersecurity incident, business interruption, or other event.

companyName: Sharecare, Inc.


text: As we utilize third-party service providers for important aspects related to the collection, storage and transmission of sensitive data, we require a risk based vendor management process to ensure the safety of our sensitive data that they store or process. We conduct a formal vendor management process on all third-party service providers that provide services that utilize or create sensitive information, which includes initial and yearly risk assessments performed by experienced third party risk management personnel, annual vendor assessments of performance including onsite review of security programs for vendors that handle sensitive customer data, and entering into Business Associate Agreements with an Information Security Addendum and Data Use Agreements in contracts for vendors that process sensitive Sharecare information that define security requirements, incident reporting, corrective action management and handling of data.


text: As of December 31, 2023, we have not detected any cybersecurity threats, including prior incidents, that have materially impacted the Company, our business or our financial results. For an examination of cybersecurity threats that could potentially have a material impact on us, please refer to our Risk Factors discussion in the section titled, "Security breaches, loss of data, and other disruptions could compromise sensitive information related to our business, partners, clients, or members, or prevent us from accessing critical information and expose us to liability, which could adversely affect our business and reputation."


text: Our Audit Committee oversees the Company's policies and monitoring programs relating to data privacy and security, including cyber or technology related attacks or malfunctions and reviews and discusses with management the Company's risk exposures pertaining to data privacy and security, and management's risk management policies. Our cybersecurity management team provides periodic updates to the Audit Committee, which occur no less than annually. Such updates include information related to threat landscape, risks, initiatives, and security incidents. In the event that any matter requires escalation, such matter would be brought to the Board; however, no matter has required such escalation since the Business Combination.


text: We also identify our cybersecurity threat risks by comparing our processes to standards set by NIST as well as by engaging experts to attempt to penetrate our information systems. To provide for the availability of critical data and systems, manage our material risks from cybersecurity threats, and protect against and respond to cybersecurity incidents, we undertake the following activities: • monitor emerging data protection laws and implement changes to our processes that are designed to comply with such laws; • through our policies, practices and contracts (as applicable), require employees, as well as third parties that provide services on our behalf, to treat confidential information and data with care; • employ technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence; • provide regular, mandatory training for our employees and contractors regarding cybersecurity threats as a means to equip them with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices; • conduct regular phishing email simulations for all employees and contractors with access to our email systems to enhance awareness and responsiveness to possible threats; • leverage the NIST incident handling framework to help us identify, protect, detect, respond and recover when there is an actual or potential cybersecurity incident; and • carry information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident.

companyName: Quantum-Si Inc

ticker: QSI


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "If we experience a significant disruption in our information technology systems, including our Platinum Analysis Software services, or cybersecurity incidents, our business could be adversely affected", which disclosures are incorporated by reference herein.


text: Cybersecurity Governance; Management Cybersecurity is an important part of our broader risk management processes and an area of focus for our Board of Directors and management. In general, our Board of Directors oversees risk management activities designed and implemented by our management, and considers specific risks, including, for example, risks associated with our strategic plan, business operations, and capital structure. Our Board of Directors executes its oversight responsibility for risk management both directly and through delegating oversight of certain of these risks to its committees, and our Board of Directors has authorized our Audit Committee to oversee risks from cybersecurity threats.


text: We plan for our Chief Financial Officer to provide our Audit Committee with quarterly general risk assessment updates, which shall cover cyber risk topics such as data security posture, results from third-party assessments, progress towards predetermined risk-mitigation-related goals, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. Our Audit Committee is also involved in the reporting function of our incident response plan which includes communication of any cybersecurity incident that meets our reporting thresholds, as well as ongoing updates regarding any such incident, until such incident has been resolved.


