text: Cybersecurity Governance The Chief Information Security Officer, who is primarily responsible for our cybersecurity strategy and assessing and managing risks from cybersecurity threats, works together with our Chief Information Officer, Chief Risk Officer and compliance organization, as well as other functions, in administering our information security program in a manner that satisfies applicable legal and regulatory requirements. The Chief Information Security Officer has over 19 years of experience in information security, technology audit, and technology operations and includes the design, implementation, and maintenance of greenfield cybersecurity programs for regulated specialty insurance and software-as-a-service companies. The Chief Information Security Officer has a master's degree in information technology with a specialization in cybersecurity augmented with numerous professional designations. The Chief Information Security Officer receives reports on potential cybersecurity threats from throughout the business on an ongoing basis and regularly reviews risk management measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. Further, our team strives to stay current with respect to cybersecurity threats through training and investing in the relevant tools. Our Chief Information Security Officer, Chief Information Officer and Chief Risk Officer provide regular updates and reports to our senior leaders.


text: The Risk Committee of our Board of Directors, in coordination with our management risk committee, has primary responsibility for overseeing cybersecurity, information technology and information security systems, processes, policies and risk management and the effectiveness of security controls. At least quarterly, the Risk Committee meets with management and reviews reports related to the status of our information technology related risks, which includes information such as the status of our environment, employee education, penetration testing, server patching, systems availability, as well as debriefs of Company cybersecurity tabletop exercises, director education sessions on a variety of topics concerning cybersecurity, and annual assessment. The Risk Committee also reviews the Chief Compliance Officer's quarterly report, which includes information regarding certain data security incidents that meet the risk criteria for inclusion in the report. Management also keeps the Risk Committee apprised of changes in the threat landscape, such as new projects or strategies that may involve cybersecurity risks, evolving trends, and cyber incidents that involve our customers and suppliers.

companyName: Enact Holdings, Inc.

ticker: ACT

secItem: Item 1C


text: At least annually, management presents a cybersecurity report to our full Board of Directors along with semiannual briefings. These sessions may cover, among other topics, the information security organization, material risks, technical threats, information technology security infrastructure, patching and vulnerability management, cybersecurity incidents, an annual cybersecurity tabletop exercise and incident preparedness, supplier management, security awareness training, cybersecurity personnel/staffing and a cybersecurity threat assessment.


text: The Company's Board recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Board is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM").

companyName: Amalgamated Financial Corp.

ticker: AMAL


text: The Company's cybersecurity policies, standards, processes and practices are fully integrated into the Company's ERM program and are based on recognized frameworks established by the National Institute of Standards and Technology, the Federal Financial Institutions Examination Council (the "FFIEC"), the International Organization for Standardization and other applicable industry standards and regulations, including regulations promulgated by the NYDFS. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the data and information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. The Company's strategy is informed by determinations of inherent risk and risk maturity level that are made in connection with an independent cybersecurity awareness assessment prepared for the FFIEC.


text: As one of the critical elements of the Company's overall ERM approach, the Company's Information Security Program is focused on the following key areas: • Protecting the confidentiality, integrity, and availability of information systems and the nonpublic information stored on them. • Identifying risks, defending against unauthorized access, and detecting, responding to, and recovering from cybersecurity incidents.


text: Role of Management The Company has implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.


text: The Company has also established a governance structure and organization to manage cybersecurity risk. This includes escalation and reporting of cybersecurity incidents through the Chief Risk Officer's organization to an Executive Response Team and the Board, and periodic reporting on the Information Security Program to the Information Cyber Security Subcommittee of the Enterprise Risk Management Committee, an executive committee that oversees the Information Security Program, and the Enterprise Risk Oversight Committee (the "EROC"), the Board committee that oversees the ERM framework.


text: The Chief Information Security Officer ("CISO"), under the supervision of the Company's Chief Risk Officer ("CRO") in coordination with the Company's executive team, which includes our CEO, CFO, Chief Technology Officer ("CTO") and Chief Legal Officer ("CLO"), works collaboratively across the Company to implement the Information Security Program, which is designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans.


text: The CISO coordinates all aspects of the Information Security Program and presents a report on the Information Security Program to the Information Cyber Security Subcommittee on a quarterly basis so that the Subcommittee is made aware of a wide range of topics including recent developments in the Information Security Program, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties.


text: In the absence of a permanent CISO at December 31, 2023, the Company contracted an interim CISO who previously had served as the Company's interim CTO from July of 2022 through October of 2023. Additionally this contractor served in various roles in information technology and information security for over 25 years, including serving as the Chief Information Officer and Chief Technology Officer of two large public financial services companies. The interim CISO has also performed Information Security leadership roles in two technology companies assessing and managing cyber risk on large amounts of data.


text: The current CTO holds an undergraduate degree in computer science and a master's degree in business administration. and has served in various roles in information technology for over 30 years, including serving as either the Chief Technology Officer or Chief Information Officer of four public companies.


text: Role of the Board of Directors The Board's oversight of cybersecurity risk management is supported by the EROC, which regularly interacts with the Company's ERM function and the CISO.


text: The EROC oversees the Company's ERM process, including the management of risks arising from cybersecurity threats. The EROC receives regular presentations and reports on the Information Security Program, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties.


text: The EROC receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.


text: Although we have not historically experienced significant cybersecurity incidents, we and other banks are subject to attacks of increasing frequency and sophistication. Any significant breach, interruption or failure of our information systems could adversely affect our business operations and our financial condition, operating results and liquidity.


text: Technical Safeguards The Company deploys technical safeguards that are designed to protect Company's data and information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.


text: The Company engages in the periodic assessment and testing of the Company's policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing, stress testing based on top cyberattack scenarios and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning and by leveraging the Federal Reserve Bank of New York methodology for cyber risk ("FFIEC CyberSecurity Assessment Tool"). The Company regularly engages third parties to perform independent assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the EROC, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: Incident Response and Recovery Planning The Company has established and maintains comprehensive incident response and recovery plans that fully address the Company's timely and effective response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis. Multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the CISO monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and reports such threats and incidents to the Executive Response Team of the Company and as guided by the Company's Chief Risk Officer, to the Risk Committee when appropriate.


text: The Company's Security Incident Response Team ("SIRT") structure includes an Executive Response Team ("ERT"). The ERT is composed of all members of the Executive Management Team, the Head of Business Continuity Management, and the CISO (if the incident is due to a cyber breach), and it oversees a Management Response Team ("MRT"). In the event of a security incident, the Company's designated Response Coordinator, who is the Information Security Manager or the CISO's designee, shall investigate the reported security incident and assign an initial severity level. They will gather initial facts about the security incident, analyze information it has received, identify those entities affected by the security incident, assess the preliminary severity and extent of the damage (which can be financial or reputational).


text: If the severity is assessed as Low or Medium in accordance with criteria identified in the incident response and recovery plans, the Response Coordinator will report the incident to the CISO and complete the remediation actions for the cybersecurity incident and report the final outcome to the CISO. The CISO will report to the ERT remediation of Low or Medium cybersecurity incidents at least on a quarterly basis. If the cybersecurity incident is classified as a High, or at the Response Coordinator's discretion, the Response Coordinator will report the cybersecurity incident to the CISO and promptly convene the ERT. The ERT will determine the appropriate steps necessary to respond to the cybersecurity incident and oversee the MRT's execution of the response. The ERT will determine whether the cybersecurity incident needs to be escalated to the Board.


text: Third-Party Risk Management The Company's Vendor Management Program provides a risk-based approach to the assessment, measurement, monitoring, and control of risks related to third parties with whom the Company does business, including vendors, service providers and other external users of Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. In particular, the Company confirms that new and existing service providers are implementing appropriate measures to protect customer information and customer information systems in conformance with the Company's requirements.


text: Education and Awareness Through its Information Security Awareness Program, the Company provides regular, mandatory training regarding cybersecurity threats as a means to equip the Company's personnel with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and effective practices.