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Chief Financial Officer in conjunction with our General Counsel and our Head of Information Technology and report to our Audit Committee. In addition, we maintain an Information Technology Steering Committee, which is comprised of several senior members of the Company. Our Chief Financial Officer has over 10 years of experience in leading Information Technology departments at various companies. Our General Counsel has over 10 years of experience related to general legal matters, including in the capacity of understanding and guiding companies on Information Technology matters and the related risks. Our Head of Information Technology has over 30 years of relevant experience, including managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs. These management team members are informed about and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan.


text: Cybersecurity Risk Management and Strategy We have certain processes for assessing, identifying, and managing material risks from cybersecurity threats, which are integrated into our enterprise risk management processes. Specifically, we have processes for: • Identifying and Managing Cybersecurity Risks — We have implemented a cross-functional approach to assessing, identifying and managing material cybersecurity threats and incidents. We periodically review, assess, update and test our policies, standards, processes and practices in a manner intended to address cybersecurity threats and events. The results of such reviews, assessments and tests are evaluated by management and periodically reported to our Audit Committee of the Board of Directors, and our Board of Directors. • Technical Safeguards — We have integrated cybersecurity into our overall information technology operations and designed our processes and systems to help protect our information assets and operations from internal and external cyber threats, protect employee and patient information from unauthorized access or attack as well as secure our networks and systems. • Incident Response and Recovery Planning — To better facilitate our cybersecurity program, our cybersecurity team works collaboratively across our Company to implement programs designed to protect our information systems from cybersecurity threats and to promptly respond to any material cybersecurity incidents. We conduct regular tabletop exercises, including incident simulations to test these plans and ensure personnel are familiar with their roles and responsibilities in a response scenario. • Third-Party Risk Management — We maintain a risk-based approach to identifying and overseeing material cybersecurity threats presented by third parties and the systems of third parties that could adversely impact our business in the event of a material cybersecurity incident affecting those third-party systems. • Education and Awareness — We provide training regarding cybersecurity threats as a means to equip our employees, directors and consultants with tools to make employees, directors and consultants aware of and to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices. We also use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs.

companyName: Humacyte, Inc.

ticker: HUMA


text: Our Board of Directors is responsible for exercising oversight of management's identification and management of, and planning for, risks from cybersecurity threats. While the full Board of Directors has overall responsibility for risk oversight, the Board of Directors has delegated oversight responsibility related to risks from cybersecurity threats to the Audit Committee. The Audit Committee reports to the Board of Directors at least annually, and notifies the Board of Directors as necessary regarding significant new cybersecurity threats or incidents. The Audit Committee of our Board of Directors meets not less than annually to discuss our approach to overseeing cybersecurity threats with management, including with members of our internal cybersecurity team. Any material cybersecurity incidents are promptly reported by management to our Audit Committee.


text: We use an internal management committee to run our information and technology function, comprised of information technology, finance, and legal employees, and led by our Vice President – Information Technology and Automation, and Chief Financial Officer, each of whom have experience managing the information and technology functions, and cybersecurity safeguards, at multiple prior companies. Through ongoing communications with this management committee, senior management is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real-time and reports such threats and incidents to the Audit Committee, when appropriate. Management updates the Audit Committee annually with an overview of our cybersecurity threat risk management and strategy processes. Members of the Audit Committee are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related topics and discuss any updates to our cybersecurity risk management and strategy programs. The Audit Committee is notified between such updates regarding material new cybersecurity threats or incidents that meet pre-established reporting thresholds and any ongoing updates regarding any risk, as needed.


text: We have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations or financial condition. However, as discussed under "Risk Factors" in Part I, Item 1A of this Annual Report on Form 10-K, cybersecurity threats could pose multiple risks to us. As cybersecurity threats become more frequent, sophisticated, and coordinated, it is reasonably likely that we will be required to expend greater resources to continue to modify and enhance our protective measures.


text: Risk management and strategy Our technology platform and other information systems are subject to various cybersecurity risks that could adversely affect our business, financial condition, and results of operations, including intellectual property theft, fraud, extortion, harm to employees or customers, violation of privacy laws and other litigation and legal risk, and reputational risk. We have implemented a risk-based approach to identify and assess the cybersecurity threats that could affect our business and information systems. Our cybersecurity program is aligned with industry standards and best practices. We are currently pursuing a SOC 2 Type 2 Report, and are working to achieve compliance with the National Institute of Standards and Technology ("NIST") 800-171 Cybersecurity Framework.

companyName: MediaAlpha, Inc.

ticker: MAX


text: We have strategically integrated cybersecurity risk management into our broader Enterprise Risk Management Plan to promote a company-wide culture of cybersecurity risk management. An analysis of the potential threat facing the organization tempered with the level of vulnerability to that threat is used to determine the likelihood of risk.


text: We use various tools and methodologies to manage cybersecurity risk that are tested on a regular cadence and at least annually. We also monitor and evaluate our cybersecurity posture and performance on an ongoing basis through regular vulnerability scans, penetration tests and threat intelligence feeds. We generally require third-party service providers with access to personal, confidential or proprietary information to implement and maintain comprehensive cybersecurity practices consistent with applicable legal standards and industry best practices.


text: We use third-party service providers to assist us from time to time to identify and monitor material risks from cybersecurity threats, including legal counsel and other professional services firms, threat intelligence services, and cybersecurity consultants.


text: We are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition.


text: The Board of Directors are acutely aware of the critical nature of managing risks associated with cybersecurity threats. The Audit Committee of the Board has the primary responsibility to oversee effective governance in managing risks associated with cybersecurity threats. Our Audit Committee is composed of members with diverse expertise, including risk management, technology, and finance, equipping them to oversee cybersecurity risks effectively.


text: Our cybersecurity program is managed by a dedicated Chief Information Security Officer ("CISO") with over 25 years of experience, who has held leadership roles during his career managing cybersecurity, information compliance and governance, privacy programs, and risk remediation. The CISO holds several certifications in cybersecurity-related areas, including Certified Information Systems Security Professional (CISSP), Certified in Risk and Information Systems Control (CRISC) and Certified Information Systems Auditor (CISA). The CISO, General Counsel, and the Chief Financial Officer ("CFO") play a critical role in informing the Audit Committee on cybersecurity risks. They provide comprehensive briefings to the Audit Committee, generally on a quarterly basis but at least annually, which encompass a broad range of topics, including: • Current cybersecurity landscape and emerging threats; • Status of ongoing cybersecurity initiatives and strategies; • Incident reports and learnings from any cybersecurity events; and • Compliance with regulatory requirements and industry standards.


text: The Audit Committee also conducts an annual review of the Company's cybersecurity posture and the effectiveness of its risk management strategies.


text: In the event of a cybersecurity incident, the CISO is equipped with a well-defined cyber crisis response plan. This plan includes assigning of the roles and duties of the crisis management team, immediate actions to mitigate the impact of the incident, and long-term strategies for remediation and prevention of future incidents.


text: All incidents are reported to the Security Steering Committee, and events that may result in a material loss are additionally reported to the Audit Committee and evaluated for public disclosure as well as disclosure to the appropriate authorities. The Audit Committee oversees management's remediation actions relating to such events, and approves management's assessment of the materiality of the event to the Company.


text: Risk management and strategy Our technology platform and other information systems are subject to various cybersecurity risks that could adversely affect our business, financial condition, and results of operations, including intellectual property theft, fraud, extortion, harm to employees or customers, violation of privacy laws and other litigation and legal risk, and reputational risk. We have implemented a risk-based approach to identify and assess the cybersecurity threats that could affect our business and information systems. Our cybersecurity program is aligned with industry standards and best practices. We are currently pursuing a SOC 2 Type 2 Report, and are working to achieve alignment with the National Institute of Standards and Technology ("NIST") 800-171 Cybersecurity Framework.