text: The Company's cybersecurity policies, standards, processes and practices are fully integrated into the Company's ERM program and are based on recognized frameworks established by the Federal Financial Institutions Examination Council (the "FFIEC"), and other applicable industry standards and regulations, including regulations promulgated by the NYDFS. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the data and information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. The Company's strategy is informed by determinations of inherent risk and risk maturity level that are made in connection with an independent cybersecurity awareness assessment prepared for the FFIEC.


text: The Company has also established a governance structure and organization to manage cybersecurity risk. This includes escalation and reporting of cybersecurity incidents through the Chief Risk Officer's organization to an Executive Response Team and the Board, and periodic reporting on the Information Security Program to the Information Security Subcommittee of the Enterprise Risk Management Committee, an executive committee that oversees the Information Security Program, and the Enterprise Risk Oversight Committee (the "EROC"), the Board committee that oversees the ERM framework.


text: In 2024, the Company appointed a new Chief Information Security Officer (CISO). The new CISO has over 25 years of experience in Cyber Security, Information Security, Risk Management, and Information Technology. He has served as CISO and SVP at a financial institution, overseeing cyber and information security policies and ensuring compliance and security for new product implementations. Previously, he was VP, Head of Cybersecurity at another financial institution and held key roles at a financial services company. He is actively involved in advisory roles and professional boards, and he holds advanced degrees and certifications in information systems and security. The CISO holds a Bachelor's in Science in Managed Information Systems from Saint Peter's University, a Master of Science in Information Systems with a concentration in Information Security from Stevens Institute of Technology, Hoboken, NJ, and a Graduate Certificate in Business Process Management and Service Innovation from Stevens Institute of Technology, Hoboken, NJ.


text: The Company engages in the periodic assessment and testing of the Company's policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, vulnerability testing, stress testing based on top cyberattack scenarios and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning and by leveraging the Federal Reserve Bank of New York methodology for cyber risk ("FFIEC CyberSecurity Assessment Tool"). The Company regularly engages third parties to perform independent assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the EROC, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: Incident Response and Recovery Planning The Company has established and maintains comprehensive incident response and recovery plans that fully address the Company's timely and effective response to a cybersecurity incident, and such plans are tested and evaluated on an annual basis. Multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the CISO monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and reports such threats and incidents to the Executive Response Team of the Company and as guided by the Company's Chief Risk Officer, to the Risk Committee when appropriate.


text: Third-Party Risk Management The Company's Third-Party Risk Management Program provides a risk-based approach to the assessment, measurement, monitoring, and control of risks related to third parties with whom the Company does business, including vendors, service providers and other external users of Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. In particular, the Company confirms that new and existing service providers are implementing appropriate measures to protect customer information and customer information systems in conformance with the Company's requirements.


text: We and our third-party vendors employ information technology, including networks, systems, and applications, to support our business processes and decision-making in our business. Our information technology infrastructure supports the flow of information throughout our business processes and is susceptible to cybersecurity threats. Accordingly, we have implemented and maintain various information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data related to our customers and employees ("Information Systems and Data").

companyName: PLAYSTUDIOS, Inc.

ticker: MYPS


text: We have a cybersecurity leadership team comprised of our Chief Information Security Officer, our Head of Infrastructure, and other senior leaders on our Information Technology group ("Cybersecurity Leadership Team"). Our Cybersecurity Leadership Team works with third-party service providers to help identify, assess, and manage our cybersecurity threats and risks, including through the use of our cybersecurity risk assessment program. Our Cybersecurity Leadership Team identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods, including automated and manual tools, third-party threat feeds, internal audits, access control assessments, and evaluating threats reported to us by various third-party enterprise threat reporting services.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards, and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data.


text: We use third-party service providers to assist us from time to time in identifying, assessing, and managing material risks from cybersecurity threats. Our Cybersecurity Leadership Team inventories and prioritizes information security risks and evaluates material risks from cybersecurity threats, and reports those periodically to the Audit Committee of our Board of Directors, which evaluates our overall enterprise risk.


text: To date, the Company has not experienced a cybersecurity threat or incident that has materially affected or is reasonably likely to materially affect the Company. The Company, however, has experienced and expects to continue to experience cyber incidents of varying degrees. Cybersecurity threats may, among other things, cause material disruptions to our operations, which may materially affect our results of operations and/or financial condition. For more information about risks from cybersecurity threats that may materially affect us and how they may do so, see "Risk Factors — Despite our security measures, we have been subject to attacks by hackers, and our information technology and infrastructure may in the future be vulnerable to attacks by hackers or breached due to employee error, malfeasance, or other disruptions." as well as the other risk factors contained in Item 1A of this Annual Report on Form 10-K.


text: Our Board of Directors has ultimate oversight responsibility over cybersecurity-related matters and has assigned oversight of cybersecurity risk management to the Audit Committee. The Audit Committee assists the Board in fulfilling its oversight responsibilities with respect to the management of risks arising from cybersecurity threats and, in furtherance thereof, regularly receives reports from our senior management and Cybersecurity Leadership Team on cybersecurity matters. These reports are intended to highlight the state of our cybersecurity and data security programs, as well as our progress on key initiatives in this area. In addition, the Board receives reports addressing cybersecurity as part of our overall enterprise risk management program and to the extent cybersecurity matters are addressed in regular business updates. As appropriate, the Board also may receive information regarding specific cybersecurity incidents and resulting mitigation efforts.


text: We have a cybersecurity leadership team comprised of our Chief Information Security Officer ("CISO"), our Global Head of Infrastructure, and other senior leaders on our Information Technology group (" Cybersecurity Leadership Team "). Our Cybersecurity Leadership Team works with third-party service providers to help identify, assess, and manage our cybersecurity threats and risks, including through the use of our cybersecurity risk assessment program. Our Cybersecurity Leadership Team identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods, including automated and manual tools, third-party threat feeds, internal audits, access control assessments, and evaluating threats reported to us by various third-party enterprise threat reporting services. The members of our Cybersecurity Leadership Team, including our CISO, have significant experience in managing and leading cybersecurity teams and in developing and implementing cybersecurity and data privacy systems and processes.


text: Cybersecurity Processes and Risk Assessment Our cybersecurity program is focused on (i) protecting the confidentiality of business, client, investors in our products and employee information; (ii) maintaining the security and availability of our systems and data; (iii) supporting compliance with applicable laws and regulations; (iv) documenting cybersecurity incidents and our responses; and (v) notification of cybersecurity incidents to, and communications with, appropriate internal and external parties.

companyName: BLUE OWL CAPITAL INC.

ticker: OWL


text: We have implemented an information security governance policy (the "ISG Policy") governing cybersecurity risk, which is designed to facilitate the protection of sensitive or confidential business, client, investor and employee information that we store or process and the maintenance of critical services and systems. Our cybersecurity program is managed by our Chief Technology Officer and Head of Technology Infrastructure (together, "IT Management"), who report to our Chief Operating Officer. IT Management and its team are responsible for implementing our monitoring and alert response processes, vulnerability management, changes made to our critical systems, including software and network changes, and various other technological and administrative safeguards. These processes and systems are designed to protect against unauthorized access of information, including by cyber-attacks, and our policy and processes include, as appropriate, encryption, data loss prevention technology, authentication technology, entitlement management, access control, anti-virus and anti-malware software, and transmission of data over private networks. Our processes and systems aim to prevent or mitigate two main types of cybersecurity risk: first, cybersecurity risks associated with our physical and digital devices and infrastructure, and second, cybersecurity risks associated with third parties, such as people and organizations who have access to our devices, infrastructure or confidential or sensitive information. The cybersecurity-control principles that form the basis of our cybersecurity program are informed by the National Institute of Standards and Technology Cybersecurity Framework ("NIST").