text: In the event of a cybersecurity incident, including aggregation of a series of related incidents, management is equipped with a well-defined cyber crisis response plan. This plan includes assigning of the roles and duties of the crisis management team, immediate actions to mitigate the impact of the incident, and long-term strategies for remediation and prevention of future incidents.


text: All relevant and critical incidents are reported to the Security Steering Committee, and events that may result in a material loss are additionally reported to the Audit Committee and evaluated for public disclosure as well as disclosure to the appropriate authorities. The Audit Committee oversees management's remediation actions relating to such events, and approves management's assessment of the materiality of the event to the Company.


text: Cybersecurity Risk Management and Strategy We confront substantial cybersecurity risks driven by various factors. These risks are rooted in the wide range of systems we must safeguard against cyberattacks, further exacerbated by the complexity and technical sophistication of our products and systems. Additionally, our reliance on third-party products, services, and components adds complexity to our risk landscape.

companyName: OppFi Inc.

ticker: OPFI


text: In response, we have adopted a cybersecurity program to manage cybersecurity risks, prioritizing the protection of data entrusted to us by our customers and other stakeholders. We employ various mechanisms, controls, technologies, and processes aimed at assessing, identifying, and managing these risks.


text: Our cybersecurity program is rooted in industry best practices, drawing upon frameworks established by the National Institute of Standards and Technology ("NIST"), the International Organization for Standardization, and other relevant industry standards. This does not mean that we meet any particular technical standards, specifications, or requirements, but only that we use these standards as a guide to help us design and assess our program.


text: Our policies, standards, processes, and practices for assessing, identifying, and managing material risks from cybersecurity threats are integrated into our overall risk management program. Regular cybersecurity risk assessments are conducted, leveraging both internal and external sources of information to drive alignment on initiatives aimed at enhancing security controls. We maintain a cybersecurity incident response plan that identifies the activities and escalation processes to be implemented upon detection of a cybersecurity incident, and we regularly test and evaluate the effectiveness of such plan.


text: Technical safeguards undergo periodic assessment and enhancement designed to protect information systems from cybersecurity threats, utilizing vulnerability assessments, threat intelligence, and incident response experience. Our policies also mandate that our employees contribute to our security efforts. We regularly remind our employees of the importance of handling and protecting customer and employee data through quarterly security training and testing, aimed at enhancing employee awareness and improving their ability to detect and respond to cybersecurity threats.


text: Additionally, controls have been implemented that are designed to identify and mitigate cybersecurity threats associated with our use of third-party service providers. Certain providers undergo security risk assessments upon onboarding and upon detection of an increase in their risk profile. Our risk assessments utilize various inputs, including information supplied by the providers and third parties. Furthermore, we mandate that our providers meet appropriate security requirements, controls, and responsibilities. We also investigate security incidents impacting our third-party providers as necessary.


text: Our cybersecurity policies, standards, processes and practices are regularly assessed by external consultants and auditors. These assessments include a variety of activities including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. For example, for the last three years, we conducted an independent cyber security risk assessment to assess our cybersecurity maturity against the NIST cybersecurity framework. The results of significant assessments are reported to management and our Audit Committee. Cybersecurity processes are adjusted based on the information provided from these assessments. For more information on our cybersecurity risks that may materially affect us, please refer to the section titled "Risk Factors – Security breaches of borrowers' confidential information that we store may harm our reputation, adversely affect our results of operations and expose us to liability – and – If our risk management framework does not effectively identify and control our risks, we could suffer unexpected losses or be adversely affected, which could have a material adverse effect on our business." While to date we have not identified any breaches from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, the sophistication of cybersecurity threats continues to increase, and the preventative actions we take to reduce the risk of cybersecurity incidents and protect our systems and information may be insufficient. Accordingly, no matter how well our program is designed or implemented, we will not be able to anticipate all security breaches, and we may not be able to implement effective preventive measures against such security breaches in a timely manner, which could result in substantial expenses and reputational damage.