text: Our cybersecurity program includes review and assessment by third parties of the cybersecurity processes and systems. These third parties assess and report on our compliance with applicable laws and regulations and our internal incident response preparedness, including benchmarking to best practices and industry frameworks and help identify areas for continued focus and improvement. Annual penetration testing of our network, including critical systems and systems that store confidential or sensitive information, is conducted with third party consultants and vulnerabilities are reviewed by IT Management for remediation. When we engage vendors and other third party partners who will have access to sensitive data or client systems and facilities, our infrastructure technology team assesses their cybersecurity programs and processes.


text: We also provide our employees with cybersecurity awareness training at onboarding and annually, as well as interim security reminders and alerts. We conduct regular phishing tests and provide additional training as appropriate.


text: Governance and Oversight of Cybersecurity Risks We have developed an incident response framework to identify, assess and manage cybersecurity events. The framework is managed and implemented by our Cyber Risk Operating Committee (the "C-ROC"), a cross-functional management committee that includes our General Counsel, Chief Operating Officer, Chief Compliance Officer and IT Management. The C-ROC is responsible for gathering information with respect to a cybersecurity incident, assessing its severity and potential responses, as well as communicating with business heads and senior management, as appropriate. This framework contemplates conducting simulated cybersecurity incident response exercises with members of senior management on an interim basis in coordination with external cyber counsel.


text: Our cybersecurity program, which is overseen by the C-ROC, is managed by an internal team that is responsible for enterprise-wide cybersecurity strategy, policies, engineering and processes. The team is led by our Chief Technology Officer, who has over 25 years of experience advising on technology strategy, including digital transformation, cybersecurity, business analytics and infrastructure, and our Head of Technology Infrastructure, who has over 20 years of experience in the information technology field with a focus on IT risk governance and management, information security, incident response capabilities and assessing effectiveness of controls. The C-ROC meets regularly and forms cross-enterprise teams, as needed, to manage and implement key policies and initiatives of our cybersecurity program.


text: Our Board of Directors has delegated the primary responsibility for oversight and review of guidelines and policies with respect to risk assessment and risk management, including cybersecurity risk, to the Audit Committee. Our Chief Technology Officer periodically reports to the Audit Committee as well as the full Board, as appropriate, on cybersecurity matters. Such reporting includes updates on our cybersecurity program, the external threat environment and our programs to address and mitigate the risks associated with the evolving cybersecurity threat environment. These reports also include updates on our preparedness, prevention, detection, responsiveness and recovery with respect to cyber incidents.


text: Impact of Cybersecurity Risks In 2023, we did not experience a material cybersecurity incident, and we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business. While we do not believe that our business strategy, results of operations or financial condition have been materially adversely affected by any cybersecurity incidents, we describe whether and how future incidents could have a material impact on our business strategy, results of operations or financial condition in "Item 1A. Risk Factors—Risks Related to Our Operations—Cybersecurity risks and cyber data security incidents could adversely affect our business by causing a disruption to our operations, a compromise or corruption of our confidential information and confidential information in our possession and damage to our business relationships." and "Item 1A. Risk Factors—Risks Related to Our Legal and Regulatory Environment—Increased data protection regulation may result in increased complexities and risk in connection with the operation of our business and our products." Additionally, although we have insurance coverage for cybersecurity events, there can be no assurance that we will be able to maintain our insurance coverage or it will be enough to cover the cost associated with one or more cybersecurity events. See "Item 1A. Risk Factors—Risks Related to Our Legal and Regulatory Environment—We may not be able to maintain sufficient insurance to cover us for potential litigation or other risks."


text: Cybersecurity Processes and Risk Assessment Our cybersecurity policies and processes are overseen by the Audit Committee of our Board. Our cybersecurity program is focused on (i) protecting confidential business, client, investor and employee information that we store or process; (ii) maintaining the security and availability of our systems and data; (iii) supporting compliance with applicable laws and regulations; (iv) documenting cybersecurity incidents and our responses; and (v) notification of cybersecurity incidents to, and communications with, appropriate internal and external parties.


text: We have implemented an information security governance policy governing cybersecurity risk, which is designed to facilitate the protection of sensitive or confidential business, client, investor and employee information that we store or process and the maintenance of critical services and systems. Our cybersecurity program is managed by our Chief Technology Officer and Head of Technology Infrastructure (together, "IT Management"), who report to our Chief Operating Officer. IT Management and its team are responsible for implementing proactive and reactive measures, including our monitoring and alert response processes, vulnerability management, changes made to our critical systems, including software and network changes, and various other technological and administrative safeguards. Our cybersecurity processes and systems are designed to protect against unauthorized access of information, including by cyber-attacks. Our policy and processes include, as appropriate, encryption, data loss prevention technology, authentication technology, entitlement management, access control, anti-virus and anti-malware software, and transmission of data over private networks. Our processes and systems aim to prevent or mitigate two main types of cybersecurity risk: first, cybersecurity risks associated with our physical and digital devices and infrastructure, and second, cybersecurity risks associated with third parties, such as people and organizations who have access to our devices, infrastructure or confidential or sensitive information. The cybersecurity-control principles that form the basis of our cybersecurity program are informed by the National Institute of Standards and Technology Cybersecurity Framework.


text: Our cybersecurity program includes review and assessment by third parties of the cybersecurity processes and systems. These third parties assess and report on our compliance with applicable laws and regulations and our internal incident response preparedness, including benchmarking to best practices and industry frameworks and help identify areas for continued focus and improvement. Annual penetration testing of our network, including critical systems and systems that store confidential or sensitive information, is conducted with third party consultants and vulnerabilities are reviewed and addressed by IT Management. When we engage vendors and other third-party partners who will have access to sensitive data or client systems and facilities, our infrastructure technology team assesses their cybersecurity programs and processes.


text: We also provide our employees with cybersecurity awareness training at onboarding and annually, as well as interim security reminders and alerts. We conduct regular phishing tests and provide additional training as appropriate. We have a process designed to assess the cybersecurity risks associated with the engagement of third-party vendors. This assessment is conducted on the basis of, among other factors, the types of services provided and the extent and type of data accessed or processed by a third-party vendor.


text: Governance and Oversight of Cybersecurity Risks We have developed an incident response framework to identify, assess, manage and report cybersecurity events, which is managed and implemented by our Cyber Risk Operating Committee (the "C-ROC"), a cross-functional management committee that includes our General Counsel, Chief Operating Officer, Chief Compliance Officer and IT Management. The incident response framework determines when the C-ROC should provide notifications regarding certain cybersecurity incidents, with different severity thresholds triggering notifications to different recipient groups, including senior members of management, our Audit Committee or our Board. The C-ROC is responsible for gathering information with respect to a cybersecurity incident, assessing its severity and potential responses, as well as communicating with senior management and the Audit Committee or full Board, as appropriate. This framework contemplates conducting simulated cybersecurity incident response exercises with members of senior management on an interim basis in coordination with external cyber counsel.


text: Our cybersecurity program, which is overseen by the C-ROC, is managed by IT Management as part of its responsibility for enterprise-wide cybersecurity strategy, policies, implementing our monitoring and alert response processes, vulnerability management, changes made to our critical systems, including software and network changes and various other technological and administrative safeguards. The team is led by our Chief Technology Officer, who has over 25 years of experience advising on technology strategy, including digital transformation, cybersecurity, business analytics and infrastructure, and our Head of Technology Infrastructure, who has over 20 years of experience in the information technology field with a focus on IT risk governance and management, information security, incident response capabilities and assessing effectiveness of controls. The C-ROC meets regularly and forms cross-enterprise teams, as needed, to manage and implement key policies and initiatives of our cybersecurity program.


text: Our Board has delegated the primary responsibility for oversight and review of guidelines and policies with respect to risk assessment and risk management, including cybersecurity risk, to the Audit Committee. Our Chief Technology Officer periodically reports to the Audit Committee as well as the full Board, as appropriate, on cybersecurity matters. Such reporting includes updates on our cybersecurity program, the external threat environment and our programs to address and mitigate the risks associated with the evolving cybersecurity threat environment. These reports also include updates on our preparedness, prevention, detection, responsiveness and recovery with respect to cyber incidents.


text: Impact of Cybersecurity Risks In 2024, we did not experience a material cybersecurity incident, and we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business. While we do not believe that our business strategy, results of operations or financial condition have been materially adversely affected by any cybersecurity incidents, we describe whether and how future incidents could have a material impact on our business strategy, results of operations or financial condition in "Item 1A. Risk Factors—Risks Related to Our Operations—Cybersecurity risks and cyber data security incidents could adversely affect our business by causing a disruption to our operations, a compromise or corruption of our confidential information and confidential information in our possession and damage to our business relationships." and "Item 1A. Risk Factors—Risks Related to Our Legal and Regulatory Environment—Increased data protection regulation may result in increased complexities and risk in connection with the operation of our business and our products." Additionally, although we have insurance coverage for cybersecurity events, there can be no assurance that we will be able to maintain our insurance coverage or it will be enough to cover the cost associated with one or more cybersecurity events. See "Item 1A. Risk Factors—Risks Related to Our Legal and Regulatory Environment—We may not be able to maintain sufficient insurance to cover us for potential litigation or other risks."


text: We recognize the critical importance of maintaining the trust and confidence of patients, business partners and employees toward our business and are committed to protecting the confidentiality, integrity and availability of our business operations and systems. Our board of directors is actively involved in oversight of our risk management activities, and cybersecurity represents an important element of our overall approach to risk management. In general, we seek to address cybersecurity risks through a comprehensive approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: GRI Bio, Inc.

ticker: GRI


text: Cybersecurity Risk Management and Strategy; Effect of Risk We face risks related to cybersecurity such as unauthorized access, cybersecurity attacks and other security incidents, including as perpetrated by hackers and unintentional damage or disruption to hardware and software systems, loss of data, and misappropriation of confidential information. To identify and assess material risks from cybersecurity threats, we maintain a cybersecurity program to ensure our systems are effective and prepared for information security risks, including regular oversight of our programs for security monitoring for internal and external threats to ensure the confidentiality and integrity of our information assets. We consider risks from cybersecurity threats alongside other company risks as part of our overall risk assessment process. As discussed in more detail under "Cybersecurity Governance" below, our board of directors provides oversight of our cybersecurity risk management and strategy processes, which are led by our Chief Financial Officer.


text: To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and protect against and respond to cybersecurity incidents, we undertake the following activities: • monitor emerging data protection laws and implement changes to our processes that are designed to comply with such laws; • through our policies, practices and contracts (as applicable), require employees, as well as third parties that provide services on our behalf, to treat confidential information and data with care; • employ technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls; and • provide training for our employees regarding cybersecurity threats as a means to equip them with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices.


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers who have access to employee data or our systems. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, in Item 1A under the heading "We may be unable to adequately protect our information systems from cyberattacks, which could result in the disclosure of confidential or proprietary information, including personal data, damage our reputation, and subject us to significant financial and legal exposure," which disclosures are incorporated by reference herein.


text: Upon detection of a cybersecurity threat, our board of directors receives an update from management of our cybersecurity threat risk management and strategy processes, as well as the steps management has taken to respond to such risks. Our board of directors also receive prompt and timely information regarding any cybersecurity incident that meets establishing reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, is managed by our Chief Financial Officer and supported by consultants with experience in managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs as needed. As discussed above, the Chief Financial Officer reports to our board of directors about material cybersecurity threat risks.


text: We recognize the critical importance of maintaining the trust and confidence of patients, business partners and employees toward our business and are committed to protecting the confidentiality, integrity and availability of our business operations and systems. Our Board is actively involved in oversight of our risk management activities, and cybersecurity represents an important element of our overall approach to risk management. In general, we seek to address cybersecurity risks through a comprehensive approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.


text: Cybersecurity Risk Management and Strategy; Effect of Risk We face risks related to cybersecurity such as unauthorized access, cybersecurity attacks and other security incidents, including as perpetrated by hackers and unintentional damage or disruption to hardware and software systems, loss of data, and misappropriation of confidential information. To identify and assess material risks from cybersecurity threats, we maintain a cybersecurity program to ensure our systems are effective and prepared for information security risks, including regular oversight of our programs for security monitoring for internal and external threats to ensure the confidentiality and integrity of our information assets. We consider risks from cybersecurity threats alongside other company risks as part of our overall risk assessment process. As discussed in more detail under "Cybersecurity Governance" below, our Board provides oversight of our cybersecurity risk management and strategy processes, which are led by our Chief Financial Officer.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, in Item 1A. under the heading "We may be unable to adequately protect our internal information systems, or those used by our CROs, clinical sites, or other contractors or consultants upon which we rely, from cyberattacks, compromises, cybersecurity incidents, or other disruptions, which could result in the compromise of sensitive or proprietary information, lead to operational or service interruption, harm our reputation, and subject us to litigation, fines and other significant financial and legal exposure, and other adverse consequences," which disclosures are incorporated by reference herein.


text: Cybersecurity Governance; Management Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management. Our Board is responsible for the oversight of risks from cybersecurity threats.


text: Our Board receives periodic updates from management about our cybersecurity threat risk management and strategy processes. Additionally, upon detection of a cybersecurity threat, our Board receives an update from management of our cybersecurity threat risk management and strategy processes, as well as the steps management has taken to respond to such identified cybersecurity threat. Our Board also receive prompt and timely information regarding any cybersecurity incident that meets establishing reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, is managed by our Chief Financial Officer and supported by consultants with experience in managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs as needed. As discussed above, the Chief Financial Officer reports to our Board about material cybersecurity threat risks.


text: Governance: The Board's oversight of cybersecurity risk management is supported by the Audit Committee of the Board, which receives, at a minimum, quarterly reports and presentations from our risk management function, our Vice President Information Technology (our "VP of IT") and other members of management. The Board and Audit Committee also receive prompt and timely information regarding material cybersecurity incidents as described below.

companyName: Velo3D, Inc.

ticker: VELO


text: Our VP of IT, in coordination with our executive management team, works collaboratively across the company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans. Through ongoing communications with our entire employee basis and appropriate third-party contractors, the VP of IT, and our Head of Information Security, as well as the management team monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and report threats and incidents to the Audit Committee, as needed.


text: Our VP of IT oversees information technology ("IT") strategy, operations, cybersecurity, compliance, and business applications. They are dedicated to accelerating and scaling our company by implementing innovative technology across the company. Additionally, they are an accomplished IT executive with over 20 years of leadership experience driving transformative change across diverse industries, including manufacturing, supply chain, and software as a service. The VP of IT is a skilled technical leader proficient in technology strategy, enterprise architecture, and program management.


text: Our Head of Information Security, Governance, Risk and Compliance is CISA certified and has over 20 years of leadership experience in IT audit and governance, risk and compliance ("GRC") at companies like Google, Cisco, Federal Reserve Bank, & Vodafone. They have substantial expertise in implementing SOX compliance, NIST compliance, COSO / COBIT framework, GDPR compliance, privacy compliance, regulatory compliance, internal IT audit, ITIL/ ITSM standards and risk assessment. Additionally, they have established our enterprise risk management program and leads our infosec steering committee. They have also been instrumental in automating GRC and continuous control monitoring to drive efficiency at our company.


text: Although we are subject to ongoing and evolving cybersecurity threats, we are not aware of any material risks from cybersecurity threats in 2023 that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. For more information on our cybersecurity risks, see "Risk Factors—Risks Related to Compliance Matters—Aspects of our business are subject to privacy, data use and data security regulations, which could increase our costs" and "—Risks Related to Our Business and Industry—We rely on our information technology systems to manage numerous aspects of our business and a disruption of these systems could adversely affect our business."