text: Cybersecurity Governance Our Board of Directors and management are actively involved in the oversight of our risk management program, with cybersecurity representing a critical component to ensure alignment with our strategic objectives. The Audit Committee directly oversee and regularly review our cybersecurity program, receiving periodic reports from our Chief Information Security Officer ("CISO") on various matters including risk assessment results, progress of risk reduction initiatives, feedback from external auditors, control maturity assessments, and relevant internal and industry cybersecurity incidents.


text: While our Board of Directors has overall responsibility for the oversight of our enterprise-wide risk management, of which cybersecurity risk management is one component, our management team is responsible for day-to-day risk management, including the implementation of our cybersecurity program. We have established an information security council (the "Information Security Council"), with full participation from our senior management team, to serve as the steward of our information security program. Designed to meet quarterly or more frequently as needed, the council reviews security performance metrics, stays abreast of industry trends and regulatory changes, and evaluates progress on security initiatives. The council plays a crucial role in promoting a culture of security awareness and ensuring OppFi remains resilient against evolving cyber threats.


text: Our corporate information security organization manages and continually enhances a robust enterprise security structure with the goal of averting cybersecurity incidents while increasing our system resilience to minimize the business impact should an incident occur. Led by our CISO, who reports to the Chief Technology Officer ("CTO"), our corporate information security organization is composed of seasoned professionals, some holding certifications such as Certified Information Systems Security Professional or Certified Information Security Manager. Our CTO has served in various leadership roles in information technology for over 20 years, including a nine-year tenure as the Chief Technology Officer at a fintech company. He holds a bachelor's degree in computer engineering and a master's degree in information systems. Our CISO, with over 20 years of leadership experience in IT and security, was a CISO at a financial services company before joining OppFi. She has an MBA and a master's degree in Computer Information Systems and is a Certified Information Security Manager (CISM). Additionally, both the CISO and CTO are members of the Information Security Council, providing regular updates to our senior management team regarding our cybersecurity program, mitigation strategy, and progress.


text: The day to day operations of our cybersecurity risk management program are overseen by our Director of IT, who reports to our Chief Financial Officer. Our Director of IT has served in this position for 5 years. He has over 38 years of IT experience, including over 10 years of experience in security compliance. Our Director of IT supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal personnel, threat intelligence, alerts, or reports produced by security tools deployed in the IT environment.

companyName: AEye, Inc.

ticker: LIDR


text: Cybersecurity is an important priority at SES, and we actively manage this critical risk through comprehensive measures. Our processes for assessing, identifying, and managing material risks from cybersecurity threats are still in development and have yet to be integrated into our overall risk management system and processes.

companyName: SES AI Corp

ticker: SES


text: Proactive Defense: We utilize industry-standard mechanisms to assess, identify, and address potential threats from cybersecurity incidents. Our dedicated information technology (IT) team continuously monitors the evolving cybersecurity landscape and develops robust response processes to swiftly and effectively handle emerging threats.


text: Structured Framework: Our company-wide cybersecurity policy outlines our security posture and incident response protocol, ensuring clear escalation procedures to inform senior management, the Audit Committee, and the Board of Directors of cybersecurity events as needed.


text: Independent Oversight: The Audit Committee, composed entirely of independent directors under SEC and NYSE rules, oversees our cyber risk exposure and evaluates our risk mitigation strategies. The committee is regularly briefed by our VP, IT Services in depth, and in turn briefs the Board of Directors on any material cyber risks and events.


text: Additionally, we use processes to oversee and identify material risks from cybersecurity threats associated with our use of third-party technology and systems, including third party penetration tests, external security audits of our data loss prevention mechanisms and require that our vendors comply with Service Organization Control Type II requirements.


text: Michael Kraus, Vice President of Compliance and Information Technology, leads our information security program with his expertise, honed by over 30 years of experience in the high-tech industry designing and deploying high-performance communication networks. Mr. Kraus has global network building experience which we believe helps to bolster our security posture.