text: The Company's cybersecurity risk management program is integrated into our overall enterprise risk management process and is based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST Framework"). The program is comprised of a comprehensive set of policies and procedures designed to protect and identify threats to our Information Technology ("IT") systems and data, including those employed by our third-party service providers. Our dedicated cybersecurity team collaborates with business operations personnel as well as certain third parties, as applicable, to provide a comprehensive suite of cybersecurity services, encompassing network security, anti-malware solutions, email security measures, endpoint security, detection systems, application security, data safeguards, access management protocols, cybersecurity awareness initiatives, incident response strategies, threat intelligence, IT risk assessment and vulnerability management. We also maintain insurance coverage for cybersecurity incidents.

companyName: Dream Finders Homes, Inc.

ticker: DFH


text: The Company also engages third parties to perform periodic assessments of certain aspects of our cybersecurity measures, including vulnerability assessments and audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Nominating and Governance Committee and the Board of Directors, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: Our Board of Directors has delegated oversight of cybersecurity risks to our Nominating and Governance Committee. Executive management, inclusive of our Vice President of IT ("VP of IT") in conjunction with our National Vice President of Finance ("NVP of Finance"), provides regular updates to the Nominating and Governance Committee including any updates to our program in response to new or changed cybersecurity risks, as well as ongoing metrics around the effectiveness of our existing cybersecurity strategies.


text: The VP of IT and the NVP of Finance work in coordination with the Cybersecurity Response Committee, which also includes our Chief Financial Officer ("CFO") and representatives from legal, internal audit and SEC reporting functions. In the event of a cyber incident, the Cybersecurity Response Committee utilizes a formal incident response plan based on the NIST Framework to assess and manage cybersecurity threats. The incident response plan encompasses the containment, eradication, recovery, and resolution processes for the incident, while also detailing the individuals and groups that need to be notified.


text: The VP of IT has served in various roles in information technology and information security for over 24 years, including serving as the Chief Information Security Officer of a healthcare company and a member of the cyber emergency response team at several companies. The VP of IT holds undergraduate and graduate degrees in computer science and has attained various professional certifications in cybersecurity. The NVP of Finance and the rest of the Cybersecurity Response Committee hold undergraduate and graduate degrees in their respective fields, and have over 50 years of collective experience managing enterprise risks at the Company and at similar companies, including risks arising from cybersecurity threats.


text: Cybersecurity threats have not materially affected the Company, including our business strategy, results of operations or financial condition, to date. Risks relating to cybersecurity threats and potential impacts to our business strategy, results of operations or financial condition are discussed in "Risk Factors" herein.


text: The Company engages third parties to perform periodic assessments of certain aspects of our cybersecurity measures, including vulnerability assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Nominating and Governance Committee and the Board of Directors, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: The VP of IT and the NVP of Finance work in coordination with the Cybersecurity Response Committee, which also includes our Chief Financial Officer and representatives from legal, internal audit and SEC reporting functions. In the event of a cyber incident, the Cybersecurity Response Committee utilizes a formal incident response plan based on the NIST Framework to assess and manage cybersecurity threats. The incident response plan encompasses the containment, eradication, recovery, and resolution processes for the incident, while also detailing the individuals and groups that need to be notified.


text: The VP of IT has served in various roles in information technology and information security for over 25 years, including serving as the Chief Information Security Officer of a healthcare company and a member of the cyber emergency response team at several companies. The VP of IT holds undergraduate and graduate degrees in computer science and has attained various professional certifications in cybersecurity. The NVP of Finance and the rest of the Cybersecurity Response Committee hold undergraduate and graduate degrees in their respective fields, and have over 50 years of collective experience managing enterprise risks at the Company and at similar companies, including risks arising from cybersecurity threats.


text: Management and Board Oversight Our Board of Directors oversees risk management for the Company, including through its approval of the investment policy and other policies of the Company and its oversight of the Adviser. For certain risks, our Board of Directors has delegated oversight responsibilities to committees of our Board of Directors. For example, the Nominating and Corporate Governance Committee assists our Board of Directors with assessing risks associated with conflicts of interest. Cybersecurity risk management is integrated into this broader risk management framework. Our Board of Directors has delegated to the Audit Committee oversight of management's programs and policies to identify, assess, manage, mitigate and monitor significant business risks of the Company, including privacy, information technology and cybersecurity risks.

companyName: Franklin BSP Capital Corp

ticker: FRBP


text: Information Technology and Cybersecurity Risks We have no employees and rely on the Adviser, a wholly-owned subsidiary of Franklin Templeton, to manage our day-to-day operations pursuant to the Advisory Agreement. Therefore, we rely heavily on Franklin Templeton's information systems and its program for defending against and responding to cybersecurity threats and incidents. Franklin Templeton maintains a robust cybersecurity defense program, including a dedicated cybersecurity team led by its Chief Security Officer ("CISO"). The CISO, who reports directly to the Franklin Templeton Executive Vice President and Chief Risk and Transformation Officer, has 28 years of experience in the information technology and cybersecurity field and has been at Franklin Templeton for 12 years. In addition, the CISO provides regular briefings for our Board of Directors and senior officers of the Company on cybersecurity matters, including on threats, events, and program enhancements. The Chief Compliance Officer of the Company also provides periodic updates to our Board of Directors and senior officers of the Company on cybersecurity threats and material risks from cybersecurity threats with respect to the Company.


text: In the event of an incident which jeopardizes the confidentiality, integrity, or availability of the information technology systems the Adviser uses to provide services to us pursuant to the Advisory Agreement, Franklin Templeton's cybersecurity team utilizes a regularly updated cybersecurity incident response plan that was developed based on, and is periodically benchmarked to, applicable third-party cybersecurity standards and frameworks. Pursuant to that plan and its escalation protocols, designated personnel are responsible for assessing the severity of the incident and associated threat, containing the threat, remediating the threat, including recovery of data and access to systems, analyzing the reporting obligations associated with the incident and performing post-incident analysis and program improvements. While the particular personnel assigned to an incident response team will depend on the particular facts and circumstances, the response team is led by the CISO or their delegee. In addition, senior officers of the Company have implemented a Company policy that supplements the Franklin Templeton incident response plan with respect to cybersecurity incidents that have or may impact the Company, including by impacting the Adviser's ability to provide services to the Company pursuant to the Advisory Agreement. Pursuant to this policy, the Adviser and Franklin Templeton are required to notify and update the Company's senior officers and our Audit Committee with respect to certain matters related to cybersecurity incidents specified under the policy.


text: The Audit Committee oversees, on behalf of our Board of Directors, the Company's privacy, information technology and security and cybersecurity risk exposures, including (i) the potential impact of those exposures on the Company's business, financial results, operations and reputation, (ii) the programs and steps implemented by management to monitor and mitigate any exposures, (iii) the Company's information governance and information security policies and programs, and (iv) major legislative and regulatory developments that could materially impact the Company's privacy, data security and cybersecurity risk exposure. On a quarterly basis, the CISO or their delegee report to our Board of Directors or Audit Committee on information technology and cybersecurity matters, including a detailed threat assessment relating to information technology risks.


text: Prevention and Preparation Franklin Templeton undertakes regular internal and external security audits and vulnerability assessments to reduce the risk of a cybersecurity incident and they implement business continuity, contingency and recovery plans to mitigate the impact of an incident. As part of these efforts, Franklin Templeton periodically engages consultants to conduct external reviews of its vulnerabilities, including penetration testing and compromise assessments. Franklin Templeton employs best practice identity and access management including broad adoption of multifactor authentication, geo-location blocking, behavior analytics and controls aligned to a zero trust model.


text: Franklin Templeton and the Adviser recognize that threat actors frequently target employees to gain unauthorized access to information systems. Therefore, a key element of their prevention efforts is employee training on their data privacy and cybersecurity procedures. For example, all new hires of Franklin Templeton and the Adviser receive mandatory privacy and information security training. In addition, current employees of the Adviser must complete mandatory annual cybersecurity and data trainings, which are supplemented by regular phishing and other cyber-related testing and trainings that the Adviser conducts throughout the year.


text: We recognize that third parties that provide information systems used by the Adviser to provide services to the Company can be subject to cybersecurity incidents that could impact the Company. To mitigate third party risk, Franklin Templeton maintains a vendor code of conduct, which is designed to require third party vendors to comply with our requirements for maintenance of passwords, as well as other confidentiality, security, and privacy procedures. All third party vendors must complete a cyber incident reporting questionnaire to ensure timely notification of any potential cybersecurity breaches. Third-party IT vendors are also subject to additional diligence requirements.


text: As discussed above, to support its preparedness, Franklin Templeton has an incident response plan that it regularly updates. In addition, Franklin Templeton performs regularly scheduled tabletop exercises and periodic drills at least once a year to test its incident response procedures, identify improvement opportunities and exercise team preparedness. Franklin Templeton also maintains cybersecurity insurance providing coverage for certain costs related to security failures and specified cybersecurity-related incidents that interrupt its network or networks of its vendors, in all cases up to specified limits and subject to certain exclusions.


text: Detection and Analysis Cybersecurity incidents may be detected through a variety of means, which may include, but are not limited to, automated event-detection notifications or similar technologies which are monitored by the Franklin Templeton cyber defense team, notifications from employees, borrowers or service providers, and notifications from third party information technology system providers. Franklin Templeton also has a comprehensive threat intelligence program that performs proactive analyses leveraging internal, government and third party provided intelligence to identify and mitigate risks to the firm. Once a potential cybersecurity incident is identified, including a third party cybersecurity event, the incident response team designated pursuant to the Franklin Templeton incident response plan follows the procedures set forth in the plan to investigate the potential incident, including determining the nature of the event (e.g., ransomware or personal data breach) and assessing the severity of the event and sensitivity of any compromised data.


text: Cybersecurity Risks As of December 31, 2023, we are not aware of any material cybersecurity incidents that impacted the Company in the last three years. We and our Adviser routinely face risks of potential incidents, whether through cyber-attacks or cyber intrusions over the Internet, ransomware and other forms of malware, computer viruses, attachments to emails, phishing attempts, extortion or other scams; however, we have been able to prevent or sufficiently mitigate harm from such risks. Although the Adviser and Franklin Templeton, on our behalf, make efforts to maintain the security and integrity of the information technology systems the Adviser uses on our behalf, these systems and the proprietary, confidential and personal information that resides on or is transmitted through them are subject to the risk of a security incident or disruption, and there can be no assurances regarding our security efforts and measures or those of our third party providers. See "Item 1A–Risk Factors– Our business could suffer in the event our Adviser or any other party that provides us with services essential to our operations experiences system failures or cyber-incidents or a deficiency in cybersecurity."


text: Information Technology and Cybersecurity Risks We have no employees and rely on the Adviser, a wholly-owned subsidiary of Franklin Templeton, to manage our day-to-day operations pursuant to the Amended and Restated Investment Advisory Agreement. Therefore, we rely heavily on Franklin Templeton's information systems and its program for defending against and responding to cybersecurity threats and incidents. Franklin Templeton maintains a robust cybersecurity defense program, including a dedicated cybersecurity team led by its Chief Security Officer ("CISO"). The CISO, who reports directly to the Franklin Templeton Executive Vice President and Chief Risk and Transformation Officer, has 30 years of experience in the information technology and cybersecurity field and has been at Franklin Templeton for 13 years. In addition, the CISO provides regular briefings for our Board of Directors and senior officers of the Company on cybersecurity matters, including on threats, events, and program enhancements. The Chief Compliance Officer of the Company also provides periodic updates to our Board of Directors and senior officers of the Company on cybersecurity threats and material risks from cybersecurity threats with respect to the Company.


text: In the event of an incident which jeopardizes the confidentiality, integrity, or availability of the information technology systems the Adviser uses to provide services to us pursuant to the Amended and Restated Investment Advisory Agreement, Franklin Templeton's cybersecurity team utilizes a regularly updated cybersecurity incident response plan that was developed based on, and is periodically benchmarked to, applicable third-party cybersecurity standards and frameworks. Pursuant to that plan and its escalation protocols, designated personnel are responsible for assessing the severity of the incident and associated threat, containing the threat, remediating the threat, including recovery of data and access to systems, analyzing the reporting obligations associated with the incident and performing post-incident analysis and program improvements. While the particular personnel assigned to an incident response team will depend on the particular facts and circumstances, the response team is led by the CISO or their delegee. In addition, senior officers of the Company have implemented a Company policy that supplements the Franklin Templeton incident response plan with respect to cybersecurity incidents that have or may impact the Company, including by impacting the Adviser's ability to provide services to the Company pursuant to the Amended and Restated Investment Advisory Agreement. Pursuant to this policy, the Adviser and Franklin Templeton are required to notify and update the Company's senior officers and our Audit Committee with respect to certain matters related to cybersecurity incidents specified under the policy.


text: We recognize that third parties that provide information systems used by the Adviser to provide services to the Company can be subject to cybersecurity incidents that could impact the Company. To mitigate third party risk, Franklin Templeton requires third party vendors to comply with our confidentiality, security, and privacy requirements. All third party vendors must complete a cyber incident reporting questionnaire to ensure timely notification of any potential cybersecurity breaches. Third-party vendors are also subject to additional diligence requirements.


text: Detection and Analysis Cybersecurity incidents may be detected through a variety of means, which may include, but are not limited to, automated event-detection notifications or similar technologies which are monitored by the Franklin Templeton cyber defense team, notifications from employees, borrowers or service providers, and notifications from third party information technology system providers. Franklin Templeton also has a comprehensive threat intelligence program that performs proactive analyses leveraging internal, government and third party provided intelligence to identify and mitigate risks to the firm. Once a potential cybersecurity incident is identified, including a third party cybersecurity event, the incident response team designated pursuant to the Franklin Templeton incident response plan follows the procedures set forth in the plan to investigate the potential incident, including determining the nature of the event and assessing the severity of the event and sensitivity of any compromised data.


text: Containment, Eradication, Recovery, and Reporting In the event of a cybersecurity incident, the Franklin Templeton incident response team is initially focused on containing the cybersecurity incident as quickly as possible consistent with the procedures in the incident response plan.


text: Cybersecurity Risks As of December 31, 2024, we are not aware of any material cybersecurity incidents that impacted the Company in the last three years. We and our Adviser routinely face risks of potential incidents, whether through cyber-attacks or cyber intrusions over the Internet, ransomware and other forms of malware, computer viruses, attachments to emails, phishing attempts, extortion or other scams; however, we have been able to prevent or sufficiently mitigate harm from such risks. Although the Adviser and Franklin Templeton, on our behalf, make efforts to maintain the security and integrity of the information technology systems the Adviser uses on our behalf, these systems and the proprietary, confidential and personal information that resides on or is transmitted through them are subject to the risk of a security incident or disruption, and there can be no assurances regarding our security efforts and measures or those of our third party providers. See "Item 1A.–Risk Factors– Our business could suffer in the event our Adviser or any other party that provides us with services essential to our operations experiences system failures or cyber-incidents or a deficiency in cybersecurity."


text: We have developed and maintain a cybersecurity risk management methodology intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management methodology is integrated into our overall enterprise risk management, and apply across the Company to other legal, compliance, strategic, operational, and financial risk areas. As part of our overall risk management processes and procedures, we have instituted a cybersecurity awareness designed to identify, assess and manage material risks from cybersecurity threats. The cyber risk management methodology involves risk assessments, implementation of security measures and ongoing monitoring of systems and networks, including networks on which we rely. Through our cybersecurity awareness, the current threat landscape is actively monitored in an effort to identify material risks arising from new and evolving cybersecurity threats. We may engage external experts, including cybersecurity assessors, consultants and auditors to evaluate cybersecurity measures and risk management processes as needed. We also depend on and engage various third parties, including suppliers, vendors and service providers in connection with our operations.