text: While cybersecurity threats remain a reality for all organizations, SES is committed to proactive risk management and continuous improvement in our security posture. We believe that the processes we have established for assessing, identifying, and managing material risks from cybersecurity allow us to effectively mitigate potential impacts and protect our business, operations, and products:


text: In-sourced IT Services: By in-sourcing IT services in late 2023, we gained greater control over IT decisions, established a comprehensive knowledge base, and laid a framework allowing for unbiased assessments of future IT and cybersecurity investments.


text: 24/7 Network Monitoring: Our continuous 24/7 second-level maintenance and monitoring contract provides constant vigilance against network disruptions and potential cyber threats, ensuring swift detection and mitigation of incidents.


text: Cutting-edge Data Backup: Deployment of our new data backup system is underway, offering robust protection against catastrophic failures, early detection of data loss prevention events, and near real-time mitigation of ransomware attacks. Full implementation is anticipated by the end of the first quarter of 2024.


text: In addition, at times we also engage assessors, consultants, auditors, or other third parties to assist with assessing, identifying, and managing cybersecurity risks.


text: We face risks from cybersecurity threats that could have a material adverse effect on our relationship with our partners, suppliers and eventual customers, or on our business, operations or products. We have experienced, and will likely continue to experience, cybersecurity incidents in the normal course of our business, however, we are not aware that we have experienced a material cybersecurity incident during fiscal 2023. See "Risk Factors – Risks Related to Privacy and Security – If we experience a significant cybersecurity breach or disruption in our information systems or any of our partners' information systems, our business could be adversely affected."


text: Independent Oversight: The Audit Committee, composed entirely of independent directors under SEC and NYSE rules, oversees our cyber risk exposure and evaluates our risk mitigation strategies. The committee was briefed by our VP, IT Services in depth, and in turn briefs the Board of Directors on any material cyber risks and events.


text: Previously, our information security program was led by our Vice President of Compliance and Information Technology, who has since left the Company. As of February 25, 2025, the responsibilities of this role are being performed on an interim basis by our IT Manager, whose experience includes two years supporting the cybersecurity function under the Vice President of Compliance and Information Technology. We are currently seeking a replacement to oversee our information security program.


text: In-sourced IT Services: By in-sourcing IT services in late 2023, we gained greater control over IT decisions, established a comprehensive knowledge base, and laid a framework allowing for unbiased assessments of future IT and cybersecurity investments. We have continued improvements using in-sourced IT services throughout 2024.


text: Data Backup: Deployment of our new data backup system was completed in June 2024 and offers robust protection against catastrophic failures, early detection of data loss prevention events, and near real-time mitigation of ransomware attacks.


text: We face risks from cybersecurity threats that could have a material adverse effect on our relationship with our partners, suppliers and eventual customers, or on our business, operations or products. We have experienced, and will likely continue to experience, cybersecurity incidents in the normal course of our business; however, to our knowledge, we have not experienced a material cybersecurity incident during fiscal 2024. See "Part I, Item 1A. Risk Factors – Risks Related to Privacy and Security – If we experience a significant cybersecurity breach or disruption in our information systems or any of our partners' information systems, our business could be adversely affected."


text: Our cybersecurity policies, standards, processes, and practices are fully integrated into the Company's risk management and incident response program and are based on recognized frameworks established by the National Institute of Standards and Technology (NIST), the American Institute of Certified Public Accountants (AICPA), the International Organization for Standardization (ISO) and other applicable industry standards. We take a multi-layered approach to cybersecurity, continually updating, innovating, and refining our security practices, policies and procedures to mitigate risk, meet new industry standards and address the evolving threat landscape. The overall cybersecurity program is modeled on the NIST Cybersecurity Framework and customized to meet our specific needs.

companyName: Matterport, Inc./DE