companyName: Carriage House Event Center, Inc.


text: One of the key functions of our Board of Directors is informed oversight of our various processes for managing risk. An overall review of risk is inherent in our Board of Directors ongoing consideration of our long-term strategies, transactions and other matters presented to and discussed by the Board of Directors. This includes a discussion of the likelihood and potential magnitude of various risks.


text: The Cooperative's Board of Directors recognizes the significance that cybersecurity has on our business, particularly the security of our member data, and is responsible for overseeing risks to the Cooperative from cybersecurity threat actors. Our operations rely party providers. These systems collect, process, transmit and retain information that may require both mandatory and voluntary data protection regimens.

companyName: Golden Growers Cooperative

ticker: GGROU


text: Our cybersecurity practices are designed to provide reasonable information security given the nature of our organization and our third-party relationships. We rely on the representations third-party relationships introduce additional cybersecurity risks. To address these third-party risks, we have established strict criteria for supplier selection and conduct security risk assessments to mitigate potential impacts on our business.


text: The Cooperative's Board of Directors contracts with a Managed Security Service Provider. Our Managed Security Service Provider services include: (i) managed IT services, consisting system monitoring and reporting; and (ii) cyber security services, consisting of firewall management, intrusion detection and prevention, malware and virus protection, security audits and vulnerability assessments, security incident response, and employee awareness training. In addition, our Managed Security Service Provider conducts risk assessments and provides recommendations to the Executive Vice President and the Board of Directors, provides threat containment and mitigation services, assists the Cooperative with cybersecurity compliance, and would coordinate with insurance carriers and law enforcement in the event of a cybersecurity incident.


text: The Cooperative's Board of Directors believes a strong cybersecurity strategy is vital to protect our business operations, sustain our control environment and honor our data protection obligations. The Board has delegated to its Finance & Audit Committee the responsibility for monitoring the effectiveness of the Cooperative's internal cybersecurity practices. The Executive Vice President manages the Cooperative's cybersecurity-related risks, communicates with suppliers and other third party providers regarding cybersecurity threats, incidents, plans and responses, and reports to the Finance & Audit Committee and/or the entire Board regarding such cybersecurity threats, incidents, plans and responses on at least a semi-annual basis, and more often as needed.


text: 2024, the Cooperative did not experience any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect the Cooperative, including its business strategy, results of operations, or financial condition.


text: The Company does not have any processes for identifying and managing material risks from cybersecurity threats. The Company considers that at the current stages of its development and information systems there are no risks of cybersecurity incidents that have materially affected and are reasonably likely to materially affect the company, including its business strategy, results of operations, or financial condition.

companyName: NIKA PHARMACEUTICALS, INC

ticker: NIKA


text: Because the Company is not reasonably likely to be materially affected by cybersecurity threats at the current stages of its development, there are no particular director's oversight of risks from cybersecurity threats and management does not have an active role in assessing and managing the Company's material risks from cybersecurity threats.


text: Risk Management and Strategy Overview As cybersecurity threats rapidly evolve in sophistication and become more prevalent, especially with the increasing use of artificial intelligence technology, we have implemented a cybersecurity risk management program as part of our oversight, evaluation and mitigation of enterprise-level risks. We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to maintain the security, confidentiality, integrity, and availability of our business systems and confidential information, including personal information and intellectual property. Our cybersecurity risk management program leverages a combination of processes, technologies and personnel with expertise in cybersecurity to comply with applicable regulations and detect and respond to cyber-attacks, data breaches, security incidents, and compromises of personal information, as well as to regularly and promptly inform management and our Board of Directors of any significant cybersecurity risks and developments.

companyName: TriSalus Life Sciences, Inc.

ticker: TLSI


text: Our company currently does not have a Chief Information Security Officer ("CISO") due to our size; our Director of Operations ("DO"), with assistance from our third-party information technology ("IT") support firm, leads the Company's effort in establishing cybersecurity strategies and structures and helps identify, assess, and manage the Company's cybersecurity threats and risk. Our DO regularly meets with our third-party IT support firm to discuss cybersecurity threats and risk. This team helps identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods and tools, for example, phishing and social engineering tests.


text: We have worked, and expect to continue to work, with third-party service providers, as appropriate, to assess, identify and manage cybersecurity risks. As such, our DO meets with the senior management from our IT support firm regularly to discuss work requests and issues raised that may need to be added to the network for security. We also conduct periodic and on-demand assessments of our cybersecurity risk management program with expert service providers to ensure it remains current, given the changing risk environment. The DO regularly updates cybersecurity matters to the executive management team.


text: We use third-party service providers to perform a variety of critical functions throughout our business, such as hosting providers, application providers, contract research organizations and contract manufacturing organizations. We have a vendor management program to manage cybersecurity risks associated with our use of these providers. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our DO. Our DO is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, communicating key priorities to relevant employees and personnel, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances. Our DO, with the appropriate members of management, will work with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response plan includes reporting to the Audit Committee of the board of directors for certain cybersecurity incidents.


text: Cybersecurity risks are overseen by the Board of Directors and the Audit Committee. The Audit Committee is central to the Board of Directors' oversight of cybersecurity risks and bears the primary responsibility for overseeing cybersecurity risk. The Audit Committee actively participates in strategic decisions related to cybersecurity, offering guidance and approval for major cybersecurity initiatives. This involvement ensures that cybersecurity considerations are integrated into our broader strategic objectives.


text: Our DO provides comprehensive updates to the Audit Committee quarterly and the full Board of Directors at least annually. These briefings have included a range of topics, such as: • Current cybersecurity landscape and emerging threats; • Status of ongoing cybersecurity initiatives and strategies; • Incident reports and learnings from any cybersecurity events; • Metrics demonstrating company and industry-standard prevention of common threats; and • Regulatory changes impacting cybersecurity requirements and strategy.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report, including "If our information technology systems or data, or those of third parties upon which we rely, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; and other adverse consequences."


text: Risk Management and Strategy Overview As cybersecurity threats rapidly evolve in sophistication and become more prevalent, especially with the increasing use of artificial intelligence technology, we have implemented a cybersecurity risk management program as part of our oversight, evaluation and mitigation of enterprise-level risks. We recognize the importance of developing, implementing, and maintaining cybersecurity measures that are designed to maintain the security, confidentiality, integrity, and availability of our business systems and confidential information, including personal information and intellectual property. Our cybersecurity risk management program leverages a combination of processes, technologies and personnel with expertise in cybersecurity in an effort to comply with applicable regulations and detect and respond to cyber-attacks, data breaches, security incidents, and compromises of personal information, as well as to inform management and our Board of Directors of any significant cybersecurity risks and developments.


text: Our Senior Director of Operations ("DO"), with assistance from our third-party information technology ("IT") support firm, leads the Company's effort in establishing cybersecurity strategies and structures that help to identify, assess, and manage the Company's cybersecurity threats and risk. Our DO working knowledge of end-user best practices and regularly meets with our third-party IT support firm to discuss potential cybersecurity threats and risk. This team helps identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods and tools, for example, phishing and social engineering tests. Based on these meetings, our DO identifies additional end-user education and company security needs, which are supported through our IT support firm or other third-party IT experts.


text: Our cybersecurity incident response plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances. Our DO, with the appropriate members of management, will work with the Company's incident response team to help us mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response plan includes reporting to the Audit Committee of the Board of Directors ("Audit Committee") for certain cybersecurity incidents.


text: Cybersecurity risks are overseen by the Audit Committee. The Audit Committee is central to the Board of Directors' oversight of cybersecurity risks and bears the primary responsibility for overseeing cybersecurity risk. The Audit Committee actively participates in strategic decisions related to cybersecurity, offering guidance and approval for major cybersecurity initiatives. This involvement ensures that cybersecurity considerations are integrated into our broader strategic objectives.


text: Our DO provides comprehensive updates to the Audit Committee and the full Board of Directors at least annually. These briefings have included a range of topics, such as: • Current cybersecurity landscape and emerging threats; • Status of ongoing cybersecurity initiatives and strategies; • Incident reports and learnings from any cybersecurity events; • Metrics demonstrating company and industry-standard prevention of common threats; and • Regulatory changes impacting cybersecurity requirements and strategy.


text: The Board of Directors is aware of the importance of managing risks associated with cybersecurity threats and is actively engaged in our cybersecurity risk management strategy.


text: We are committed to safeguarding our customers and the sensitive information shared in the application of software and services provided. Our cybersecurity program, risk management and governance reflect our dedication to not only meeting industry standards but exceeding them.

companyName: Certara, Inc.

ticker: CERT


text: Risk Management and Strategy We recognize that cybersecurity risks pose a significant threat to our business, customers, and stakeholders, and we have implemented a comprehensive security and privacy program to address these risks. We embed security considerations into every aspect of our operations, and our focus encompasses a proactive approach that involves continuous monitoring to swiftly detect and respond to emerging threats to ensure that our customers' information remains secure in the face of evolving cybersecurity challenges. With a foundation grounded in industry best practices, including NIST 800-53, ISO 27001, CIS Top 20, OWASP Top 10, and Security by Design, we prioritize the identification and assessment of risks to create a protective shield around our customers' data.


text: This foundation guides our processes for assessing, identifying, and managing risks related to cybersecurity threats and incidents, as well as ensuring compliance with legal and contractual obligations. Our risk management processes are integrated into our overall business strategy and operations. We use various methods and tools to identify and assess cybersecurity risks across all assets in our technical landscape, such as vulnerability scanning, penetration testing, threat intelligence, risk assessments, and audits from customers. We also use third-party assessors and service providers, consultants, and auditors, to support our risk management processes and to provide independent validation and verification of our security posture. We have established processes to oversee and identify risks associated with our use of third-party assessors and service providers, such as due diligence, contractual obligations, monitoring and vendor evaluation and qualification.


text: We maintain robust cybersecurity incident response procedures, which includes escalating incidents to the appropriate level of management, mitigation, remediation and the assessment of materiality of cybersecurity incidents, or a series of related incidents, that may materially affect or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. We also disclose information regarding our security and privacy program and practices on our website and in our public-facing notices.


text: Furthermore, we conduct annual cybersecurity awareness training for our employees in order to provide them with the knowledge necessary to navigate the digital landscape securely. We understand that cybersecurity is not a static concept but a dynamic discipline, and our security and privacy program reflects this by incorporating internal and third-party audits, penetration testing, active vulnerability scanning and a continuous improvement mindset.


text: As of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity incidents, or a series of related incidents, that have had or are reasonably likely to have a material impact on the Company's business strategy, results of operations or financial condition. For more information on our cybersecurity related risks, see Part 1, Item 1A. Risk Factors entitled "Risks Related to Intellectual Property, Information Technology and Data Privacy" included elsewhere in this Annual Report on Form 10-K.


text: We have established a corporate governance structure that provides oversight and guidance for our security and privacy program. The Board of Directors (the "Board") is ultimately responsible for the oversight of the Company's security and privacy program. The Audit Committee, which supports the Board in the oversight of the program, is focused on cybersecurity and data privacy risk, including incident response planning, timely identification and assessment of incidents, incident recovery and business continuity considerations.


text: We have defined roles and responsibilities for the management of cybersecurity risks, including specific executive-level and management-level positions or committees. Our security and privacy program is overseen by our Security and Privacy Program Office ("SPPO"), which is composed of corporate leadership from legal and IT. The SPPO is accountable to the VP of Information Technology, who is the accountable executive for the program. Our function and business unit executive leadership, acting in support of the SPPO and the Board, is responsible for ensuring organizational compliance with data protection regulations and controls across the organization. Our VP of Information Technology and Director, Compliance Standards & Data Privacy ("DCSDP"), are responsible for the design, implementation, and monitoring of the security and privacy policies, standards, procedures, and controls that govern our information systems and data processing activities. Our VP of Information Technology, has 30 years of experience in IT infrastructure, cybersecurity operations, and site reliability engineering for a wide range of software and service organizations, with the last 15 years focused on SaaS software businesses with access to sensitive customer data. The DCSDP also has 30 years in IT with the last 12 focused on compliance and data privacy issues for Certara.


text: The VP of Information Technology and DCSDP also have a reporting responsibility to the General Counsel, and the Board via the Audit Committee. They coordinate the response and remediation of cybersecurity incidents and data breaches and report on the status and effectiveness of the security and privacy program to the SPPO, the Board, the Audit Committee, and other stakeholders on a quarterly basis, or more frequently as needed.


text: We are committed to safeguarding our customers' information that is shared with us in the application of the software and services we contractually provide to them. Our information systems, including our cybersecurity program, risk management systems and processes and governance, reflect our dedication to meeting industry cybersecurity standards.


text: Risk Management and Strategy We have implemented a comprehensive cybersecurity and data privacy program as part of our risk management processes to assess, identify and manage risks posed to our business by cybersecurity threats. We embed cybersecurity considerations into every material aspect of our operations, and our focus encompasses a proactive approach that involves continuous monitoring to swiftly detect and respond to cybersecurity threats. Our cybersecurity risk management processes are grounded in industry best practices, including NIST 800-53, ISO 27001, CIS Top 18, OWASP Top 10, and Security by Design and are intended to prevent adverse effects on the confidentiality, integrity and availability of our information systems and information residing therein.


text: Our cybersecurity processes have been integrated into our risk management processes in order for us to assess, identify, and manage risks related to cybersecurity threats and ensure compliance with our legal and contractual obligations, which require us to safeguard the confidential and sensitive information provided to us by our customers. For example, we use various methods and tools to identify and assess cybersecurity threats across all assets in our technical landscape, such as vulnerability scanning, penetration testing, threat intelligence, risk assessments, and audits from customers. We regularly engage third-party assessors, service providers, consultants, and auditors to support and review our risk management processes and to provide independent validation and verification of our security posture. We have established processes to oversee and identify risks from cybersecurity threats associated with our use of third-party assessors and service providers, such as due diligence, contractual language, monitoring and periodic vendor evaluation and qualification.


text: We maintain robust cybersecurity threat procedures, which includes escalating threats to the appropriate level of risk management, mitigation, remediation and the assessment of materiality of cybersecurity threats, or a series of related incidents, that may materially affect or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. We disclose information regarding our cybersecurity and privacy program and practices on our website and in our public-facing notices.


text: As of December 31, 2024, we were not aware of any cybersecurity threats that have materially affected, or are reasonably likely to affect, the Company, including its business strategy, results of operations or financial condition. As discussed more fully under Part 1, Item 1A. Risk Factors, the sophistication of cyber threats continues to increase, and the preventative actions the Company takes to reduce the risk of cyber incidents and protect its systems and information may be insufficient. No matter how well designed or implemented the Company's cybersecurity controls are, it will not be able to anticipate all security breaches, and it may not be able to implement effective preventive measures against cybersecurity breaches in a timely manner. See Part 1,


text: Item 1A. Risk Factors entitled "Risks Related to Intellectual Property, Information Technology and Data Privacy" included elsewhere in this Annual Report on Form 10-K.


text: We have established a corporate governance structure that provides oversight and guidance for our cybersecurity and data privacy program. Our Board of Directors (the "Board") is responsible for the oversight of our cybersecurity and privacy program and risks from cybersecurity threats. Our Board's Audit Committee, which supports the Board in its oversight of our cybersecurity and data privacy program, is focused on cybersecurity and data privacy risk, including incident response planning, and timely identification and assessment of cybersecurity threats, cybersecurity incident recovery and business continuity considerations.